joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10062bd0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100ab00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push edi
mov edi, dword [ebp + 8]
jne 0x10062cd2
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x10062c57
cmp ecx, edi
jne 0x10062c4e
mov edx, dword [eax + 4]
test edx, edx
je 0x10062c1c
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x10062c1c
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x10062c28
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x10062c35
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 8]
test edx, edx
je 0x10062c4e
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x10062c4e
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x10062c01
push esi
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
push 0xc8
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100460d0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x100626a0
push 0
push 0
call esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.10077b59
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10063200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1006322c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1006324e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10063250
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100632d5
jg 0x10063265
test esi, esi
je 0x100632d5
test ecx, ecx
jl 0x100632b8
jg 0x1006326f
test eax, eax
je 0x100632b8
cmp edi, ecx
jg 0x10063283
jl 0x10063279
cmp esi, eax
jae 0x10063283
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x100632d5
jg 0x100632bb
test esi, esi
je 0x100632d5
jmp 0x100632bb
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100632d5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100632f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x1006331c
jl 0x10063310
test esi, esi
jne 0x1006331c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10063335
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x10063375
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10063375
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x1006342c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100633a0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x100633ef
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10063419
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100633c0
cmp dword [ebp - 4], 0
jbe 0x1006342f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100637a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100ab00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100637d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10063800
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10063800
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100638d5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10063829
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10063835
movsx eax, bl
jmp 0x1006386c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100638d5
cmp eax, 1
jle 0x10063896
cmp eax, 3
jne 0x100638d5
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100638b4
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100638d5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100638d5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10077b59
mov esp, ebp
pop ebp
ret 4
Function at 0x10072960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ab00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10072a1c
cmp byte [esi + 0x3d], 0
je 0x10072a1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10072a0a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100729d1
sub eax, 1
je 0x100729d5
sub eax, 2
jne 0x10072a0a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100729f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10072a0a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10077b59
mov esp, ebp
pop ebp
ret
Function at 0x100778f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008677d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100ab00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10077790
cmp byte [ebp - 0x84], 0
jne 0x10077a41
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10077985
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100ac048
call fcn.10077790
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10077790
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x100779f4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10077840
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10077a83
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10077a79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10077a79
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100783a7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10077b59
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x318263c1
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3b30288e
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x6f18af32
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f7eb014]
mov dword [ebp - 0xc], eax
jmp 0x6f18b016
jmp 0x6f18b0ec
jmp 0x6f18b1c2
jmp 0x6f18b298
jmp 0x6f18b36e
jmp 0x6f18b444
jmp 0x6f18b51a
jmp 0x6f18b5f0
jmp 0x6f18b6c6
jmp 0x6f18b79c
jmp 0x6f18b872
jmp 0x6f18b948
jmp 0x6f18ba1e
jmp 0x6f18baf4
jmp 0x6f18bbca
jmp 0x6f18bca0
jmp 0x6f18bd76
jmp 0x6f18be4c
jmp 0x6f18bf22
jmp 0x6f18bff8
jmp 0x6f18c0ce
jmp 0x6f18c1a4
jmp 0x6f18c27a
cmp dword [ebp - 0xc], 0
je 0x6f190fbe
mov eax, dword [0x6f7eb014]
mov dword [0x6f7eb00c], eax
jmp 0x6f18c364
jmp 0x6f18c43a
jmp 0x6f18c510
jmp 0x6f18c5e6
jmp 0x6f18c6bc
jmp 0x6f18c792
jmp 0x6f18c868
jmp 0x6f18c93e
jmp 0x6f18ca14
jmp 0x6f18caea
jmp 0x6f18cbc0
jmp 0x6f18cc96
jmp 0x6f18cd6c
jmp 0x6f18ce42
jmp 0x6f18cf18
jmp 0x6f18cfee
jmp 0x6f18d0c4
jmp 0x6f18d19a
jmp 0x6f18d270
jmp 0x6f18d346
jmp 0x6f18d41c
jmp 0x6f18d4f2
jmp 0x6f18d5c8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x6f7eb008], eax
jmp 0x6f18d6ae
jmp 0x6f18d784
jmp 0x6f18d85a
jmp 0x6f18d930
jmp 0x6f18da06
jmp 0x6f18dadc
jmp 0x6f18dbb2
jmp 0x6f18dc88
jmp 0x6f18dd5e
jmp 0x6f18de34
jmp 0x6f18df0a
jmp 0x6f18dfe0
jmp 0x6f18e0b6
jmp 0x6f18e18c
jmp 0x6f18e262
jmp 0x6f18e338
jmp 0x6f18e40e
jmp 0x6f18e4e4
jmp 0x6f18e5ba
jmp 0x6f18e690
jmp 0x6f18e766
jmp 0x6f18e83c
jmp 0x6f18e912
mov eax, dword [0x6f7eb008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x6f18e9f3
jmp 0x6f18eac9
jmp 0x6f18eb9f
jmp 0x6f18ec75
jmp 0x6f18ed4b
jmp 0x6f18ee21
jmp 0x6f18eef7
jmp 0x6f18efcd
jmp 0x6f18f0a3
jmp 0x6f18f179
jmp 0x6f18f24f
jmp 0x6f18f325
jmp 0x6f18f3fb
jmp 0x6f18f4d1
jmp 0x6f18f5a7
jmp 0x6f18f67d
jmp 0x6f18f753
jmp 0x6f18f829
jmp 0x6f18f8ff
jmp 0x6f18f9d5
jmp 0x6f18faab
jmp 0x6f18fb81
jmp 0x6f18fc57
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x6f7eb004], eax
jmp 0x6f18fd5a
jmp 0x6f18fe30
jmp 0x6f18ff06
jmp 0x6f18ffdc
jmp 0x6f1900b2
jmp 0x6f190188
jmp 0x6f19025e
jmp 0x6f190334
jmp 0x6f19040a
jmp 0x6f1904e0
jmp 0x6f1905b6
jmp 0x6f19068c
jmp 0x6f190762
jmp 0x6f190838
jmp 0x6f19090e
jmp 0x6f1909e4
jmp 0x6f190aba
jmp 0x6f190b90
jmp 0x6f190c66
jmp 0x6f190d3c
jmp 0x6f190e12
jmp 0x6f190ee8
jmp 0x6f190fbe
nop
leave
ret
Function at 0x6f193679
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f7eb008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6f7eb008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6f19376f
jmp 0x6f193845
jmp 0x6f19391b
jmp 0x6f1939f1
jmp 0x6f193ac7
jmp 0x6f193b9d
jmp 0x6f193c73
jmp 0x6f193d49
jmp 0x6f193e1f
jmp 0x6f193ef5
jmp 0x6f193fcb
jmp 0x6f1940a1
jmp 0x6f194177
jmp 0x6f19424d
jmp 0x6f194323
jmp 0x6f1943f9
jmp 0x6f1944cf
jmp 0x6f1945a5
jmp 0x6f19467b
jmp 0x6f194751
jmp 0x6f194827
jmp 0x6f1948fd
jmp 0x6f1949d3
mov dword [ebp - 0x14], 0
jmp 0x6f194ab0
jmp 0x6f194b86
jmp 0x6f194c5c
jmp 0x6f194d32
jmp 0x6f194e08
jmp 0x6f194ede
jmp 0x6f194fb4
jmp 0x6f19508a
jmp 0x6f195160
jmp 0x6f195236
jmp 0x6f19530c
jmp 0x6f1953e2
jmp 0x6f1954b8
jmp 0x6f19558e
jmp 0x6f195664
jmp 0x6f19573a
jmp 0x6f195810
jmp 0x6f1958e6
jmp 0x6f1959bc
jmp 0x6f195a92
jmp 0x6f195b68
jmp 0x6f195c3e
jmp 0x6f195d14
mov dword [ebp - 0x18], 0
jmp 0x6f195df1
jmp 0x6f195ec7
jmp 0x6f195f9d
jmp 0x6f196073
jmp 0x6f196149
jmp 0x6f19621f
jmp 0x6f1962f5
jmp 0x6f1963cb
jmp 0x6f1964a1
jmp 0x6f196577
jmp 0x6f19664d
jmp 0x6f196723
jmp 0x6f1967f9
jmp 0x6f1968cf
jmp 0x6f1969a5
jmp 0x6f196a7b
jmp 0x6f196b51
jmp 0x6f196c27
jmp 0x6f196cfd
jmp 0x6f196dd3
jmp 0x6f196ea9
jmp 0x6f196f7f
jmp 0x6f197055
mov dword [ebp - 0x10], 0
jmp 0x6f197132
jmp 0x6f197208
jmp 0x6f1972de
jmp 0x6f1973b4
jmp 0x6f19748a
jmp 0x6f197560
jmp 0x6f197636
jmp 0x6f19770c
jmp 0x6f1977e2
jmp 0x6f1978b8
jmp 0x6f19798e
jmp 0x6f197a64
jmp 0x6f197b3a
jmp 0x6f197c10
jmp 0x6f197ce6
jmp 0x6f197dbc
jmp 0x6f197e92
jmp 0x6f197f68
jmp 0x6f19803e
jmp 0x6f198114
jmp 0x6f1981ea
jmp 0x6f1982c0
jmp 0x6f198396
mov dword [ebp - 0x10], 0
jmp 0x6f19e40a
jmp 0x6f198478
jmp 0x6f19854e
jmp 0x6f198624
jmp 0x6f1986fa
jmp 0x6f1987d0
jmp 0x6f1988a6
jmp 0x6f19897c
jmp 0x6f198a52
jmp 0x6f198b28
jmp 0x6f198bfe
jmp 0x6f198cd4
jmp 0x6f198daa
jmp 0x6f198e80
jmp 0x6f198f56
jmp 0x6f19902c
jmp 0x6f199102
jmp 0x6f1991d8
jmp 0x6f1992ae
jmp 0x6f199384
jmp 0x6f19945a
jmp 0x6f199530
jmp 0x6f199606
jmp 0x6f1996dc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6f7eb004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6f1997c3
jmp 0x6f199899
jmp 0x6f19996f
jmp 0x6f199a45
jmp 0x6f199b1b
jmp 0x6f199bf1
jmp 0x6f199cc7
jmp 0x6f199d9d
jmp 0x6f199e73
jmp 0x6f199f49
jmp 0x6f19a01f
jmp fcn.6f19a0f5
mov eax, dword [0x6f7eb008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6f1983a2
nop
leave
ret

Function at 0x6f1d4c50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6f7ea040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6f1d4cb0
Function at 0x6f1d4cb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6f7eb378]
test esi, esi
jle 0x6f1d4d9d
mov edi, dword [0x6f7eb37c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6f1d4ce4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6f1d4d96
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6f1d4cd0
mov dword [esp], eax
mov esi, eax
call fcn.6f1d5450
test eax, eax
mov edi, eax
je 0x6f1d4dda
mov esi, dword [0x6f7eb37c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6f1d5560
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6f7eb37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6f1d4dba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6f1d4d8f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6f1d4d8f
mov eax, dword [esp + 0x20]
add ebx, dword [0x6f7eb37c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6f1d4da4
add dword [0x6f7eb378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6f1d4cee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6f1d4c50
mov eax, dword [0x6f7eb37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6f1d4c50
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6f1d4c50
lea esi, [esi]

Function at 0x6f1d50c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6f7eb388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6f7eb380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6f1d5115
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6f1d510e
test esi, esi
je 0x6f1d510e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6f1d50f0
mov dword [esp], 0x6f7eb388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5fedf970
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5feed898]
jne 0x5fedf979
ret
jmp fcn.5fedf980
Function at 0x401184
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004090e0
mov eax, dword [0x244fc5c]
mov ecx, dword [0x244f6e8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x401243
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x244fc5c], 0x959
jne 0x401232
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401061
add ebx, 8
dec edi
jne 0x4011b0
pop edi
pop ebx
pop esi
leave
ret