joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bd4b0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xef
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6bd500
test cl, 1
je 0x6bd521
test edx, 0x10000
je 0x6bd4ec
test edx, 0x2000000
jne 0x6bd540
and edx, 0x200000
je 0x6bd5a0
xor esi, esi
mov eax, esi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
jns 0x6bd4d0
lea rdx, str.src_win_tty.c
mov r8d, 0x402
lea rcx, [0x0090f577]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x6bd4d0
test cl, 4
je 0x6bd4d0
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x6bd4d0
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6bd4d0
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r10d, 0x10
mov qword [rsp + 0x52], 0
mov qword [rsp + 0x5a], 0
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rdx + 0x12], r9w
lea r9, [rsp + 0x4c]
mov word [rsp + 0x50], r10w
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x6bd4ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x6bd4ee
lea rcx, [0x00c2c698]
call fcn.006b8b90
mov eax, 2
xchg dword [0x00c2c6bc], eax
cmp eax, 1
je 0x6bd5d4
lea rcx, [0x00c2c698]
call fcn.006b8b60
or dword [rbx + 0x58], 0x200000
jmp 0x6bd4ec
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str.conout_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x6bd6a0
lea rdx, [0x00c2c6a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x6bd733
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov dword [rsp + 0x60], 0
lea rdx, [rsp + 0x50]
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x6bd720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6bd5c8
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x6bd5c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x6bd4ee
jmp 0x6bd5c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6bd70a
lock or dword [0x00c2c6b8], 1
jmp 0x6bd62d
Function at 0x6bdf00
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov ebp, r9d
mov dword [rsp + 0x48], 1
jne 0x6be0a0
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6bdfe2
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x6bdfd0
xor r9d, r9d
mov rdx, qword [rdi + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x6bdfd0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x4c], 0x274
mov qword [rsp + 0x20], rax
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6bdfd0
cmp dword [rsp + 0x78], 1
je 0x6be040
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x70], rbx
cmp ebp, 0x17
je 0x6be020
xor eax, eax
and edx, 0x400000
jne 0x6bdff4
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x79
lea rdx, str.src_win_udp.c
lea rcx, str.__handle__flags__UV_HANDLE_IPV6_
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6bdfc4
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x6be080
mov rax, qword [0x0091eaf0]
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x198], rax
mov rax, qword [0x0091eb00]
or edx, 0x20000
mov dword [rsi + 0x58], edx
mov qword [rsi + 0x1a0], rax
jmp 0x6bdfb1
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 1
je 0x6bdfae
call rdi
jmp 0x6bdfc4
mov eax, 0xfffff00e
jmp 0x6bdfc4
Function at 0x6be0b0
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor esi, esi
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
mov edi, r9d
mov dword [rsp + 0x38], 0
test byte [rcx + 0x59], 0x20
jne 0x6be126
mov r13d, r9d
and r13d, 1
je 0x6be0ee
cmp word [rdx], 0x17
mov esi, 0x57
jne 0x6be126
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x6be1b0
and edi, 4
jne 0x6be140
cmp word [rbp], 0x17
je 0x6be17a
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x6be1f0
or dword [rbx + 0x58], 0x2000
xor esi, esi
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], 1
mov edx, 0xffff
mov r8d, 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6be1f0
cmp word [rbp], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x6be108
or dword [rbx + 0x58], 0x400000
test r13d, r13d
jne 0x6be108
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x6be108
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6be1f0
mov rcx, qword [rbx + 8]
movzx r9d, word [rbp]
mov r8, rax
mov rdx, rbx
call fcn.006bdf00
mov esi, eax
test eax, eax
jne 0x6be200
mov rcx, qword [rbx + 0x70]
jmp 0x6be0fc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x6be126
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6be126
Function at 0x6bee10
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rsi, rcx
mov r12, rdx
mov rbp, r8
mov edi, r9d
cmp eax, 0x2000
je 0x6beee0
mov rdx, qword [0x0091eac0]
mov r9d, 4
mov r8d, 0x1c
call fcn.006be0b0
mov ebx, eax
test eax, eax
jne 0x6bef00
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test rbp, rbp
je 0x6bee95
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, rbp
call fcn.0069deb0
test eax, eax
jne 0x6beee0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [r12 + 8]
movaps xmmword [rsp + 0x30], xmm0
test edi, edi
je 0x6beef2
mov r8d, 0xc
cmp edi, 1
jne 0x6beee0
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6bef20
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x6beeb0
mov ecx, eax
call fcn.0069fed0
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0069fed0
mov ebx, eax
jmp 0x6beed1
Function at 0x6bf5f0
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov edi, dword [rsp + 0xd8]
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13d, r9d
test byte [rdx + 0x59], 0x20
jne 0x6bf644
cmp edi, 0x10
je 0x6bf850
cmp edi, 0x1c
jne 0x6bf870
mov rdx, qword [0x0091eac0]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call fcn.006be0b0
test eax, eax
jne 0x6bf7be
mov rbp, qword [rbx + 8]
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x6c]
mov r8d, r13d
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x40], 0
mov rdx, r12
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x78], rax
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 0
mov rcx, qword [rbx + 0x70]
mov dword [rsi + 8], 5
mov qword [rsi + 0x70], rbx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x6bf720
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x6bf7b0
mov edx, r13d
mov rcx, r12
call fcn.0069e460
mov qword [rsi + 0x60], rax
add qword [rbx + 0x60], rax
mov eax, dword [rbx + 0x7c]
add dword [rbx + 0x78], 1
lea edx, [rax + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], edx
test eax, eax
jne 0x6bf7d2
mov eax, dword [rbx + 0x58]
test al, 4
je 0x6bf800
add dword [rbp + 0x20], 1
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x58]
test edx, 0x20000
je 0x6bf6d4
mov ecx, dword [rbx + 0x7c]
mov qword [rsi + 0x60], 0
add dword [rbx + 0x78], 1
lea r8d, [rcx + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], r8d
test ecx, ecx
je 0x6bf820
test r8d, r8d
jg 0x6bf776
mov dword [rsp + 0x5c], eax
mov r8d, 0x1ba
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x5c]
mov rdx, qword [rbp + 0x48]
add dword [rbp + 0x20], 1
mov qword [rsi + 0x68], 0
test rdx, rdx
je 0x6bf860
mov rcx, qword [rdx + 0x68]
mov qword [rsi + 0x68], rcx
mov qword [rdx + 0x68], rsi
mov qword [rbp + 0x48], rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x6bf712
mov ecx, eax
call fcn.0069fed0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test edx, edx
jg 0x6bf70c
mov r8d, 0x1c2
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6bf70c
mov edx, eax
or edx, 4
mov dword [rbx + 0x58], edx
test al, 8
je 0x6bf70c
mov rax, qword [rbx + 8]
add dword [rax + 8], 1
jmp 0x6bf70c
test dl, 4
jne 0x6bf776
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rbx + 0x58], ecx
je 0x6bf776
mov rdx, qword [rbx + 8]
add dword [rdx + 8], 1
jmp 0x6bf776
mov rdx, qword [0x0091eab0]
jmp 0x6bf62e
mov qword [rsi + 0x68], rsi
mov qword [rbp + 0x48], rsi
jmp 0x6bf712
mov eax, 0xfffff019
jmp 0x6bf712
Function at 0x6bf880
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov esi, dword [rsp + 0x130]
mov rbx, rcx
mov rbp, rdx
mov edi, r8d
test r8d, r8d
je 0x6bf970
test r9, r9
je 0x6bf8be
lea rdx, [rsp + 0x60]
mov rcx, r9
call fcn.006c31a0
test eax, eax
jne 0x6bf941
cmp qword [rbx + 0x68], 0
jne 0x6bf9b3
test byte [rbx + 0x59], 0x20
jne 0x6bf8fa
cmp esi, 0x10
je 0x6bf9a0
cmp esi, 0x1c
jne 0x6bf9ac
mov rdx, qword [0x0091eac0]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.006be0b0
test eax, eax
jne 0x6bf956
lea rax, [rsp + 0x60]
mov rdx, rbp
mov rcx, qword [rbx + 0x70]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
mov r8d, edi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov edx, eax
mov eax, dword [rsp + 0x5c]
test edx, edx
jne 0x6bf950
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0069fed0
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsp + 0x128], r9
mov r8d, 0x3e5
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x128]
jmp 0x6bf8a4
mov rdx, qword [0x0091eab0]
jmp 0x6bf8e8
mov eax, 0xfffff019
jmp 0x6bf941
mov eax, 0xfffff008
jmp 0x6bf941

Function at 0x6bfd00
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x6bfe40
test rdx, rdx
je 0x6bfe40
lea rbx, [rsp + 0x40]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x6bfe04
cmp eax, 0x104
ja 0x6bfe47
mov edx, eax
xor ecx, ecx
mov word [rsp + rdx*2 + 0x40], cx
lea edx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x6bfe20
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
je 0x6bfe04
mov rdx, qword [rsi]
mov ecx, edx
cmp edx, eax
jl 0x6bfe4e
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, rbx
mov qword [rsp + 0x38], 0
cmova ecx, eax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rbp
test eax, eax
je 0x6bfe04
sub eax, 1
cdqe
mov qword [rsi], rax
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0069fed0
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 3
je 0x6bfe31
xor eax, eax
mov word [rsp + rdx*2 + 0x40], ax
jmp 0x6bfd61
cmp word [rsp + 0x42], 0x3a
jne 0x6bfe25
jmp 0x6bfd61
mov eax, 0xfffff019
jmp 0x6bfdf8
mov eax, 0xfffff01a
jmp 0x6bfdf8
cdqe
mov qword [rsi], rax
mov eax, 0xfffff024
jmp 0x6bfdf8
Function at 0x6bfe60
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov r8, rcx
test rcx, rcx
je 0x6bffaf
lea rbx, [rsp + 0x40]
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x6bff00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x6bff80
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, eax
test rax, rax
je 0x6bff80
cmp rax, 0x104
ja 0x6bffb9
lea rdx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x6bff90
cmp rax, 1
jbe 0x6bfef1
cmp word [rsp + 0x42], 0x3a
je 0x6bff30
xor eax, eax
add rsp, 0x250
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x6bffa5
mov ecx, eax
call fcn.0069fed0
add rsp, 0x250
pop rbx
ret
cmp word [rsp + 0x42], 0x3a
jne 0x6bff96
nop dword [rax + rax]
movzx eax, word [rsp + 0x40]
lea edx, [rax - 0x41]
cmp dx, 0x19
jbe 0x6bff4a
lea edx, [rax - 0x61]
sub eax, 0x20
cmp dx, 0x19
ja 0x6bfef1
mov edx, 0x3d
mov word [rsp + 0x3a], ax
lea rcx, [rsp + 0x38]
mov word [rsp + 0x38], dx
mov rdx, rbx
mov dword [rsp + 0x3c], 0x3a
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x6bfef1
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6bff0f
cmp rax, 3
je 0x6bff20
xor ecx, ecx
mov rax, rdx
mov word [rsp + rdx*2 + 0x40], cx
jmp 0x6bfee3
mov eax, 0xfffff020
jmp 0x6bff16
mov eax, 0xfffff019
jmp 0x6bff16
mov eax, 0xfffff01a
jmp 0x6bff16

Function at 0x6bfff0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, 0xffffffffffffffff
test eax, eax
je 0x6c0017
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rsp, 0x68
ret

Function at 0x6c0020
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, 0xffffffffffffffff
test eax, eax
je 0x6c0047
mov rdx, qword [rsp + 0x28]
mov rax, rdx
add rsp, 0x68
ret

Function at 0x6c0070
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x20]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x6c00bf
jmp 0x6c00e0
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x6c00e0
cmp dword [rsp + 0x28], edi
jne 0x6c00b0
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
mov esi, 0xffffffff
jmp 0x6c00c9
Function at 0x6c0d40
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rdi, rcx
mov rbx, rdx
test rcx, rcx
je 0x6c0e80
test rdx, rdx
je 0x6c0e80
cmp qword [rdx], 0
je 0x6c0e80
lea rsi, [rsp + 0x40]
mov ecx, 0x106
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, eax
test rax, rax
je 0x6c0e40
cmp rax, 0x106
ja 0x6c0e9a
lea rdx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x6c0e60
xor edx, edx
mov r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
je 0x6c0e40
mov rdx, qword [rbx]
mov eax, eax
cmp rax, rdx
ja 0x6c0e90
mov dword [rsp + 0x28], edx
mov r9d, 0xffffffff
xor edx, edx
mov r8, rsi
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
call rbp
test eax, eax
je 0x6c0e40
sub eax, 1
mov qword [rbx], rax
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0069fed0
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp rax, 3
je 0x6c0e72
xor eax, eax
mov word [rsp + rdx*2 + 0x40], ax
jmp 0x6c0da7
cmp word [rsp + 0x42], 0x3a
jne 0x6c0e66
jmp 0x6c0da7
mov eax, 0xfffff019
jmp 0x6c0e2e
mov qword [rbx], rax
mov eax, 0xfffff024
jmp 0x6c0e2e
mov eax, 0xfffff01a
jmp 0x6c0e2e
Function at 0x6c1550
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbx, rcx
test rcx, rcx
je 0x6c16ba
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6c1653
lea rsi, [rsp + 0x34]
lea rdi, [rsp + 0x250]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x6c15e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x7a
je 0x6c16b0
mov ecx, ebx
call fcn.0069fed0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x6c1670
mov qword [rbx + 0x18], 0
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.006c0ed0
test eax, eax
jne 0x6c15d5
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.006c0ed0
test eax, eax
jne 0x6c1690
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x6c15d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0069fed0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x6c16b0
mov ecx, eax
call fcn.0069fed0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.0069b430
mov eax, dword [rsp + 0x2c]
jmp 0x6c15d5
mov eax, 0xfffff027
jmp 0x6c15d5
mov eax, 0xfffff019
jmp 0x6c15d5
Function at 0x6c1890
Capabilities:
Query environment variable

Disassembly:
push r12
mov eax, 0x10050
push rbp
push rdi
push rsi
push rbx
call fcn.00704490
sub rsp, rax
test rdx, rdx
mov rbp, rdx
mov rbx, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x6c1a10
test rcx, rcx
je 0x6c1a10
cmp qword [r8], 0
je 0x6c1a10
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.006c1480
mov esi, eax
test eax, eax
je 0x6c18f5
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8d, 0x7fff
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
call fcn.0069b430
cmp rdi, 0x7ffe
ja 0x6c1952
test rdi, rdi
jne 0x6c196c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x6c1a1a
mov ecx, eax
call fcn.0069fed0
mov esi, eax
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0x5ce
lea rdx, str.src_win_util.c
lea rcx, str.len___MAX_ENV_VAR_LENGTH
call qword [sym.imp.msvcrt.dll__assert]
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x6c1a00
mov rdx, qword [rbx]
mov eax, eax
cmp rax, rdx
ja 0x6c1a24
mov dword [rsp + 0x28], edx
mov r9d, 0xffffffff
xor edx, edx
mov r8, r12
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbp
call rdi
test eax, eax
je 0x6c1a00
sub eax, 1
mov qword [rbx], rax
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6c1939
mov esi, 0xfffff019
jmp 0x6c18e5
mov esi, 0xfffff026
jmp 0x6c18e5
mov qword [rbx], rax
mov esi, 0xfffff024
jmp 0x6c18e5
Function at 0x6c22f0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
mov rsi, rax
test rax, rax
je 0x6c2494
lea rdx, str.RtlGetVersion
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, rsi
mov qword [0x00cae660], rax
call rbx
mov qword [0x00cae688], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
mov qword [0x00cae658], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
mov qword [0x00cae678], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
mov qword [0x00cae648], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
mov qword [0x00cae640], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x00cae640], 0
mov qword [0x00cae680], rax
je 0x6c2480
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
mov qword [0x00cae670], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryInformationProcess
mov rcx, rsi
call rbx
mov qword [0x00cae668], rax
test rax, rax
je 0x6c2480
lea rcx, [0x0090fe95]
call rdi
test rax, rax
je 0x6c2494
mov rcx, rax
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x00cae690], rax
call rsi
test rax, rax
je 0x6c2457
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x00cae698], rax
lea rcx, str.user32.dll
call rsi
test rax, rax
je 0x6c2478
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x00cae650], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.0069fe10
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.0069fe10
nop
nop
nop
nop
nop
nop
nop
nop