joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1668
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404738
xor eax, eax
push ebp
push 0x4b17c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x4aeed8]
call fcn.00415ee8
test eax, eax
jl 0x4b16cf
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.004b0a10
and eax, 0x7f
mov eax, dword [eax*4 + 0x4dbcdc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x4b1732
mov eax, dword [ebx]
call fcn.00404548
test eax, eax
jle 0x4b1732
mov eax, dword [ebx]
call fcn.00404548
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x4b16f6
mov eax, ebx
mov edx, 0x4b17d8
call fcn.00404550
mov eax, dword [ebx]
call fcn.00404548
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004050e0
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.004b090c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x4b177d
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4dbdec]
call fcn.004060cc
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a024
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004042dc
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4077e4]
call fcn.0040cb04
call fcn.00403c40
mov eax, dword [ebp - 8]
call fcn.004b15e0
mov ebx, eax
test edi, edi
je 0x4b1792
mov eax, edi
call fcn.00403474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b17c7
lea eax, [ebp - 0x1c]
call fcn.00404288
lea eax, [ebp - 0x18]
call fcn.00405c08
lea eax, [ebp - 0x14]
call fcn.00404288
lea eax, [ebp - 4]
call fcn.00404288
ret

Function at 0x4b23a4
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402e3c
mov dword [esp], 0x3c
mov eax, dword [0x4dc164]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x4b2ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b302a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dc36c]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x4dc36c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00481080
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00446774
xor edx, edx
push ebp
push 0x4b300d
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4b2f7d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405c08
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.004b1028
push eax
mov eax, dword [0x4dc164]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x4b2f73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403cec
jmp 0x4b3014
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b2fb9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00446354
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004b2d50
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x4b2f95
push 0
mov edx, 0x4b2ce8
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00445f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3014
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004467c0
mov eax, dword [0x4dc36c]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.00481080
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3031
lea eax, [ebp - 0x10]
call fcn.00405c08
ret
Function at 0x4b6d08
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404738
xor eax, eax
push ebp
push 0x4b6e25
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b6d95
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
mov ecx, 0x4b6e3c
mov edx, dword [ebp - 4]
call fcn.00404594
mov eax, dword [ebp - 0x24]
call fcn.00404748
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, 8
call fcn.00408d40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6da7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004084d4
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.004042dc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404548
mov ebx, eax
cmp bx, 1
jb 0x4b6e02
movzx eax, bx
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov dl, byte [edx + eax - 1]
add dl, 0xd0
sub dl, 0xa
jb 0x4b6dfc
add dl, 0xf9
sub dl, 0x1a
jb 0x4b6dfc
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.004047e8
dec ebx
test bx, bx
jne 0x4b6dd1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6e2c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004042ac
lea eax, [ebp - 4]
call fcn.00404288
ret
Function at 0x4b75c4
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff68
mov edi, eax
push edi
call sub.user32.dll_IsIconic
test eax, eax
je 0x4b75e2
push 9
push edi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp edi, eax
jne 0x4b75f2
mov bl, 1
jmp 0x4b76e3
xor esi, esi
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4b760e
mov esi, dword [esp + 0x14]
cmp esi, 2
jne 0x4b761a
cmp dword [esp + 8], 4
ja 0x4b763e
dec esi
jne 0x4b76cd
cmp dword [esp + 8], 4
ja 0x4b763e
cmp dword [esp + 8], 4
jne 0x4b76cd
cmp dword [esp + 0xc], 0
jbe 0x4b76cd
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push edi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push esi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4b7685
push edi
call sub.user32.dll_BringWindowToTop
push edi
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp edi, eax
sete bl
test bl, bl
jne 0x4b76d9
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push edi
call sub.user32.dll_BringWindowToTop
push edi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x4b76d9
push edi
call sub.user32.dll_BringWindowToTop
push edi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp edi, eax
sete bl
mov eax, ebx
add esp, 0x98
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b76f0
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x4dc398]
cmp dword [eax], 2
jne 0x4b776a
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4b776a
lea eax, [esp + 0xc]
push eax
push 0x4b7780
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x4b776a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x4c5e08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c5e10
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4c5fb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43ca04]
call fcn.0043cb04
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0043cba4
mov edx, dword [0x4dbda0]
mov edx, dword [edx]
mov cl, 1
mov eax, ebx
call fcn.0043cce8
mov eax, dword [esi + 0x658]
mov edx, dword [eax]
call dword [edx + 0xcc]
inc eax
lea edx, [ebp - 0xc]
call fcn.00408c04
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x4c5fcc
call fcn.00404594
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0043d218
test al, al
je 0x4c5f94
mov dl, 1
mov eax, dword [0x417998]
call fcn.00403444
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x658]
mov edx, dword [eax]
call dword [edx + 0xcc]
inc eax
lea edx, [ebp - 0x1c]
call fcn.00408c04
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4c5fcc
call fcn.00404594
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov eax, ebx
call fcn.0043d0b0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0049c7d0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0041be80
lea ecx, [ebp - 0x20]
mov edx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x20]
mov eax, dword [esi + 0x658]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
lea ecx, [ebp - 0x24]
mov eax, dword [esi + 0x658]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x20]
mov edx, dword [0x4dc000]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
mov ecx, 0x4c5fd8
call fcn.00404594
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 4]
call fcn.00403474
push 3
push 0
push 0
mov edx, dword [0x4dc000]
mov edx, dword [edx]
lea eax, [ebp - 0x2c]
mov ecx, 0x4c5fd8
call fcn.00404594
mov eax, dword [ebp - 0x2c]
call fcn.00404748
push eax
push 0
mov eax, esi
call fcn.00468ebc
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.00403474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5fbd
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.004042ac
ret
Function at 0x4d8ae8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff00
mov ebx, edx
mov edi, eax
push 0
push 0x4d8bf0
call sub.user32.dll_FindWindowA
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4d8b16
push 0
push 0x4d8bf8
call sub.user32.dll_FindWindowA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4d8be3
push 0
push 0x4d8c08
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
jne 0x4d8b49
push 0
push 0x4d8c10
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
jbe 0x4d8be3
push 0
push 0x4d8c18
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4d8c28
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4d8b86
push 0
push 0x4d8c28
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
jbe 0x4d8be3
push 0
push 0x4d8c3c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
jbe 0x4d8be3
push 0
push 0x4d8c4c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
jbe 0x4d8be3
push 0
push 0x4d8c58
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
mov eax, esp
push eax
push 0xff
push 0xd
push esi
call sub.user32.dll_SendMessageA
mov eax, edi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004044f8
add esp, 0x100
pop edi
pop esi
pop ebx
ret
Function at 0x7ffe53be
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
not eax
not eax
and al, 0xff
not eax
not eax
push es
pop ds
xor eax, ecx
xor eax, ecx
push eax
pop eax
push bx
inc esp
inc esp
inc esi
dec esi
add al, 4
sub al, 4
and al, 0xff
push bx
inc esp
inc esp
push eax
pop eax
pushf
popf
inc esi
dec esi
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
xor eax, ecx
xor eax, ecx
add al, 0
add al, 4
sub al, 4
inc esi
dec esi
xor eax, ecx
xor eax, ecx
lea esp, [esp]
call 0x7ffe5412
pop edx
push bx
inc esp
inc esp
add al, 0
xor dx, dx
add al, 0
stc
add edx, 0xd5e0
add al, 4
sub al, 4
inc esi
dec esi
inc esi
dec esi
xor ecx, ecx
add al, 0
add al, 4
sub al, 4
nop
mov cl, 0x1e
push es
pop ds
xor byte [ecx + edx], 0xc5
loop 0x7ffe543a
push es
pop ds
pushf
popf
add eax, 0
push dword fs:[0x24]
push bx
inc esp
inc esp
add al, 0
add al, 0
pop dword [edx + 0xa]
and al, 0xff
cld
inc esi
dec esi
mov cl, 0xff
push edx
loop 0x7ffe5462
not eax
not eax
push es
pop ds
cld
inc esi
dec esi
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
and al, 0xff
clc
mov dword [edx + 0x1b], ecx
push es
pop ds
mov dword [edx + 0x100], ecx
inc esi
dec esi
pushf
popf
clc
mov dword [eax + 0x2c], esp
add al, 4
sub al, 4
inc esi
dec esi
add al, 0
push 0
and bh, 0xff
push 0
add al, 4
sub al, 4
push eax
pop eax
push eax
pop eax
push 0
add al, 0
push bx
inc esp
inc esp
add eax, 0
push 0
add al, 4
sub al, 4
push 0x30
nop
push 0x20
not eax
not eax
push 0
cld
push 0
add edx, 0xffff7f33
xor eax, ecx
xor eax, ecx
and al, 0xff
push eax
pop eax
cld
push edx
add al, 4
sub al, 4
push edx
add eax, 0
push 0
xor eax, ecx
xor eax, ecx
push es
pop ds
call dword [edx + 0x8210]
not eax
not eax
push eax
pop eax
push es
pop ds
cld
add esp, 0x3f8
pushf
popf
xor eax, eax
add al, 0
nop
inc esi
dec esi
inc eax
pushf
popf
inc esi
dec esi
push eax
pop eax
ret 0xc
Function at 0x6aeca690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6aed92d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6aed92d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6aeca6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6afe7054]
test esi, esi
jle 0x6aeca810
mov eax, dword [0x6afe7058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6aeca724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6aeca7a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6aeca710
mov dword [esp], ebx
call fcn.6aecaee0
mov edi, eax
test eax, eax
je 0x6aeca837
mov eax, dword [0x6afe7058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6aecb020
mov edx, dword [0x6afe7058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6aeca817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6aeca7a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6aeca7b0
add dword [0x6afe7054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6afe7058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6aeca7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6aeca690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6aeca72e
mov eax, dword [0x6afe7058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6aeca690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6aeca690
lea esi, [esi]
nop
Function at 0x6aecab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6afe7064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6afe705c]
sub esp, 4
test ebx, ebx
je 0x6aecaba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6aecab9e
test esi, esi
je 0x6aecab9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6aecab80
mov dword [esp], 0x6afe7064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6aecaee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6aec0000], 0x5a4d
jne 0x6aecaf05
mov ecx, dword [0x6aec003c]
cmp dword [ecx + 0x6aec0000], 0x4550
lea edx, [ecx + 0x6aec0000]
je 0x6aecaf10
ret
cmp word [ecx + 0x6aec0018], 0x10b
jne 0x6aecaf05
push esi
movzx eax, word [ecx + 0x6aec0014]
push ebx
movzx esi, word [ecx + 0x6aec0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6aec0000
test si, si
je 0x6aecaf58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6aecaf4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6aecaf5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6aecaf40
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6aed0290
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x6afe70c0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x6afe70c4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6aed0300
mov dword [esp + 4], 0x6aed01a0
mov dword [esp], eax
mov dword [0x6afe70bc], eax
call fcn.6aed9b50
test eax, eax
jne 0x6af96d79
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6aed02ea
Function at 0x6aedc3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6afa0df5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6afa0e59]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6aecb1c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.6af95980
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6af9e248], 0
jne 0x6aedc4e6
mov byte [0x6af9e248], 1
call fcn.6af937f0
test eax, eax
je 0x6aedc4b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6aeca340
mov dword [esp], 2
mov esi, dword [fcn.6aed92d0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6aedc4a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6afa15f9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6af96164
jmp 0x6af9615c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6aedc46a
mov dword [esp], 2
call dword [0x6af9d0a0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6af96157
mov dword [esp], 2
call dword [0x6af9d0a0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6afa15a8
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6aed9a38
call fcn.6af93b20
call fcn.6af936e0
call fcn.6af93820
jmp 0x6af96157