joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e6cebf0
Capabilities:
Parse credit card information

Disassembly:
cmp cx, 0x16
je 0x6e6cee90
jbe 0x6e6cec50
cmp cx, 0x25
je 0x6e6cf080
jbe 0x6e6ced90
cmp cx, 0x44
je 0x6e6cf070
ja 0x6e6ced60
cmp cx, 0x41
je 0x6e6cf060
jbe 0x6e6ceca0
cmp cx, 0x42
je 0x6e6cf050
cmp cx, 0x43
jne 0x6e6cf040
lea rcx, [0x6e6db000]
jmp fcn.6e6ceb70
cmp cx, 0xa
je 0x6e6cf030
ja 0x6e6ced20
cmp cx, 4
je 0x6e6cf020
jbe 0x6e6cece0
cmp cx, 7
je 0x6e6cf010
jbe 0x6e6cecc0
cmp cx, 8
je 0x6e6cf000
cmp cx, 9
jne 0x6e6cf040
lea rcx, [0x6e6db380]
jmp fcn.6e6ceb70
cmp cx, 0x26
je 0x6e6ceff0
cmp cx, 0x40
jne 0x6e6cf040
lea rcx, [0x6e6db060]
jmp fcn.6e6ceb70
cmp cx, 5
je 0x6e6cefe0
cmp cx, 6
jne 0x6e6cf040
lea rcx, [0x6e6db3e0]
jmp fcn.6e6ceb70
cmp cx, 1
je 0x6e6cefd0
test cx, cx
je 0x6e6cefc0
cmp cx, 2
je 0x6e6cefb0
cmp cx, 3
jne 0x6e6cf040
lea rcx, [0x6e6db440]
jmp fcn.6e6ceb70
cmp cx, 0x10
je 0x6e6cefa0
jbe 0x6e6cee60
cmp cx, 0x13
je 0x6e6cef90
jbe 0x6e6cee40
cmp cx, 0x14
je 0x6e6cef80
cmp cx, 0x15
jne 0x6e6cf040
lea rcx, [0x6e6db220]
jmp fcn.6e6ceb70
cmp cx, 0x47
je 0x6e6cef70
jbe 0x6e6cedd0
cmp cx, 0x48
je 0x6e6cef60
cmp cx, 0xfff
jne 0x6e6cf040
lea rcx, [0x6e6daf00]
jmp fcn.6e6ceb70
cmp cx, 0x1b
je 0x6e6cef50
jbe 0x6e6cee10
cmp cx, 0x1e
je 0x6e6cef40
jbe 0x6e6cedf0
cmp cx, 0x1f
je 0x6e6cef30
cmp cx, 0x24
jne 0x6e6cf040
lea rcx, [0x6e6db0c0]
jmp fcn.6e6ceb70
cmp cx, 0x45
je 0x6e6cef20
cmp cx, 0x46
jne 0x6e6cf040
lea rcx, [0x6e6daf60]
jmp fcn.6e6ceb70
cmp cx, 0x1c
je 0x6e6cef10
cmp cx, 0x1d
jne 0x6e6cf040
lea rcx, [0x6e6db120]
jmp fcn.6e6ceb70
cmp cx, 0x18
je 0x6e6cef00
jb 0x6e6ceef0
cmp cx, 0x19
je 0x6e6ceee0
cmp cx, 0x1a
jne 0x6e6cf040
lea rcx, [0x6e6db180]
jmp fcn.6e6ceb70
cmp cx, 0x11
je 0x6e6ceed0
cmp cx, 0x12
jne 0x6e6cf040
lea rcx, [0x6e6db280]
jmp fcn.6e6ceb70
cmp cx, 0xc
je 0x6e6ceec0
jb 0x6e6ceeb0
cmp cx, 0xd
je 0x6e6ceea0
cmp cx, 0xe
jne 0x6e6cf040
lea rcx, [0x6e6db2e0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db200]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db300]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db340]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db320]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db2a0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db1a0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db1e0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db1c0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db140]
jmp fcn.6e6ceb70
lea rcx, [0x6e6daf80]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db0e0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db100]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db160]
jmp fcn.6e6ceb70
lea rcx, [0x6e6daf20]
jmp fcn.6e6ceb70
lea rcx, [0x6e6daf40]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db240]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db260]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db2c0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db460]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db4a0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db480]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db400]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db080]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db3a0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db3c0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db420]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db360]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db560]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db020]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db040]
jmp fcn.6e6ceb70
lea rcx, [0x6e6dafc0]
jmp fcn.6e6ceb70
lea rcx, [0x6e6db0a0]
jmp fcn.6e6ceb70
Function at 0x6e6cf270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.6e6ceb70
test rax, rax
je 0x6e6cf2d7
mov r9, qword [rax]
test r9, r9
jle 0x6e6cf2d7
mov r8, rax
add r9, rbx
sub r8, rbx
nop dword [rax]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, rbx
sar rcx, 8
sar rdx, 0x10
xor ecx, ebx
and edx, 0xffffffee
and ecx, 0xffffffee
xor cl, byte [r8 + rbx + 0x10]
xor ecx, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor ecx, edx
mov byte [r8 + rbx + 0x10], cl
add rbx, 1
cmp rbx, r9
jne 0x6e6cf2a0
add rsp, 0x20
pop rbx
ret
Function at 0x6e6d2680
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rcx, qword [0x6e6eedb0]
test rcx, rcx
je 0x6e6d269d
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.6e6d24b0
lea rcx, [0x6e6eefa0]
call fcn.6e6ceb40
lea rcx, [0x6e6dac00]
mov rbx, rax
mov rsi, qword [rbx + 0x18]
lea rax, [0x6e6ef470]
mov qword [rbx], rax
lea rax, str.ReraiseDefect
mov qword [rbx + 0x10], rax
call fcn.6e6cddb0
test rsi, rsi
mov qword [rbx + 0x18], rax
je 0x6e6d26fc
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
ja 0x6e6d26fc
lea rcx, [0x6e6eb3e8]
call fcn.6e6ccc40
mov qword [rsp + 0x20], 0x35
lea r9, str.fatal.vsf
mov rcx, rbx
lea r8, str.cuskqacy
lea rdx, str.ReraiseDefect
call fcn.6e6d25d0
nop
nop dword [rax]
nop word cs:[rax + rax]

Function at 0x6e6d2730
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x150
cmp qword [0x6e6ef230], 0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov byte [rbp - 0x111], 1
je 0x6e6d282f
mov rax, qword [0x6e6e42d0]
lea rcx, [rbp - 0x110]
mov rdx, rbp
mov qword [0x6e6e42d0], rcx
add rcx, 0x10
mov qword [rbp - 0x110], rax
call sub.msvcrt.dll__setjmp
cdqe
test rax, rax
mov qword [rbp - 0x108], rax
jne 0x6e6d2850
xor ebx, ebx
cmp qword [rbp + 0x20], 0
je 0x6e6d2800
mov rcx, qword [rbp + 0x20]
call sub.msvcrt.dll_strlen
mov edx, 0x18
mov qword [rbp - 0x128], 7
cmp rax, 6
mov rsi, rax
jbe 0x6e6d27ca
lea rdx, [rax + 0x11]
mov qword [rbp - 0x128], rax
lea r8, [0x6e6eb3d0]
lea rcx, [0x6e6d9040]
call fcn.6e6cde40
mov rdx, qword [rbp + 0x20]
movq xmm0, rsi
lea rcx, [rax + 0x10]
movhps xmm0, qword [rbp - 0x128]
mov rbx, rax
movups xmmword [rax], xmm0
lea r8, [rsi + 1]
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [0x6e6ef230]
mov rax, qword [0x6e6e42d0]
mov byte [rbp - 0x111], 0
cmp qword [rbp - 0x108], 0
mov rax, qword [rax]
mov qword [0x6e6e42d0], rax
jne 0x6e6d28c4
movzx eax, byte [rbp - 0x111]
test al, al
jne 0x6e6d28d0
add rsp, 0x150
pop rbx
pop rsi
pop rbp
ret
mov rax, qword [0x6e6e42d0]
mov rax, qword [rax]
mov qword [rbp - 0x108], 0
mov qword [0x6e6e42d0], rax
mov rax, qword [0x6e6eedb0]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x6e6d288d
add qword [rbx - 0x10], 8
mov rax, qword [0x6e6eedb0]
test rax, rax
je 0x6e6d28af
mov rsi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rsi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x6e6d28af
lea rcx, [0x6e6eb3e8]
call fcn.6e6ccc40
cmp qword [rbp - 0x108], 0
mov qword [0x6e6eedb0], rbx
je 0x6e6d282f
call fcn.6e6d2680
jmp 0x6e6d282f
mov ecx, 2
call qword [fcn.6e6d8a00]
mov rcx, qword [rbp + 0x20]
mov edx, 1
mov r8, qword [rbp + 0x28]
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
jmp 0x6e6d283e
Function at 0x6e6d54b0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 0xfb1
xor ebx, ebx
mov r12, rcx
lea rcx, [0x6e6d9040]
call fcn.6e6cdfd0
movdqa xmm0, xmmword [0x6e6dccd0]
lea rbp, [rax + 0x10]
mov rsi, rax
movups xmmword [rax], xmm0
nop dword [rax]
nop word cs:[rax + rax]
mov r9, r12
mov r8d, 0xfa0
mov edx, 1
mov rcx, rbp
call sub.msvcrt.dll_fread
cmp rax, 0xfa0
mov rdi, rax
je 0x6e6d5560
mov rcx, r12
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x6e6d55a4
mov rcx, rsi
mov rdx, rdi
call fcn.6e6d00a0
test rax, rax
mov rsi, rax
je 0x6e6d5590
mov rdx, qword [rax]
mov rcx, rbx
call fcn.6e6d0880
mov rdx, rsi
mov rbx, rax
mov rcx, rax
call fcn.6e6c1f60
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [rsi]
mov rcx, rbx
call fcn.6e6d0880
mov r8, qword [rsi]
mov rdx, rbp
mov rbx, rax
mov rax, qword [rax]
add r8, 1
lea rcx, [rbx + rax + 0x10]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
jmp 0x6e6d54f0
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6e6d0880
mov rcx, r12
call fcn.6e6d5210
nop
nop dword [rax]

Function at 0x6e6d55b0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebp, 7
cmp rdx, 7
mov rbx, rdx
mov rdi, rcx
cmovge rbp, rdx
lea rcx, [0x6e6d9040]
lea rdx, [rbp + 0x11]
call fcn.6e6cdfd0
movq xmm1, rbp
mov r9, rdi
mov r8, rbx
movq xmm0, rbx
mov edx, 1
mov rsi, rax
punpcklqdq xmm0, xmm1
lea rcx, [rax + 0x10]
movups xmmword [rax], xmm0
call sub.msvcrt.dll_fread
mov rcx, rdi
cmp rbx, rax
mov rbp, rax
je 0x6e6d5660
call sub.msvcrt.dll_ferror
mov rcx, rdi
test eax, eax
jne 0x6e6d56d4
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov r12d, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test r12d, r12d
jns 0x6e6d5675
cmp rbx, rbp
jle 0x6e6d56b1
mov rdx, rbp
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6e6d00a0
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov ebx, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test ebx, ebx
js 0x6e6d56b1
mov rcx, rdi
call fcn.6e6d54b0
test rax, rax
mov rbx, rax
je 0x6e6d56c0
mov rdx, qword [rax]
mov rcx, rsi
call fcn.6e6d0880
lea rdx, [rbx + 0x10]
mov rsi, rax
mov rax, qword [rax]
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
add qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor edx, edx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6e6d0880
call fcn.6e6d5210
nop
nop word [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [fcn.6e6d8a00]
cmp rax, rbx
je 0x6e6d5730
mov rcx, rbx
call fcn.6e6d83f0
xor edx, edx
mov r8d, 2
mov rcx, rbx
mov rdi, rax
call fcn.6e6d8640
mov rcx, rbx
call fcn.6e6d83f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.6e6d8640
test rsi, rsi
jg 0x6e6d5740
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.6e6d54b0
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp 0x6e6d55b0
Function at 0x6e6d56e0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ebp, 7
cmp rdx, 7
mov rbx, rdx
mov rdi, rcx
cmovge rbp, rdx
lea rcx, [0x6e6d9040]
lea rdx, [rbp + 0x11]
call fcn.6e6cdfd0
movq xmm1, rbp
mov r9, rdi
mov r8, rbx
movq xmm0, rbx
mov edx, 1
mov rsi, rax
punpcklqdq xmm0, xmm1
lea rcx, [rax + 0x10]
movups xmmword [rax], xmm0
call sub.msvcrt.dll_fread
mov rcx, rdi
cmp rbx, rax
mov rbp, rax
je 0x6e6d5660
call sub.msvcrt.dll_ferror
mov rcx, rdi
test eax, eax
jne 0x6e6d56d4
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov r12d, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test r12d, r12d
jns 0x6e6d5675
cmp rbx, rbp
jle 0x6e6d56b1
mov rdx, rbp
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6e6d00a0
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov ebx, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test ebx, ebx
js 0x6e6d56b1
mov rcx, rdi
call fcn.6e6d54b0
test rax, rax
mov rbx, rax
je 0x6e6d56c0
mov rdx, qword [rax]
mov rcx, rsi
call fcn.6e6d0880
lea rdx, [rbx + 0x10]
mov rsi, rax
mov rax, qword [rax]
lea rcx, [rsi + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
add qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor edx, edx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6e6d0880
call fcn.6e6d5210
nop
nop word [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [fcn.6e6d8a00]
cmp rax, rbx
je 0x6e6d5730
mov rcx, rbx
call fcn.6e6d83f0
xor edx, edx
mov r8d, 2
mov rcx, rbx
mov rdi, rax
call fcn.6e6d8640
mov rcx, rbx
call fcn.6e6d83f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.6e6d8640
test rsi, rsi
jg 0x6e6d5740
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.6e6d54b0
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp 0x6e6d55b0
Function at 0x6e6d72e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6e6e3ca4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6e6d7468
mov rax, qword [0x6e6e3ca8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6e6d732c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6e6d73b5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6e6d7310
mov rcx, rbx
call fcn.6e6d7f80
test rax, rax
mov r12, rax
je 0x6e6d749d
mov rax, qword [0x6e6e3ca8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.6e6d80b0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6e6e3ca8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6e6d7480
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6e6d73ae
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6e6d7410
add dword [0x6e6e3ca4], 1
cmp edi, 8
jae 0x6e6d73e3
test dil, 4
jne 0x6e6d7454
test edi, edi
je 0x6e6d73d8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6e6d746f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6e6d73d8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6e6d73fc
jmp 0x6e6d73d8
add rsi, qword [0x6e6e3ca8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6e6d73ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ruhfdzjjbksdqtjgntknzqasuszltugjq_0x_x
mov edx, eax
call fcn.6e6d8b60
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6e6d73d8
xor esi, esi
jmp 0x6e6d7337
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6e6d73d8
mov rax, qword [0x6e6e3ca8]
lea rcx, str.__xpivkauneborkshlxzl_for__d_egypskqjmuhjzbfs__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.6e6d8b60
lea rcx, str.jyaypryqqlpehteddevrafizrrihsce
mov rdx, rbx
call fcn.6e6d8b60
nop
nop dword [rax]

Function at 0x6e6d7bf0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6e6e3f80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6e6e3f60]
test rbx, rbx
je 0x6e6d7c44
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6e6d7c3b
test rsi, rsi
je 0x6e6d7c3b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6e6d7c20
lea rcx, [0x6e6e3f80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6e6d7f80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6e6dd050]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6e6d7fed
mov rcx, r8
call fcn.6e6d7e60
test eax, eax
je 0x6e6d7fed
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6e6d7fed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6e6d7fe4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6e6d7fef
add rax, 0x28
cmp rax, r9
jne 0x6e6d7fd0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6e6d8b60
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x6e6c13a0]
jmp 0x6e6c1380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6e6d8a00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.prhphgehwejffbwxvjymixpaxv_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.6e6d8a00
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x6e6c1390
Function at 0x140007780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd qword [rsp + 0x20], xmm3
movsd qword [rsp + 0x18], xmm2
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
movsd xmm0, qword [0x140115220]
movsd qword [rsp + 0x48], xmm0
mov dword [rsp + 0x34], 0x291
mov dword [rsp + 0x38], 0x35b
mov dword [rsp + 0x3c], 0xfad
xor eax, eax
cmp eax, 1
je 0x1400077e5
mov dword [rsp + 0x20], 0x54
jmp 0x1400077da
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x1400077e5
jmp 0x1400077d0
xor eax, eax
cmp eax, 1
je 0x14000780b
mov dword [rsp + 0x24], 0x4f
jmp 0x140007800
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x14000780b
jmp 0x1400077f6
xor eax, eax
test eax, eax
je 0x140007830
mov dword [rsp + 0x28], 0xc
jmp 0x140007825
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x140007830
jmp 0x14000781b
xor eax, eax
test eax, eax
je 0x140007855
mov dword [rsp + 0x2c], 0x2c
jmp 0x14000784a
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x140007855
jmp 0x140007840
xor eax, eax
test eax, eax
je 0x14000787a
mov dword [rsp + 0x30], 0x1d
jmp 0x14000786f
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x14000787a
jmp 0x140007865
movsd xmm0, qword [0x140116038]
movsd qword [rsp + 0x40], xmm0
mov rcx, qword [rsp + 0x88]
call fcn.14009b9a0
movsd xmm0, qword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14000c950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov rax, qword [0x140130098]
xor rax, rsp
mov qword [rsp + 0x128], rax
lea rdx, str.vxqouhjvveawohoqxga
lea rcx, [rsp + 0x108]
call fcn.14009a810
mov byte [rsp + 0x23], 0
movsd xmm0, qword [0x140117350]
movsd qword [rsp + 0x58], xmm0
mov dword [rsp + 0x38], 0xe6
mov dword [rsp + 0x3c], 0x1f3
movsd xmm0, qword [0x140115418]
movsd qword [rsp + 0x60], xmm0
lea rdx, [0x1400d05e4]
lea rcx, [rsp + 0xe8]
call fcn.14009a810
mov dword [rsp + 0x40], 0x687
xor eax, eax
test eax, eax
je 0x14000ca02
mov dword [rsp + 0x24], 0x37
jmp 0x14000c9f7
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x14000ca02
jmp 0x14000c9ed
xor eax, eax
test eax, eax
je 0x14000ca27
mov dword [rsp + 0x28], 0x1a
jmp 0x14000ca1c
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14000ca27
jmp 0x14000ca12
xor eax, eax
cmp eax, 1
je 0x14000ca4d
mov dword [rsp + 0x2c], 0x3f
jmp 0x14000ca42
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x14000ca4d
jmp 0x14000ca38
lea rdx, [0x1400d0624]
lea rcx, [rsp + 0x88]
call fcn.14009a810
mov qword [rsp + 0x48], rax
lea rdx, [0x1400d0664]
lea rcx, [rsp + 0x68]
call fcn.14009a810
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov rcx, rax
call fcn.140098340
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x68]
call fcn.14009b9a0
lea rcx, [rsp + 0x88]
call fcn.14009b9a0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14000caca
mov dword [rsp + 0x30], 9
jmp 0x14000cabf
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x14000caca
jmp 0x14000cab5
lea rdx, [0x1400d0a3c]
lea rcx, [rsp + 0xc8]
call fcn.14009a810
mov qword [rsp + 0x50], rax
lea rdx, [0x1400d0a5c]
lea rcx, [rsp + 0xa8]
call fcn.14009a810
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
call fcn.140098370
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0xa8]
call fcn.14009b9a0
lea rcx, [rsp + 0xc8]
call fcn.14009b9a0
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x14000cb4d
mov dword [rsp + 0x34], 0x1e
jmp 0x14000cb42
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x14000cb4d
jmp 0x14000cb38
mov byte [rsp + 0x22], 1
lea rcx, [rsp + 0xe8]
call fcn.14009b9a0
lea rcx, [rsp + 0x108]
call fcn.14009b9a0
mov rcx, qword [rsp + 0x150]
call fcn.14009b9a0
mov rcx, qword [rsp + 0x160]
call fcn.14009b9a0
mov rcx, qword [rsp + 0x168]
call fcn.14009b9a0
movzx eax, byte [rsp + 0x22]
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1400a4b80
add rsp, 0x138
ret
Function at 0x1400110e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov rax, qword [0x140130098]
xor rax, rsp
mov qword [rsp + 0x128], rax
movsd xmm0, qword [0x1401145b8]
movsd qword [rsp + 0x50], xmm0
mov byte [rsp + 0x23], 0
lea rdx, [0x1401092e8]
lea rcx, [rsp + 0x108]
call fcn.14009a810
movsd xmm0, qword [0x140116010]
movsd qword [rsp + 0x58], xmm0
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x38], 0x7a4
mov dword [rsp + 0x3c], 0x189e
movsd xmm0, qword [0x140113ec0]
movsd qword [rsp + 0x60], xmm0
lea rdx, str.mkgayueabfpvelvgsqjlzlmkmwbbrhtdxjetmkkvuclzwjfjpxhygcvxrgizckhirzojgapvmfenguqzcefyxgpbflfjpc
lea rcx, [rsp + 0xe8]
call fcn.14009a810
xor eax, eax
cmp eax, 1
je 0x14001119e
mov dword [rsp + 0x28], 0x2e
jmp 0x140011193
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14001119e
jmp 0x140011189
lea rdx, [0x1401095e0]
lea rcx, [rsp + 0x88]
call fcn.14009a810
mov qword [rsp + 0x40], rax
lea rdx, [0x140109608]
lea rcx, [rsp + 0x68]
call fcn.14009a810
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
mov rcx, rax
call fcn.140098340
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x68]
call fcn.14009b9a0
lea rcx, [rsp + 0x88]
call fcn.14009b9a0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14001121b
mov dword [rsp + 0x2c], 0x4a
jmp 0x140011210
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x14001121b
jmp 0x140011206
xor eax, eax
test eax, eax
je 0x140011240
mov dword [rsp + 0x30], 0x4e
jmp 0x140011235
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x140011240
jmp 0x14001122b
lea rdx, [0x140109648]
lea rcx, [rsp + 0xc8]
call fcn.14009a810
mov qword [rsp + 0x48], rax
lea rdx, str.rsphwupqemyubxdhnhvtbqhcmzcbrlmwho
lea rcx, [rsp + 0xa8]
call fcn.14009a810
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov rcx, rax
call fcn.140098370
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0xa8]
call fcn.14009b9a0
lea rcx, [rsp + 0xc8]
call fcn.14009b9a0
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1400112c3
mov dword [rsp + 0x34], 0x33
jmp 0x1400112b8
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x1400112c3
jmp 0x1400112ae
mov byte [rsp + 0x22], 1
lea rcx, [rsp + 0xe8]
call fcn.14009b9a0
lea rcx, [rsp + 0x108]
call fcn.14009b9a0
mov rcx, qword [rsp + 0x178]
call fcn.14009b9a0
movzx eax, byte [rsp + 0x22]
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1400a4b80
add rsp, 0x138
ret