joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4300a0
Capabilities:
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x204
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x210]
test eax, eax
je 0x4300d1
push eax
call fcn.0042ef30
add esp, 4
mov eax, dword [0x48baf4]
test eax, eax
je 0x430235
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x430156
mov ecx, dword [0x48bb04]
test ecx, ecx
je 0x43014a
mov eax, dword [0x48bafc]
test eax, eax
je 0x43014a
lea edx, [esp + 8]
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x430132
mov edx, dword [esp + 8]
mov eax, dword [0x48bafc]
cmp edx, eax
je 0x43014a
mov eax, dword [0x48baf4]
lea ecx, [esp + 0xc]
push eax
push 0x455070
push ecx
call fcn.00437eec
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x430245
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x48baf4]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esi - 2]
cmp ecx, 0x79
ja case.0x43017f.7
xor edx, edx
mov dl, byte [ecx + 0x430288]
jmp dword [edx*4 + 0x430270]
cmp eax, 0xffffffff
je 0x4301ac
test al, 1
je 0x4301ac
mov eax, dword [0x48baf4]
push eax
push 0x455030
lea ecx, [esp + 0x14]
push ecx
call fcn.00437eec
add esp, 0xc
jmp 0x430245
mov edx, dword [0x48baf4]
lea eax, [esp + 0xc]
push edx
push 0x454ffc
push eax
call fcn.00437eec
add esp, 0xc
jmp 0x430245
mov ecx, dword [0x48baf4]
lea edx, [esp + 0xc]
push ecx
push 0x454fb8
push edx
call fcn.00437eec
add esp, 0xc
jmp 0x430245
mov eax, dword [0x48baf4]
push eax
push 0x454f88
jmp 0x43019a
mov edx, dword [0x48baf4]
lea eax, [esp + 0xc]
push edx
push 0x454f54
push eax
call fcn.00437eec
add esp, 0xc
jmp 0x430245
mov ecx, dword [0x48baf4]
lea edx, [esp + 0xc]
push ecx
push 0x454f20
push edx
call fcn.00437eec
add esp, 0xc
jmp 0x430245
mov eax, dword [0x48baf4]
push eax
push 0x454ee8
jmp 0x43019a
mov ecx, 0xd
mov esi, 0x454eb4
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0xc]
pop edi
test al, al
pop esi
je 0x430265
lea edx, [esp + 4]
push edx
call fcn.00422370
add esp, 4
xor al, al
add esp, 0x204
ret
mov al, 1
add esp, 0x204
ret
Function at 0x430760
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.00432820
mov edi, eax
add esp, 4
test edi, edi
je 0x430906
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, eax
push ebp
and ebx, 0x80
test al, 0x40
je 0x430795
mov dword [esp + 0x18], 1
jmp 0x4307a1
mov ecx, eax
shr ecx, 4
and ecx, 2
mov dword [esp + 0x18], ecx
test al, 8
je 0x4307ac
mov ebp, 1
jmp 0x4307b3
mov ebp, eax
shr ebp, 1
and ebp, 2
test al, 2
je 0x4307c1
mov dword [esp + 0x10], 1
jmp 0x4307ca
and eax, 1
shl eax, 1
mov dword [esp + 0x10], eax
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0x21
add eax, 0x7f
push eax
push 0x149
push esi
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00437380
mov ecx, dword [edi + 0x2c]
add esp, 0x10
push ecx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [edi + 0x28]
push 0
push ebp
push 0x64
push 0x1e
push 0x12c
push 8
push 0xb
push edx
push 0x44dad8
push esi
call fcn.00437490
mov eax, dword [esp + 0x40]
mov ecx, dword [edi + 0x24]
push 0
push eax
push 0x67
push 0xe
push 0x128
push 0x28
push 0xd
push ecx
push 0x44dad8
push esi
call fcn.00437490
mov edx, dword [esp + 0x60]
add esp, 0x50
push 0
push edx
push 0x66
push 0xe
push 0x128
push 0x36
push 0xd
push 0x4550bc
push 0x44dad8
push esi
call fcn.00437490
push 0
push 1
push 0x65
push 0x14
push 0x12c
push 0x44
push 0xb
push 0
push 0x4550a8
push esi
call fcn.00437490
add esp, 0x50
push 0x65
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push ecx
push edx
push 0x406
push eax
mov dword [edi + 4], eax
call ebp
mov eax, dword [edi + 0x14]
push 0
mov ecx, dword [edi + 4]
push eax
push 0x402
push ecx
call ebp
pop ebp
test ebx, ebx
pop ebx
je 0x4308ef
push 0
push 0x10001
push 2
push 0x17
push 0x50
push 0x64
push 0x79
push 0x44dab8
push 0x44dac0
push esi
call fcn.00437490
add esp, 0x28
push 2
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push esi
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x400
push 1
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
pop edi
pop esi
pop ecx
ret

Function at 0x430bb0
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
call fcn.00430380
test al, al
je 0x430c27
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push ebp
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
call fcn.00430b70
test al, al
jne 0x430c1f
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
call ebx
call fcn.00430b70
test al, al
je 0x430bf8
pop edi
pop esi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
add esp, 0x1c
ret
Function at 0x433250
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push ebp
call fcn.00432820
add esp, 4
test eax, eax
je 0x4334d9
push ebx
push esi
push edi
push 0
push 0
push 0x64
push 0x1e
push 0
push 0
push 0
push 0
push 0x44dad8
push ebp
call fcn.00437490
push 0
push 0
push 0
push 0x14
push 0x28
push 8
push 5
mov esi, eax
push 0x4551f4
push 0x44dad8
push esi
call fcn.00437490
add esp, 0x50
push 0x200
push 0
push 0x65
push 0x14
push 0x46
push 5
push 0x32
push 0x4551f0
push 0x44dab0
push esi
call fcn.00437490
push 0
push 0x1009
push 0x66
push 0x14
push 0x14
push 5
push 0x82
push 0x4551ec
push 0x44dac0
push esi
mov dword [esp + 0x64], eax
call fcn.00437490
add esp, 0x50
push 0
push 0x1009
push 0x67
push 0x14
push 0x14
push 5
push 0x9a
push 0x4551e8
push 0x44dac0
push esi
call fcn.00437490
push 0
push 0x1009
push 0x68
push 0x14
push 0x14
push 5
push 0xb2
push 0x4551e4
push 0x44dac0
push esi
call fcn.00437490
add esp, 0x50
push 0
push 0x1000
push 0x69
push 0x14
push 0x3c
push 5
push 0xd2
push 0x4551d8
push 0x44dac0
push esi
call fcn.00437490
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x28
push 0
push 1
push 0xf1
push 0x66
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x66
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 0
push 0x68
push esi
call edi
push eax
call ebx
push 0
push 0x69
push esi
call edi
push eax
call ebx
push 0
push 0
push 0xc8
push 0
push 0
push 0
push 0
push 0
push 0x44dad8
push ebp
call fcn.00437490
push 0
push 5
push 0xc9
push 0
push 0
push 0
push 0
mov ebp, eax
push 0
push 0x4551cc
push ebp
call fcn.00437490
add esp, 0x50
push 0x200
push 8
push 0x6a
push 0x14
push 0x47
push 0x32
push 0x32
push 0
push 0x44dab0
push ebp
call fcn.00437490
add esp, 0x28
mov dword [esp + 0x10], eax
push 0xa
call dword [sym.imp.GDI32.dll_GetStockObject]
push 1
push eax
push 0x30
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x10]
push 0
push ecx
call ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x436360
push 0xfffffffffffffffc
push esi
call ebx
push 0x433e60
push 0xfffffffffffffffc
push ebp
mov dword [0x4934c4], eax
call ebx
mov edx, dword [esp + 0x14]
push 0x4361d0
push 0xfffffffffffffffc
push edx
mov dword [0x4934c4], eax
call ebx
mov dword [0x4934d4], eax
mov eax, dword [esp + 0x10]
push 0x4334f0
push 0xfffffffffffffffc
push eax
call ebx
push 0x436160
push 0xfffffffffffffffc
push 0x66
push esi
mov dword [0x4934d4], eax
call edi
push eax
call ebx
push 0x436160
push 0xfffffffffffffffc
push 0x67
push esi
mov dword [0x4934d0], eax
call edi
push eax
call ebx
push 0x436160
push 0xfffffffffffffffc
push 0x68
push esi
mov dword [0x4934d0], eax
call edi
push eax
call ebx
push 0x436160
push 0xfffffffffffffffc
push 0x69
push esi
mov dword [0x4934d0], eax
call edi
push eax
call ebx
mov ebp, dword [esp + 0x1c]
pop edi
pop esi
mov dword [0x4934d0], eax
pop ebx
push 0
push 0xc8
push 0
push ebp
call dword [sym.imp.USER32.dll_SetTimer]
pop ebp
add esp, 8
ret
Function at 0x433c40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xc8
push esi
call edi
push 0x6a
push eax
call edi
lea ecx, [esp + 8]
push 0x14
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x24]
lea eax, [esp + 8]
push edx
push eax
call fcn.00433ca0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.00433d00
push esi
call fcn.00433900
add esp, 0x18
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4371a0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x400
lea eax, [esp]
push esi
push edi
push 0x200
push eax
call fcn.00437130
add esp, 8
lea ecx, [esp + 0x208]
lea edx, [esp + 8]
push ecx
push 0
push 0x455264
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x21c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
jne 0x43725c
push ebx
push 1
lea edx, [esp + 0x10]
push 0x1a
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, 0x455258
or ecx, esi
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop ebx
mov esi, dword [esp + 0x410]
mov edi, dword [esp + 0x40c]
lea ecx, [esp + 8]
push esi
push ecx
push edi
call fcn.00438390
add esp, 0xc
mov byte [edi + esi - 1], 0
pop edi
pop esi
add esp, 0x400
ret

Function at 0x437a80
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x437aa4
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret

Function at 0x437ab0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x437ad4
or eax, 0xffffffff
ret
mov eax, dword [esp + 0xc]
ret

Function at 0x437b00
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x437bb0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x437be0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
ret
Function at 0x437e00
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x400
lea eax, [esp]
push esi
push edi
push 0x200
push eax
call fcn.00437d90
add esp, 8
lea ecx, [esp + 0x208]
lea edx, [esp + 8]
push ecx
push 0
push 0x455264
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x208]
push 0x32
push eax
call fcn.004379f0
mov esi, eax
push esi
call fcn.00437ae0
lea ecx, [esp + 0x214]
push ecx
call fcn.00437b40
add esp, 0x10
cmp esi, 0xffffffff
jne 0x437eac
push ebx
push 1
lea edx, [esp + 0x10]
push 0x1a
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, 0x455258
or ecx, esi
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop ebx
mov esi, dword [esp + 0x410]
mov edi, dword [esp + 0x40c]
lea ecx, [esp + 8]
push esi
push ecx
push edi
call fcn.00438390
add esp, 0xc
mov byte [edi + esi - 1], 0
pop edi
pop esi
add esp, 0x400
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x581734b1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0xf1746e8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x6d681607
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x234
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x34], 0x18
mov eax, dword [ebp - 0x34]
mov eax, dword fs:[eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x14
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x236]
mov ecx, 0x1fe
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
jmp 0x6d681711
sub dword [ebp - 0xc], 8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 0x2c
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.6d6814b0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0
jmp 0x6d6816dc
mov eax, dword [ebp - 0x10]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x2c]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
mov dword [esp], eax
call fcn.6d6815eb
movsx dx, al
mov eax, dword [ebp - 0x10]
mov word [ebp + eax*2 - 0x236], dx
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x30]
jle 0x6d6816b0
lea eax, [ebp - 0x236]
mov dword [esp], eax
call fcn.6d68151c
cmp dword [ebp + 8], eax
jne 0x6d681705
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x6d681720
add dword [ebp - 0xc], 8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jne 0x6d681683
mov eax, dword [ebp - 0x14]
add esp, 0x234
pop ebx
pop edi
pop ebp
ret
Function at 0x6d68172a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x6d6817d9
mov eax, dword [ebp - 8]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp], eax
call fcn.6d6814db
cmp dword [ebp + 0xc], eax
jne 0x6d6817d5
mov eax, dword [ebp - 8]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x20]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x6d6817e4
add dword [ebp - 8], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 8], eax
jb 0x6d68178e
cmp dword [ebp - 4], 0
je 0x6d6817f4
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, edx
jmp 0x6d6817f9
mov eax, 0
leave
ret

Function at 0x6d695800
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6d696350
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6d696350
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x6d695860
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6d761070]
test esi, esi
jle 0x6d695980
mov eax, dword [0x6d761074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6d695894
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6d695917
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6d695880
mov dword [esp], ebx
call fcn.6d696050
mov edi, eax
test eax, eax
je 0x6d6959a7
mov eax, dword [0x6d761074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6d696190
mov edx, dword [0x6d761074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d695987
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6d695910
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6d695920
add dword [0x6d761070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6d761074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6d695910
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d695800
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6d69589e
mov eax, dword [0x6d761074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d695800
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d695800
lea esi, [esi]
nop

Function at 0x6d695cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6d761080
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6d761078]
sub esp, 4
test ebx, ebx
je 0x6d695d15
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6d695d0e
test esi, esi
je 0x6d695d0e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d695cf0
mov dword [esp], 0x6d761080
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6d696050
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6d680000], 0x5a4d
jne 0x6d696075
mov ecx, dword [0x6d68003c]
cmp dword [ecx + 0x6d680000], 0x4550
lea edx, [ecx + 0x6d680000]
je 0x6d696080
ret
cmp word [ecx + 0x6d680018], 0x10b
jne 0x6d696075
push esi
movzx eax, word [ecx + 0x6d680014]
push ebx
movzx esi, word [ecx + 0x6d680006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6d680000
test si, si
je 0x6d6960c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6d6960be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6d6960ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6d6960b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x1003281e
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10032846
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x6ca2cb51
jmp 0x10032931
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], 0xb8d96378
mov dword [ebp - 0xc], 0x5eaf
mov dword [ebp - 0x28], 0x14c5530c
mov dword [ebp - 0x34], 0x3acb6d64
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003287d
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, 0x5f5b
sub eax, dword [ebp - 8]
neg eax
cmp dword [ebp - 0x10], eax
jne 0x1003289b
mov dword [ebp - 0x14], 1
jmp 0x1003289f
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jg 0x100328b0
mov dword [ebp - 0x18], 1
jmp 0x100328b4
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 8]
cmp eax, 0x9fff
jl 0x100328ca
mov dword [ebp - 0x1c], 1
jmp 0x100328ce
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 1
jge 0x100328e3
mov eax, 0x6e9f
test eax, eax
jne 0x100328e3
and dword [ebp - 0x20], 0
jmp 0x100328ea
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0xd5493e
jne 0x100328f9
cmp dword [ebp - 0xc], 0
jne 0x10032905
cmp dword [ebp - 0xc], 0
jne 0x10032905
and dword [ebp - 0x24], 0
jmp 0x1003290c
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0xfffffffb
mov esp, ebp
pop ebp
ret