joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3200f9760
Capabilities:
Create thread

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp edx, 1
je 0x3200f9780
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r12, rax
call rsi
mov rbx, qword [sym.imp.KERNEL32.dll_HeapUnlock]
mov rcx, rax
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 2
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
lea r8, [0x3200f9440]
xor edx, edx
xor ecx, ecx
mov r9, rax
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, 0xf
mov rcx, rax
call rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xfffffff1
mov rcx, rax
call rdi
call rsi
mov rcx, rax
call rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x3200f9e20
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rcx
test dl, dl
je 0x3200f9e30
ret
jmp fcn.3200fa410

Function at 0x3200f9e40
Capabilities:
Log keystrokes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov ebx, ecx
mov edi, edx
mov rsi, r8
xor edx, edx
mov ebp, r9d
movzx ecx, cl
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp ebx, 0x5d
jg 0x3200f9f10
cmp ebx, 0x20
jg 0x3200f9ea8
cmp ebx, 0x13
je 0x3200f9ebb
test rsi, rsi
je 0x3200f9ec5
mov rcx, rsi
test bpl, bpl
je 0x3200f9f30
cmp edi, 1
mov edx, 0x100
movsxd r8, ebx
sbb edx, 0xffffffff
xor r9d, r9d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.USER32.dll_PostMessageW]
movabs rcx, 0x1c000000000038ff
lea edx, [rbx - 0x21]
bt rcx, rdx
jae 0x3200f9e70
or edi, 1
nop
test rsi, rsi
jne 0x3200f9e75
mov word [rsp + 0x28], bx
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov ecx, 1
mov dword [rsp + 0x20], 1
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.USER32.dll_SendInput]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp ebx, 0xa3
je 0x3200f9ebb
lea edx, [rbx - 0xa5]
cmp edx, 0xf
ja 0x3200f9e70
or edi, 1
jmp 0x3200f9ec0
call fcn.3200fa410
mov rcx, rax
jmp 0x3200f9e81

Function at 0x3200fa410
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], ecx
lea rcx, [0x3200fa390]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x3200fb620
Capabilities:
Get graphical window text

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
call fcn.3200fb210
lea r8, str.is_valid_failed.
test al, al
jne 0x3200fb648
mov rax, r8
add rsp, 0x28
pop rbx
pop r12
ret
lea r12, [rbx + 8]
mov r8d, 0x200
mov rcx, qword [rbx]
mov rdx, r12
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea r8, [0x3202e8844]
test eax, eax
jle 0x3200fb63a
mov edx, 8
mov ecx, 0x64
call sub.msvcrt.dll_calloc
mov r8, rax
test rax, rax
je 0x3200fb63a
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov r8, rax
mov rax, r8
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x320101500
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.320102a90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.320102a90
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x320101570
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x320382774]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x320101720
mov rax, qword [0x320382778]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x3201015bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x320101647
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x3201015a0
mov rcx, r12
call fcn.320101e10
mov rbp, rax
test rax, rax
je 0x32010177d
mov rax, qword [0x320382778]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.320101f40
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x320382778]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x320101762
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x320101640
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x3201016d0
add dword [0x320382774], 1
cmp ebx, 8
jae 0x320101678
test bl, 4
jne 0x320101730
test ebx, ebx
je 0x320101669
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x320101750
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x320101669
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x3201016aa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x320382778]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x320101640
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.320101500
xor edi, edi
jmp 0x3201015c7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x320101669
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x320101669
mov rax, qword [0x320382778]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.320101500
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.320101500
nop
nop dword [rax]
Function at 0x320101a80
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x3203827a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x320382780]
test rbx, rbx
je 0x320101ad4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x320101acb
test r12, r12
je 0x320101acb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x320101ab0
lea rcx, [0x3203827a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x320101e10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x3202e8df0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x320101e89
mov rcx, r10
call fcn.320101ce0
test eax, eax
je 0x320101e89
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x320101e86
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x320101e7d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x320101e89
add r8, 0x28
cmp r8, r9
jne 0x320101e68
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1402f9040
Capabilities:
Encode data using xor

Disassembly:
adc esi, dword [rcx - 0xa]
mov esi, dword [rbx]
sub ebx, ecx
lodsb al, byte [rsi]
xor dword [rdi + 0x3c], r12d
xchg esi, eax
sbb eax, 0x5762eae4
sbb eax, 0xfa95c2b0
jl 0x1402f903a
stc
outsd dx, dword [rsi]
je 0x1402f90be
or edi, edx
invalid
add byte [rax + rbx*2 + 5], ch
invalid

Function at 0x142630058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1426301df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142630089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14263006f
add dl, dl
jne 0x142630096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1426300f6
xor eax, eax
add dl, dl
jne 0x1426300a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1426301ad
add dl, dl
jne 0x1426300b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1426300c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1426300d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1426300dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1426300ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14263007e
mov eax, 1
add dl, dl
jne 0x142630106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142630113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1426300fb
sub eax, ebx
mov ebx, 1
jne 0x14263014c
mov ecx, 1
add dl, dl
jne 0x14263012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14263013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142630123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14263007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142630168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142630175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14263015d
cmp eax, 0x7d00
jae 0x14263019b
cmp eax, 0x500
jb 0x142630196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14263007e
cmp eax, 0x7f
ja 0x14263019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14263007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1426301d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14263007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x6cfc1442
Capabilities:
Write file on windows

Disassembly:
push rdi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rbx, rcx
mov r10, rdx
je 0x6cfc146b
mov rdi, rdx
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
mov rdx, rcx
not rdx
lea r8, [rdx - 1]
mov rcx, r10
mov r9, rbx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rdi
jmp fcn.6d004c00

Function at 0x6cfc1b8d
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, rdx
mov rdi, rcx
mov rbx, rdx
mov ecx, 4
cqo
idiv rcx
mov rcx, qword [0x6d018830]
lea rsi, [rax*4]
call fcn.6d004f90
xor ecx, ecx
xor r10d, r10d
mov r9b, byte [rax]
cmp rsi, rcx
jg 0x6cfc1bde
mov rax, rbx
mov r8d, 4
add rdi, rcx
cqo
idiv r8
xor r8d, r8d
jmp 0x6cfc1c19
mov edx, dword [rdi + rcx]
add rcx, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
test r9b, r9b
jne 0x6cfc1c69
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x6cfc1bc3
dec rdx
shl r8d, 8
movzx eax, byte [rdi + rdx]
or r8d, eax
test rdx, rdx
jg 0x6cfc1c0b
imul ecx, r8d, 0xcc9e2d51
xor eax, eax
rol ecx, 0xf
test r9b, r9b
jne 0x6cfc1c6b
imul r8d, ecx, 0x1b873593
mov edx, r10d
xor edx, ebx
xor r8d, edx
mov eax, r8d
shr eax, 0x10
xor r8d, eax
imul r8d, r8d, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul eax, eax, 0xc2b2ae35
mov r8d, eax
shr r8d, 0x10
xor eax, r8d
jmp 0x6cfc1c6b
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
xor ecx, ecx
test rax, rax
je 0x6cfc1c85
lea rcx, [rax + 8]
jmp 0x6cfc1b8d

Function at 0x6cfc1c73
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, rdx
mov rdi, rcx
mov rbx, rdx
mov ecx, 4
cqo
idiv rcx
mov rcx, qword [0x6d018830]
lea rsi, [rax*4]
call fcn.6d004f90
xor ecx, ecx
xor r10d, r10d
mov r9b, byte [rax]
cmp rsi, rcx
jg 0x6cfc1bde
mov rax, rbx
mov r8d, 4
add rdi, rcx
cqo
idiv r8
xor r8d, r8d
jmp 0x6cfc1c19
mov edx, dword [rdi + rcx]
add rcx, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
test r9b, r9b
jne 0x6cfc1c69
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x6cfc1bc3
dec rdx
shl r8d, 8
movzx eax, byte [rdi + rdx]
or r8d, eax
test rdx, rdx
jg 0x6cfc1c0b
imul ecx, r8d, 0xcc9e2d51
xor eax, eax
rol ecx, 0xf
test r9b, r9b
jne 0x6cfc1c6b
imul r8d, ecx, 0x1b873593
mov edx, r10d
xor edx, ebx
xor r8d, edx
mov eax, r8d
shr eax, 0x10
xor r8d, eax
imul r8d, r8d, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul eax, eax, 0xc2b2ae35
mov r8d, eax
shr r8d, 0x10
xor eax, r8d
jmp 0x6cfc1c6b
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
xor ecx, ecx
test rax, rax
je 0x6cfc1c85
lea rcx, [rax + 8]
jmp 0x6cfc1b8d
Function at 0x6cfc760c
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [fcn.6d004e10]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.6d004c00

Function at 0x6cfca0a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r12, [rsp + 0x20]
mov rdi, rcx
mov rbp, rdx
lea rcx, [0x6d024580]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [fcn.6d004e10]
cmp rbx, rbp
mov ecx, 1
jl 0x6cfca118
call rsi
mov r8d, 1
mov edx, 1
lea rcx, [0x6d00c001]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rsi
mov rcx, rax
call fcn.6d004c00
lea rcx, [0x6d024580]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rsi
mov rdx, rbx
xor r8d, r8d
shl rdx, 4
mov rcx, rax
movups xmm0, xmmword [rdi + rdx]
mov rdx, r12
movaps xmmword [rsp + 0x20], xmm0
call fcn.6cfc9fe8
mov rcx, qword [0x6d018830]
call fcn.6d004f90
cmp byte [rax], 0
jne 0x6cfca151
inc rbx
jmp 0x6cfca0cb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x6cfca9a9
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x6d024558], 0
jne 0x6cfca9c4
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.6cfc760c
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.6cfca928
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x6d024558]
test rbx, rbx
je 0x6cfca9fd
mov eax, 1
shl rax, 0x3e
test qword [rbx], rax
jne 0x6cfca9fd
mov rcx, rbx
call fcn.6d004be0
mov rcx, qword [0x6d018830]
call fcn.6d004f90
cmp byte [rax], 0
je 0x6cfcaa1c
mov byte [rax], 0
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.6cff9807
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x6cfce868
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, rdx
mov edx, 1
mov r9, rbx
call sub.msvcrt.dll_fwrite
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.6cfce6ec
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
ret

Function at 0x6cfce9f2
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, rdx
mov edx, 1
mov r9, rbx
mov rsi, r8
call sub.msvcrt.dll_fread
cmp rsi, rax
je 0x6cfcea25
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.6cfce6ec
mov rax, qword [rsp + 0x28]
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x6cfda267
Capabilities:
Hash data with crc32

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, 1
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
cpuid
mov r12d, ecx
mov rcx, qword [0x6d018830]
call fcn.6d004f90
cmp byte [rax], 0
mov rbp, rax
je 0x6cfda29e
xor eax, eax
jmp 0x6cfda3b7
bt r12d, 0x13
jae 0x6cfda2d1
and r12b, 2
je 0x6cfda2d1
cmp rdi, 0x3f
jle 0x6cfda2d1
mov rbx, rdi
or r8d, 0xffffffff
mov rcx, rsi
and rbx, 0xfffffffffffffff0
mov rdx, rbx
call fcn.6cfd9ea6
cmp byte [rbp], 0
not eax
je 0x6cfda2d5
jmp 0x6cfda297
xor ebx, ebx
xor eax, eax
cmp rbx, rdi
jge 0x6cfda3b7
lea rcx, [rsi + rbx]
mov rdx, rdi
not eax
lea r10, [0x6d00fd20]
sub rdx, rbx
mov bl, byte [rbp]
xor esi, esi
mov r11, rdx
mov r12, rdx
and r11, 0xfffffffffffffff8
cmp r11, rsi
jne 0x6cfda311
lea r9, [0x6d00fd20]
jmp 0x6cfda3ac
test bl, bl
mov r8d, dword [rcx + rsi]
jne 0x6cfda3b7
xor eax, r8d
mov r8d, dword [rcx + rsi + 4]
add rsi, 8
mov edi, r8d
movzx r9d, r8b
mov edx, r8d
shr edi, 0x18
mov r9d, dword [r10 + r9*4 + 0xc00]
shr r8d, 0x10
xor r9d, dword [r10 + rdi*4]
movzx edi, al
movzx r8d, r8b
xor r9d, dword [r10 + rdi*4 + 0x1c00]
mov edi, eax
shr edi, 0x18
xor r9d, dword [r10 + rdi*4 + 0x1000]
movzx edi, dh
xor r9d, dword [r10 + rdi*4 + 0x800]
movzx edi, ah
shr eax, 0x10
xor r9d, dword [r10 + r8*4 + 0x400]
movzx r8d, al
xor r9d, dword [r10 + rdi*4 + 0x1800]
mov eax, dword [r10 + r8*4 + 0x1400]
xor eax, r9d
jmp 0x6cfda300
mov r8b, byte [rcx + r11]
inc r11
xor r8d, eax
shr eax, 8
movzx r8d, r8b
xor eax, dword [r9 + r8*4]
cmp r12, r11
jg 0x6cfda397
test bl, bl
jne 0x6cfda3b7
not eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6cfff770
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d0236a4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6cfff8f8
mov rax, qword [0x6d0236a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6cfff7bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6cfff845
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6cfff7a0
mov rcx, rbx
call fcn.6d000410
test rax, rax
mov r12, rax
je 0x6cfff92d
mov rax, qword [0x6d0236a8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.6d000540
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d0236a8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6cfff910
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6cfff83e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6cfff8a0
add dword [0x6d0236a4], 1
cmp edi, 8
jae 0x6cfff873
test dil, 4
jne 0x6cfff8e4
test edi, edi
je 0x6cfff868
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6cfff8ff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6cfff868
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6cfff88c
jmp 0x6cfff868
add rsi, qword [0x6d0236a8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6cfff83e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6d009d30
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6cfff868
xor esi, esi
jmp 0x6cfff7c7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6cfff868
mov rax, qword [0x6d0236a8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.6d009d30
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.6d009d30
nop
nop dword [rax]

Function at 0x6d000080
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d023980]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d023960]
test rbx, rbx
je 0x6d0000d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d0000cb
test rsi, rsi
je 0x6d0000cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d0000b0
lea rcx, [0x6d023980]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d000410
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d018850]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d00047d
mov rcx, r8
call fcn.6d0002f0
test eax, eax
je 0x6d00047d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d00047d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d000474
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d00047f
add rax, 0x28
cmp rax, r9
jne 0x6d000460
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d0058a0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x6d00b8c8], eax
je 0x6d0058ba
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x6d005dc0
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x6d005de3
call fcn.6d008b00
cmp eax, 1
je 0x6d005dee
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x6d005e65
mov eax, 0x28
jmp 0x6d005e4a
add rax, 1
cmp rax, 0x6b
je 0x6d005e57
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x6d005e40
cmp eax, 0x6a
jne 0x6d005e6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x6d005e57