joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f58e2d0
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov r9, rdx
mov dword [rsp + 0x20], 6
xor edx, edx
mov rbx, rcx
call dbg.sha384_addbits_and_close
mov r9, qword [0x6f734320]
mov r10, qword [0x6f734328]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0x80], r9
mov qword [rbx + 0x88], r10
mov r9, qword [0x6f734330]
mov r10, qword [0x6f734338]
mov qword [rbx + 0x90], r9
mov qword [rbx + 0x98], r10
mov r9, qword [0x6f734340]
mov r10, qword [0x6f734348]
mov qword [rbx + 0xa0], r9
mov qword [rbx + 0xa8], r10
mov r9, qword [0x6f734350]
mov r10, qword [0x6f734358]
mov qword [rbx + 0xb0], r9
mov qword [rbx + 0xb8], r10
add rsp, 0x30
pop rbx
ret

Function at 0x6f58e370
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x20], 6
mov rbx, rcx
call dbg.sha384_addbits_and_close
mov r9, qword [0x6f734320]
mov r10, qword [0x6f734328]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0x80], r9
mov qword [rbx + 0x88], r10
mov r9, qword [0x6f734330]
mov r10, qword [0x6f734338]
mov qword [rbx + 0x90], r9
mov qword [rbx + 0x98], r10
mov r9, qword [0x6f734340]
mov r10, qword [0x6f734348]
mov qword [rbx + 0xa0], r9
mov qword [rbx + 0xa8], r10
mov r9, qword [0x6f734350]
mov r10, qword [0x6f734358]
mov qword [rbx + 0xb0], r9
mov qword [rbx + 0xb8], r10
add rsp, 0x30
pop rbx
ret

Function at 0x6f58e410
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov r9, rdx
mov dword [rsp + 0x20], 8
xor edx, edx
mov rbx, rcx
call dbg.sha384_addbits_and_close
mov r9, qword [0x6f7342e0]
mov r10, qword [0x6f7342e8]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0x80], r9
mov qword [rbx + 0x88], r10
mov r9, qword [0x6f7342f0]
mov r10, qword [0x6f7342f8]
mov qword [rbx + 0x90], r9
mov qword [rbx + 0x98], r10
mov r9, qword [0x6f734300]
mov r10, qword [0x6f734308]
mov qword [rbx + 0xa0], r9
mov qword [rbx + 0xa8], r10
mov r9, qword [0x6f734310]
mov r10, qword [0x6f734318]
mov qword [rbx + 0xb0], r9
mov qword [rbx + 0xb8], r10
add rsp, 0x30
pop rbx
ret

Function at 0x6f58e4b0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x20], 8
mov rbx, rcx
call dbg.sha384_addbits_and_close
mov r9, qword [0x6f7342e0]
mov r10, qword [0x6f7342e8]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0x80], r9
mov qword [rbx + 0x88], r10
mov r9, qword [0x6f7342f0]
mov r10, qword [0x6f7342f8]
mov qword [rbx + 0x90], r9
mov qword [rbx + 0x98], r10
mov r9, qword [0x6f734300]
mov r10, qword [0x6f734308]
mov qword [rbx + 0xa0], r9
mov qword [rbx + 0xa8], r10
mov r9, qword [0x6f734310]
mov r10, qword [0x6f734318]
mov qword [rbx + 0xb0], r9
mov qword [rbx + 0xb8], r10
add rsp, 0x30
pop rbx
ret
Function at 0x6f5a7a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.haval3_close

Function at 0x6f5a7b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.haval4_close

Function at 0x6f5a7bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.haval5_close
Function at 0x6f5b10b0
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x38
mov rax, qword [0x6f7534a0]
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
movabs rdx, 0x6a09e667f3bcc908
mov qword [rcx], 0
mov qword [rcx + 0x28], 0
mov qword [rcx + 0x40], rdx
movabs rdx, 0xbb67ae8584caa73b
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x48], rdx
movabs rdx, 0x3c6ef372fe94f82b
mov qword [rcx + 0x38], 0
mov qword [rcx + 0x50], rdx
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x58], rdx
movabs rdx, 0x510e527fade682d1
mov qword [rcx + 0x60], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x68], rdx
movabs rdx, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x70], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x78], rdx
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rax]
jne 0x6f5b1183
add rsp, 0x38
ret
call sym.__stack_chk_fail
nop
nop dword [rax]
Function at 0x6f5b27d0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, qword [0x6f7534a0]
mov rbx, rcx
mov rsi, rdx
mov rbp, r9
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
xor eax, eax
lea rax, [r9 + r9*2]
shl rax, 5
test r9, r9
lea rdi, [r8 + rax - 0x60]
je 0x6f5b2932
xor r13d, r13d
mov rax, qword [rsi]
xor qword [rbx], rax
mov rcx, rbx
mov rax, qword [rsi + 8]
xor qword [rbx + 8], rax
add r13, 1
mov rax, qword [rsi + 0x10]
xor qword [rbx + 0x10], rax
add rsi, 0x60
mov rax, qword [rsi - 0x48]
sub rdi, 0x60
xor qword [rbx + 0x18], rax
mov rax, qword [rsi - 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsi - 0x38]
xor qword [rbx + 0x28], rax
mov rax, qword [rsi - 0x30]
xor qword [rbx + 0x30], rax
mov rax, qword [rsi - 0x28]
xor qword [rbx + 0x38], rax
mov rax, qword [rsi - 0x20]
xor qword [rbx + 0x40], rax
mov rax, qword [rsi - 0x18]
xor qword [rbx + 0x48], rax
mov rax, qword [rsi - 0x10]
xor qword [rbx + 0x50], rax
mov rax, qword [rsi - 8]
xor qword [rbx + 0x58], rax
call dbg.reducedBlake2bLyra(unsigned long long*)
mov rax, qword [rsi - 0x60]
xor rax, qword [rbx]
mov qword [rdi + 0x60], rax
mov rax, qword [rsi - 0x58]
xor rax, qword [rbx + 8]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi - 0x50]
xor rax, qword [rbx + 0x10]
mov qword [rdi + 0x70], rax
mov rax, qword [rsi - 0x48]
xor rax, qword [rbx + 0x18]
mov qword [rdi + 0x78], rax
mov rax, qword [rsi - 0x40]
xor rax, qword [rbx + 0x20]
mov qword [rdi + 0x80], rax
mov rax, qword [rsi - 0x38]
xor rax, qword [rbx + 0x28]
mov qword [rdi + 0x88], rax
mov rax, qword [rsi - 0x30]
xor rax, qword [rbx + 0x30]
mov qword [rdi + 0x90], rax
mov rax, qword [rsi - 0x28]
xor rax, qword [rbx + 0x38]
mov qword [rdi + 0x98], rax
mov rax, qword [rsi - 0x20]
xor rax, qword [rbx + 0x40]
mov qword [rdi + 0xa0], rax
mov rax, qword [rsi - 0x18]
xor rax, qword [rbx + 0x48]
mov qword [rdi + 0xa8], rax
mov rax, qword [rsi - 0x10]
xor rax, qword [rbx + 0x50]
mov qword [rdi + 0xb0], rax
mov rax, qword [rsi - 8]
xor rax, qword [rbx + 0x58]
mov qword [rdi + 0xb8], rax
cmp rbp, r13
jne 0x6f5b2810
mov rax, qword [rsp + 0x28]
xor rax, qword [r12]
jne 0x6f5b294a
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call sym.__stack_chk_fail
nop
Function at 0x6f5b2b70
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, qword [0x6f7534a0]
mov r12, qword [rsp + 0x90]
mov rbx, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
mov rax, qword [r13]
mov qword [rsp + 0x28], rax
xor eax, eax
test r12, r12
je 0x6f5b2d1b
xor r14d, r14d
mov rax, qword [rsi]
add rax, qword [rbp]
mov rcx, rbx
xor qword [rbx], rax
mov rax, qword [rsi + 8]
add rax, qword [rbp + 8]
xor qword [rbx + 8], rax
mov rax, qword [rsi + 0x10]
add rax, qword [rbp + 0x10]
xor qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x18]
add rax, qword [rbp + 0x18]
xor qword [rbx + 0x18], rax
mov rax, qword [rsi + 0x20]
add rax, qword [rbp + 0x20]
xor qword [rbx + 0x20], rax
mov rax, qword [rsi + 0x28]
add rax, qword [rbp + 0x28]
xor qword [rbx + 0x28], rax
mov rax, qword [rsi + 0x30]
add rax, qword [rbp + 0x30]
xor qword [rbx + 0x30], rax
mov rax, qword [rsi + 0x38]
add rax, qword [rbp + 0x38]
xor qword [rbx + 0x38], rax
mov rax, qword [rsi + 0x40]
add rax, qword [rbp + 0x40]
xor qword [rbx + 0x40], rax
mov rax, qword [rsi + 0x48]
add rax, qword [rbp + 0x48]
xor qword [rbx + 0x48], rax
mov rax, qword [rsi + 0x50]
add rax, qword [rbp + 0x50]
xor qword [rbx + 0x50], rax
mov rax, qword [rsi + 0x58]
add rax, qword [rbp + 0x58]
xor qword [rbx + 0x58], rax
call dbg.reducedBlake2bLyra(unsigned long long*)
mov rax, qword [rbx]
xor qword [rdi], rax
mov rax, qword [rbx + 8]
xor qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
xor qword [rdi + 0x38], rax
add r14, 1
mov rax, qword [rbx + 0x40]
xor qword [rdi + 0x40], rax
add rbp, 0x60
mov rax, qword [rbx + 0x48]
xor qword [rdi + 0x48], rax
mov rax, qword [rbx + 0x50]
xor qword [rdi + 0x50], rax
mov rax, qword [rbx + 0x58]
xor qword [rdi + 0x58], rax
add rdi, 0x60
mov rax, qword [rbx + 0x58]
xor qword [rsi], rax
mov rax, qword [rbx]
xor qword [rsi + 8], rax
mov rax, qword [rbx + 8]
xor qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x10]
xor qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x18]
xor qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x20]
xor qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x28]
xor qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x30]
xor qword [rsi + 0x38], rax
mov rax, qword [rbx + 0x38]
xor qword [rsi + 0x40], rax
mov rax, qword [rbx + 0x40]
xor qword [rsi + 0x48], rax
mov rax, qword [rbx + 0x48]
xor qword [rsi + 0x50], rax
mov rax, qword [rbx + 0x50]
xor qword [rsi + 0x58], rax
add rsi, 0x60
cmp r12, r14
jne 0x6f5b2bb0
mov rax, qword [rsp + 0x28]
xor rax, qword [r13]
jne 0x6f5b2d35
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call sym.__stack_chk_fail
nop
nop dword [rax + rax]
Function at 0x6f5b5b40
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov r9, rdx
mov dword [rsp + 0x20], 8
xor edx, edx
mov rbx, rcx
call dbg.sha224_addbits_and_close
mov rax, qword [0x6f736620]
mov rdx, qword [0x6f736628]
mov qword [rbx + 0x60], 0
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rdx
mov rax, qword [0x6f736630]
mov rdx, qword [0x6f736638]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdx
add rsp, 0x30
pop rbx
ret

Function at 0x6f5b5ba0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x20], 8
mov rbx, rcx
call dbg.sha224_addbits_and_close
mov rax, qword [0x6f736620]
mov rdx, qword [0x6f736628]
mov qword [rbx + 0x60], 0
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rdx
mov rax, qword [0x6f736630]
mov rdx, qword [0x6f736638]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdx
add rsp, 0x30
pop rbx
ret
Function at 0x6f5b88a0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
xor eax, eax
lea rbp, [rsp + 0x60]
mov rbx, rdx
mov rsi, r8
nop dword [rax]
mov rdx, qword [rcx + rax]
xor rdx, qword [rbx + rax]
mov qword [rbp + rax], rdx
add rax, 8
cmp rax, 0x40
jne 0x6f5b88c0
mov rcx, rbp
lea r12, [rsp + 0x20]
call dbg.F
xor eax, eax
nop word cs:[rax + rax]
mov rdx, qword [rsi + rax]
xor rdx, qword [rbp + rax]
mov qword [r12 + rax], rdx
add rax, 8
cmp rax, 0x40
jne 0x6f5b88f0
lea r13, [0x6f736660]
lea rdi, [r13 + 0x300]
mov rcx, r12
call dbg.F
xor eax, eax
nop
mov rdx, qword [rbp + rax]
xor rdx, qword [r13 + rax]
mov qword [rbp + rax], rdx
add rax, 8
cmp rax, 0x40
jne 0x6f5b8920
mov rcx, rbp
call dbg.F
xor eax, eax
mov rdx, qword [r12 + rax]
xor rdx, qword [rbp + rax]
mov qword [r12 + rax], rdx
add rax, 8
cmp rax, 0x40
jne 0x6f5b8943
add r13, 0x40
cmp rdi, r13
jne 0x6f5b8915
xor eax, eax
mov rdx, qword [r12 + rax]
xor rdx, qword [rbx + rax]
mov qword [r12 + rax], rdx
add rax, 8
cmp rax, 0x40
jne 0x6f5b8965
xor eax, eax
nop dword [rax]
mov rdx, qword [r12 + rax]
xor rdx, qword [rsi + rax]
mov qword [rbx + rax], rdx
add rax, 8
cmp rax, 0x40
jne 0x6f5b8980
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x6f5bf1b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [rdx + 0x10]
mov rbx, qword [rdx + 8]
mov rdi, rcx
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x18]
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rax
movabs rax, 0xbb67ae856a09e667
mov qword [rsp + 0x28], rbx
mov qword [rdi + 0x68], rax
movabs rax, 0xa54ff53a3c6ef372
mov qword [rsp + 0x20], rcx
mov qword [rdi + 0x70], rax
movabs rax, 0x9b05688c510e527f
lea rcx, [rdi + 0x68]
mov qword [rdi + 0x78], rax
movabs rax, 0x5be0cd191f83d9ab
mov qword [rsp + 0x38], rdx
mov qword [rdi + 0x80], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rdi + 0xc8], 0
mov rsi, rbp
mov rbx, rbp
nop word [rax + rax]
xor byte [rbx], 0x5c
add rbx, 1
cmp rbx, rax
jne 0x6f5bf260
mov r8d, 0x40
mov rdx, rbp
call dbg.secp256k1_sha256_write
movabs rax, 0xbb67ae856a09e667
mov qword [rdi + 0x60], 0
mov qword [rdi], rax
movabs rax, 0xa54ff53a3c6ef372
mov qword [rdi + 8], rax
movabs rax, 0x9b05688c510e527f
mov qword [rdi + 0x10], rax
movabs rax, 0x5be0cd191f83d9ab
mov qword [rdi + 0x18], rax
nop dword [rax]
xor byte [rsi], 0x6a
add rsi, 1
cmp rsi, rbx
jne 0x6f5bf2c0
mov r8d, 0x40
mov rdx, rbp
mov rcx, rdi
call dbg.secp256k1_sha256_write
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6f5dfab0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
jle 0x6f5dfbf1
lea eax, [r8 - 1]
xor r9d, r9d
xor r8d, r8d
lea r10, [rax*8 + 8]
add rax, 1
and eax, 7
je 0x6f5dfb62
cmp rax, 1
je 0x6f5dfb4b
cmp rax, 2
je 0x6f5dfb3c
cmp rax, 3
je 0x6f5dfb2d
cmp rax, 4
je 0x6f5dfb1e
cmp rax, 5
je 0x6f5dfb0f
cmp rax, 6
jne 0x6f5dfbe0
mov r11, qword [rdx + r8]
xor r11d, dword [rcx + r8]
add r8, 8
or r9d, r11d
mov rax, qword [rdx + r8]
xor eax, dword [rcx + r8]
add r8, 8
or r9d, eax
mov r11, qword [rdx + r8]
xor r11d, dword [rcx + r8]
add r8, 8
or r9d, r11d
mov rax, qword [rdx + r8]
xor eax, dword [rcx + r8]
add r8, 8
or r9d, eax
mov r11, qword [rdx + r8]
xor r11d, dword [rcx + r8]
add r8, 8
or r9d, r11d
mov rax, qword [rdx + r8]
xor eax, dword [rcx + r8]
add r8, 8
or eax, r9d
cmp r10, r8
mov r9d, eax
je 0x6f5dfbd4
mov rax, qword [rdx + r8]
xor eax, dword [rcx + r8]
mov r11, qword [rdx + r8 + 8]
xor r11d, dword [rcx + r8 + 8]
or eax, r9d
mov r9, qword [rdx + r8 + 0x10]
xor r9d, dword [rcx + r8 + 0x10]
or r11d, eax
mov rax, qword [rdx + r8 + 0x18]
xor eax, dword [rcx + r8 + 0x18]
or r11d, r9d
mov r9, qword [rdx + r8 + 0x28]
xor r9d, dword [rcx + r8 + 0x28]
or eax, r11d
mov r11, qword [rdx + r8 + 0x20]
xor r11d, dword [rcx + r8 + 0x20]
or eax, r11d
or r9d, eax
mov rax, qword [rdx + r8 + 0x30]
xor eax, dword [rcx + r8 + 0x30]
or r9d, eax
mov rax, qword [rdx + r8 + 0x38]
xor eax, dword [rcx + r8 + 0x38]
add r8, 0x40
or eax, r9d
cmp r10, r8
mov r9d, eax
jne 0x6f5dfb62
test eax, eax
mov edx, 2
cmovne eax, edx
ret
mov r9, qword [rdx]
mov r8d, 8
xor r9d, dword [rcx]
jmp 0x6f5dfb00
xor eax, eax
ret
Function at 0x6f611fd0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
add rsp, 0xffffffffffffff80
xor r8d, r8d
xor edx, edx
mov r9d, 1
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x6f612030
mov rcx, qword [rsp + 0x38]
lea rbx, [rsp + 0x40]
test rcx, rcx
jne 0x6f612063
call sym.core_get
mov edx, 0x40
mov dword [rax + 0xfeda8], 0
mov rcx, rbx
call sym.rand_seed
nop
sub rsp, 0xffffffffffffff80
pop rbx
ret
call sym.core_get
lea rcx, [0x6f74c78a]
lea rdx, [0x6f74c778]
mov dword [rax], 1
mov r8d, 0x89
lea rbx, [rsp + 0x40]
call sym.util_printf
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x6f612006
mov r8, rbx
mov edx, 0x40
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x6f6120c0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x6f612006
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x6f612006
call sym.core_get
lea rdx, [0x6f74c778]
lea rcx, [0x6f74c78a]
mov dword [rax], 1
mov r8d, 0x8f
call sym.util_printf
jmp 0x6f612006
call sym.core_get
lea rdx, [0x6f74c778]
lea rcx, [0x6f74c78a]
mov dword [rax], 1
mov r8d, 0x8c
call sym.util_printf
jmp 0x6f612075
Function at 0x6f637180
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x6f78b904]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x6f6372a0
mov rax, qword [0x6f78b908]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x6f6371cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x6f637286
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x6f6371b0
mov rcx, rsi
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6f6372d8
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x6f78b908]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x6f78b908]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6f6372bb
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6f63727f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6f63727f
add rbx, qword [0x6f78b908]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x6f6372a7
add dword [0x6f78b904], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebx, ebx
jmp 0x6f6371d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x6f78b908]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call dbg.__report_error
nop
nop dword [rax + rax]

Function at 0x6f637a30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6f78bbe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6f78bbc0]
test rbx, rbx
je 0x6f637a84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6f637a7b
test rsi, rsi
je 0x6f637a7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6f637a60
lea rcx, [0x6f78bbe0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6f637cc0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6f637cd0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0
Function at 0x6f637ce0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6f637d21
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6f637d18
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x6f637d23
add rax, 0x28
cmp rax, r9
jne 0x6f637d04
xor eax, eax
repz ret

Function at 0x6f637dc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x6f753410]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x6f637de0
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6f637dd8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6f637e3d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x6f637e34
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x6f637dd8
add rdx, 0x28
cmp rdx, r9
jne 0x6f637e20
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x6f637f50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6f753410]
xor eax, eax
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x6f637f70
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6f637f68
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6f637fcd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6f637fc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6f637fd4
add rax, 0x28
cmp rax, r9
jne 0x6f637fb0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6f637ff0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6f753410]
xor r9d, r9d
mov r8d, ecx
cmp word [r11], 0x5a4d
je 0x6f638011
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6f638009
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x6f638009
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6f638009
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x6f638064
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x6f638080
add rdx, 0x28
cmp rdx, r10
jne 0x6f638050
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x6f638098
jmp 0x6f63806d
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x6f6380a6
mov edx, dword [rax + 0xc]
test edx, edx
je 0x6f63806d
test r8d, r8d
jg 0x6f638090
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret