joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e03f200
Capabilities:
Print debug messages
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07289b], 0
push ebx
push edi
mov edi, ecx
mov ebx, 0x6e072488
jne 0x6e03f21e
cmp byte [0x6e07289a], 0
je 0x6e03f25b
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f229
mov eax, dword [eax]
push dword [ebp + 8]
push eax
push str.CMemMappedFile__s__mapForReading_numBytes_u_
push ebx
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03f24b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f25b
push ebx
call fcn.6e004210
pop ecx
mov eax, dword [edi]
push esi
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
cmp dword [edi + 0x20], 0
jne 0x6e03f2a9
cmp byte [edi + 0x30], 0
jne 0x6e03f28c
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
jmp 0x6e03f2a5
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f297
mov eax, dword [eax]
push eax
push 0
push 4
call dword [sym.imp.kernel32.dll_OpenFileMappingA]
mov dword [edi + 0x20], eax
cmp dword [edi + 0x20], 0
pop esi
je 0x6e03f2ef
push dword [ebp + 8]
push 0
push 0
push 4
push dword [edi + 0x20]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
test eax, eax
jne 0x6e03f344
cmp byte [0x6e07289b], al
jne 0x6e03f2d5
cmp byte [0x6e07289a], al
je 0x6e03f342
add edi, 4
cmp dword [edi + 0x14], 0x10
jb 0x6e03f2e0
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.CMemMappedFile__s__ERROR_MAPPING_FILE_FOR_READING__err_u_
jmp 0x6e03f319
cmp byte [0x6e07289b], 0
jne 0x6e03f301
cmp byte [0x6e07289a], 0
je 0x6e03f342
add edi, 4
cmp dword [edi + 0x14], 0x10
jb 0x6e03f30c
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.CMemMappedFile__s__ERROR_OPENING_FILE_FOR_READING__err_u_
push ebx
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03f332
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f342
push ebx
call fcn.6e004210
pop ecx
xor eax, eax
pop edi
pop ebx
pop ebp
ret 4
Function at 0x6e03f350
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07289b], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov esi, 0x6e072488
jne 0x6e03f372
cmp byte [0x6e07289a], 0
je 0x6e03f3ad
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f37d
mov eax, dword [eax]
push ebx
push eax
push str.CMemMappedFile__s__mapForWriting_numBytes_u_
push esi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03f39d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f3ad
push esi
call fcn.6e004210
pop ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
cmp dword [edi + 0x20], 0
jne 0x6e03f400
cmp byte [edi + 0x30], 0
jne 0x6e03f3dd
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
jmp 0x6e03f3f6
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f3e8
mov eax, dword [eax]
push eax
push 0
push 2
call dword [sym.imp.kernel32.dll_OpenFileMappingA]
mov dword [edi + 0x20], eax
cmp dword [edi + 0x20], 0
je 0x6e03f4a0
push ebx
push 0
push 0
push 2
push dword [edi + 0x20]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
test eax, eax
je 0x6e03f474
cmp byte [0x6e07289b], 0
jne 0x6e03f429
cmp byte [0x6e07289a], 0
je 0x6e03f469
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f434
mov eax, dword [eax]
push ebx
push eax
push str.CMemMappedFile__s__mapped_for_writing__u_bytes
mov esi, 0x6e072488
push esi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03f459
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f469
push esi
call fcn.6e004210
pop ecx
mov eax, dword [edi + 0x28]
mov dword [edi + 0x2c], ebx
jmp 0x6e03f4fa
cmp byte [0x6e07289b], 0
jne 0x6e03f486
cmp byte [0x6e07289a], 0
je 0x6e03f4f8
add edi, 4
cmp dword [edi + 0x14], 0x10
jb 0x6e03f491
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.CMemMappedFile__s__ERROR_MAPPING_FILE_FOR_WRITING__err_u_
jmp 0x6e03f4ca
cmp byte [0x6e07289b], 0
jne 0x6e03f4b2
cmp byte [0x6e07289a], 0
je 0x6e03f4f8
add edi, 4
cmp dword [edi + 0x14], 0x10
jb 0x6e03f4bd
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.CMemMappedFile__s__ERROR_OPENING_FILE_FOR_WRITING__err_u_
mov esi, 0x6e072488
push esi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03f4e8
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f4f8
push esi
call fcn.6e004210
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x6e03f580
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x28], edi
je 0x6e03f5fc
cmp byte [0x6e07289b], 0
jne 0x6e03f59d
cmp byte [0x6e07289a], 0
je 0x6e03f5de
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f5a8
mov eax, dword [eax]
push ebx
push eax
push str.CMemMappedFile__s__unmap
mov ebx, 0x6e072488
push ebx
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03f5cd
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f5dd
push ebx
call fcn.6e004210
pop ecx
pop ebx
cmp dword [esi + 0x2c], edi
jbe 0x6e03f5f0
push dword [esi + 0x2c]
push edi
call dword [sym.imp.kernel32.dll_FlushViewOfFile]
mov dword [esi + 0x2c], edi
push dword [esi + 0x28]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov dword [esi + 0x28], edi
pop edi
pop esi
ret

Function at 0x6e03f600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07289b], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov esi, 0x6e072488
jne 0x6e03f622
cmp byte [0x6e07289a], 0
je 0x6e03f660
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f62d
mov eax, dword [eax]
push ebx
push dword [ebp + 0xc]
push eax
push str.CMemMappedFile__s__writeBytes_offset_u__length_u_
push esi
call fcn.6e01daf9
add esp, 0x14
cmp byte [0x6e07289a], 0
je 0x6e03f650
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f660
push esi
call fcn.6e004210
pop ecx
mov ecx, dword [edi]
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
mov ecx, eax
test ecx, ecx
je 0x6e03f6a4
mov eax, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
add eax, ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [edi]
add esp, 0xc
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
mov al, 1
jmp 0x6e03f6fb
cmp byte [0x6e07289b], 0
jne 0x6e03f6b6
cmp byte [0x6e07289a], 0
je 0x6e03f6f9
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f6c1
mov eax, dword [eax]
push ebx
push dword [ebp + 0xc]
mov esi, 0x6e072488
push eax
push str.CMemMappedFile__s__ERROR_WRITING__NO_MEMORY_MAPPED_FILE_
push esi
call fcn.6e01daf9
add esp, 0x14
cmp byte [0x6e07289a], 0
je 0x6e03f6e9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f6f9
push esi
call fcn.6e004210
pop ecx
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x6e040694
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x6e072cac], 0
jne 0x6e040703
push ebx
call fcn.6e01daf9
xor ebx, ebx
mov byte [0x6e072cad], al
inc ebx
test al, al
jne 0x6e0406fc
call fcn.6e04943a
cmp eax, 0x6b
jl 0x6e0406fc
xor eax, eax
mov byte [ebp - 2], al
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 2]
push eax
call fcn.6e01daf9
add esp, 0x10
test al, al
je 0x6e0406fc
movzx eax, byte [0x6e072cad]
cmp byte [ebp - 1], 0
cmovne eax, ebx
mov byte [0x6e072cad], al
mov byte [0x6e072cac], bl
pop ebx
cmp byte [0x6e07289b], 0
jne 0x6e040715
cmp byte [0x6e07289a], 0
je 0x6e04074f
cmp byte [0x6e072cad], 0
mov ecx, str.FALSE
push esi
mov eax, str.TRUE
mov esi, 0x6e0728a0
cmove eax, ecx
push eax
push str.IsRunningInAppContainer___s
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e04074e
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop esi
mov al, byte [0x6e072cad]
leave
ret
Function at 0x6e041fe9
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x440
mov eax, 0x6e04fe22
call fcn.6e04ad1a
mov eax, dword [ebp + 8]
mov esi, 0x208
mov dword [ebp - 0x438], eax
xor edi, edi
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x424]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x430], xmm0
push eax
push 0x20019
push edi
push 0x6e05ea38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6e042208
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
mov ebx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x6e0420f5
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
fstp qword [ebp - 0x44c]
movsd xmm0, qword [ebp - 0x44c]
comisd xmm0, xmmword [0x6e05ecf8]
pop ecx
jbe 0x6e0420e1
comisd xmm0, xmmword [ebp - 0x430]
jbe 0x6e0420e1
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
inc ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x6e04208d
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x6e042208
push str.ClientUserInterface
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
mov dword [ebp - 0x42c], edi
push 2
pop edx
lea ebx, [eax + 0x105]
mov dword [ebp - 4], edi
add ebx, esi
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov esi, eax
mov dword [ebp - 0x42c], esi
pop ecx
pop ecx
test esi, esi
je 0x6e042208
push ebx
push edi
push esi
call fcn.6e01daf9
push str.SoftwareMicrosoftSoftGrid_
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.ClientUserInterface
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6e042201
push dword [ebp - 0x438]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.6e042240
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.6e042240
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.6e04b0be
pop ecx
call fcn.6e04ac67
ret
Function at 0x6e042240
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x6e04fe4c
call fcn.6e04ace3
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6e042385
cmp dword [ebp - 0x18], 1
jne 0x6e042385
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x6e042385
push dword [ebp - 0x14]
push ebx
push esi
call fcn.6e01daf9
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6e04237a
cmp dword [ebp - 0x18], 1
jne 0x6e04237a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [edi], eax
pop ecx
test eax, eax
je 0x6e04237a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.6e01daf9
lea eax, [ebp - 0x20]
push eax
push 0x6e05ea34
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x6e04235e
push ebx
call fcn.6e01daf9
pop ecx
test al, al
je 0x6e04235e
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x6e04237a
push dword [edi]
call fcn.6e04b0be
and dword [edi], 0
pop ecx
jmp 0x6e04237a
test esi, esi
je 0x6e042385
push esi
call fcn.6e04b0be
pop ecx
call fcn.6e04ac41
ret

Function at 0x6e042aab
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x6e05e77c
xor esi, esi
call fcn.6e01daf9
pop ecx
test eax, eax
jne 0x6e042acc
push 0x6e05e794
call fcn.6e01daf9
pop ecx
test eax, eax
je 0x6e042acf
xor esi, esi
inc esi
cmp byte [0x6e07289b], 0
jne 0x6e042ae1
cmp byte [0x6e07289a], 0
je 0x6e042b17
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x6e072cb8
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e042b06
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e042b16
push edi
call fcn.6e004210
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x6e044ecc
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x6e044f4a
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x6e044f4a
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x6e07289b], 0
jne 0x6e044f0e
cmp byte [0x6e07289a], 0
je 0x6e044f45
movzx eax, bl
mov esi, 0x6e073820
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e044f35
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e044f45
push esi
call fcn.6e004210
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x6e07289b], 0
jne 0x6e044f5c
cmp byte [0x6e07289a], 0
je 0x6e044f8e
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x6e073820
push esi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e044f7e
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e044f8e
push esi
call fcn.6e004210
pop ecx
mov al, 1
pop esi
ret
Function at 0x6e0495c9
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x6e0495e6
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x6e07289b], 0
jne 0x6e0495fc
cmp byte [0x6e07289a], 0
je 0x6e04973b
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x6e073c78
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e049622
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e04963b
push edi
call fcn.6e004210
cmp byte [0x6e07289b], 0
pop ecx
jne 0x6e049644
cmp byte [0x6e07289a], 0
je 0x6e049664
push 4
push str.sizeof_Uns32____d
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e049664
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e04967d
push edi
call fcn.6e004210
cmp byte [0x6e07289b], 0
pop ecx
jne 0x6e049686
cmp byte [0x6e07289a], 0
je 0x6e0496a6
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e0496a6
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e0496bf
push edi
call fcn.6e004210
cmp byte [0x6e07289b], 0
pop ecx
jne 0x6e0496c8
cmp byte [0x6e07289a], 0
je 0x6e0496e8
push 4
push str.sizeof_Handle32____d
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e0496e8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e049701
push edi
call fcn.6e004210
cmp byte [0x6e07289b], 0
pop ecx
jne 0x6e04970a
cmp byte [0x6e07289a], 0
je 0x6e04972a
push 4
push str.sizeof_void____d
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e04972a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e04973a
push edi
call fcn.6e004210
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x6e0497d4
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x6e04e43a
call fcn.6e04acac
cmp byte [0x6e07289b], 0
mov ebx, 0x6e073c78
mov edi, dword [ebp + 8]
jne 0x6e0497ff
mov al, byte [0x6e07289a]
test al, al
jne 0x6e0497ff
lea esi, [edi + 4]
jmp 0x6e049816
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.6e01daf9
mov al, byte [0x6e07289a]
add esp, 0xc
test al, al
je 0x6e049821
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e049831
push ebx
call fcn.6e004210
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.6e01daf9
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.6e03e93e
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x6e049864
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x6e052870]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.6e010d54
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.6e04ac56
ret
Function at 0x6e04987a
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x6e050124
call fcn.6e04acac
cmp byte [0x6e07289b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x6e0498a7
cmp byte [0x6e07289a], 0
je 0x6e0498f6
call fcn.6e01daf9
test al, al
mov edx, 0x6e053800
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x6e073c78
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e0498e2
push 0x6e073c78
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e0498f6
push 0x6e073c78
call fcn.6e004210
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.6e01daf9
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.6e03e93e
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.6e010d54
test ebx, ebx
jne 0x6e049974
cmp byte [0x6e07289b], bl
jne 0x6e049940
cmp byte [0x6e07289a], bl
je 0x6e0499e8
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x6e073c78
push ebx
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e049962
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e0499e8
push ebx
call fcn.6e004210
pop ecx
jmp 0x6e0499e8
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x6e052870]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x6e0499a3
cmp byte [0x6e07289b], al
jne 0x6e04999c
cmp byte [0x6e07289a], al
je 0x6e0499e8
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x6e049945
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6e052870]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x6e0499d8
cmp byte [0x6e07289b], al
jne 0x6e0499ce
cmp byte [0x6e07289a], al
je 0x6e0499e8
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x6e049945
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.6e04ac56
ret
Function at 0x10006ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 7
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x10006aee
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x10006b14
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10006b00
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.10004ee0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10006b34
add eax, 0x20
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.1001c59c
int3