joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6aa0fa90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x6aa0fac0
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x6aa0fb90
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp eax, 1
je 0x6aa0fbc0
cmp eax, 3
jne 0x6aa0faab
mov eax, dword [0x6ab34068]
cmp eax, 0xffffffff
je 0x6aa0faab
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6aa0faab
lea esi, [eax + 0x1c]
lea edi, [eax + 0x38]
test byte [eax + 0x20], 0x30
je 0x6aa0fbf0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x6aa0fb09
call fcn.6aa0f7d0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6aa0fb3b
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x6aa0fb2d
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov dword [esp], esi
call fcn.6aa12340
mov dword [esp], edi
call fcn.6aa131c0
cmp eax, 1
je 0x6aa0fcb6
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x6aa0fcaa
mov eax, dword [0x6ab34068]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x6aa0faab
mov eax, dword [0x6abe51b4]
test eax, eax
je 0x6aa0faab
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x6abe51b4], 0
sub esp, 4
jmp 0x6aa0faab
mov dword [esp + 4], 0x6aa0ee80
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x6abe51b4], eax
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x6aa0fc60
test eax, eax
je 0x6aa0fc0a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x6aa0fc27
call fcn.6aa0f7d0
test byte [ebx + 0x24], 4
je 0x6aa0fca0
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x6aa0fb3b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], esi
call fcn.6aa12340
jmp 0x6aa0fb43
test eax, eax
je 0x6aa0fca0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], esi
call fcn.6aa12340
mov dword [esp], edi
call fcn.6aa131c0
cmp eax, 1
je 0x6aa0fcb6
mov dword [ebx + 0x38], 0xffffffff
jmp 0x6aa0faab
mov dword [esp], esi
call fcn.6aa12340
jmp 0x6aa0fc7f
mov eax, ebx
call fcn.6aa0f3d0
jmp 0x6aa0fb69
call fcn.6aa0f130
lea esi, [esi]
nop
Function at 0x6aa0ff50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x6aa10070
cmp eax, 1
je 0x6aa0ffa4
mov eax, ebx
call fcn.6aa0ef10
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.6aa11e80
mov ebp, dword [ebx]
test ebp, ebp
je 0x6aa0ffb0
cmp ebp, 1
jne 0x6aa10040
mov dword [esp], edi
call fcn.6aa121c0
test esi, esi
je 0x6aa0ffa4
mov eax, esi
call fcn.6aa0f220
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x6aa0f2e0
mov dword [esp + 0x18], esi
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x6aa100a8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x6aa10090
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x6aa10080
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x6aa0ff91
mov dword [esp], 2
call dword [0x6ab340f8]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x6aa0ff91
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6aa0f650
test eax, eax
jne 0x6aa10028
jmp 0x6ab23bfd
call fcn.6aa0f650
test eax, eax
jne 0x6aa10002
jmp 0x6ab23c0f
call fcn.6aa0f650
test eax, eax
jne 0x6aa0ffdc
jmp 0x6ab23c08
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x6aa10300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6aa10378
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.6aa131d0
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x6aa10354
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x6aa10354
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.6aa13220
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6aa0f650
mov ebx, eax
jmp 0x6aa1032b
Function at 0x6aa10390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6aa104b0
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.6aa131d0
cmp esi, dword [ebx + 0x28]
jae 0x6aa10410
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.6aa13220
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x6aa104bc
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x6aa104bc
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.6aa2c5b8
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.6aa2c5b8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x6aa103d8
call fcn.6aa0f650
mov ebx, eax
jmp 0x6aa103c5
mov dword [esp], edi
call fcn.6aa13220
mov eax, 0xc
jmp 0x6aa10400

Function at 0x6aa10540
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6aa10568
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.6aa0f650
test eax, eax
jne 0x6aa1055d
add esp, 0x1c
ret

Function at 0x6aa105d0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6aa105f8
add eax, 0xc
add esp, 0x1c
ret
call fcn.6aa0f650
test eax, eax
jne 0x6aa105ed
jmp 0x6aa105f0
Function at 0x6aa10630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.6aa0f7a0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x6aa10652
call fcn.6aa0f7d0
test byte [ebx + 0x20], 0x30
jne 0x6aa1066c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x6aa106ad
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x6aa106ed
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x6aa106a2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x6aa106b6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.6aa0f570
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x6aa106ad
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x6aa10701
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x6aa106ce

Function at 0x6aa10710
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6abe51e0]
test eax, eax
jne 0x6aa10720
xor eax, eax
ret
sub esp, 0x1c
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6aa10760
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x6aa10750
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x6aa10744
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x6aa10746
call fcn.6aa0f650
test eax, eax
jne 0x6aa1073d
jmp 0x6aa10744

Function at 0x6aa10770
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6aa107b0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x6aa107a0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.6aa0f650
test eax, eax
jne 0x6aa1078d
add esp, 0x1c
ret
Function at 0x6aa108b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6aa10920
test byte [ebx + 0x20], 0xc
jne 0x6aa108e0
mov eax, dword [0x6abe51e0]
test eax, eax
jne 0x6aa108f0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.6aa11e80
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x6aa10912
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x6aa10912
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x6aa10931
mov dword [esp], esi
call fcn.6aa121c0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.6aa0f650
mov ebx, eax
test eax, eax
jne 0x6aa108d1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6aa10951
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.6aa121c0
call fcn.6aa107c0
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6aa109e0
mov dword [esp], eax
call fcn.6aa11bc0
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x6aa10a20
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6aa10a80
test edi, edi
je 0x6aa109fa
call fcn.6aa108b0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6aa10a58
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6aa11cd0
call fcn.6aa108b0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6aa10a70
call fcn.6aa108b0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.6aa108b0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x6aa109b2
call fcn.6aa0f650
mov ebx, eax
jmp 0x6aa109b2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x6aa109ce
call fcn.6aa0f650
jmp 0x6aa109fa
call fcn.6aa0f650
mov ebx, eax
jmp 0x6aa109ae
Function at 0x6aa10a90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.6aa0f590
mov eax, dword [0x6ab34068]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6aa10b08
test esi, esi
je 0x6aa10ae0
call fcn.6aa108b0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6aa10b18
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6aa11cd0
call fcn.6aa108b0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.6aa108b0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.6aa108b0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.6aa0f650
mov ebx, eax
jmp 0x6aa10ab5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x6aa10ad1
Function at 0x6aa1d8d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6aa2bdc0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6aa2bdc0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6aa1d930
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6abe5214]
test esi, esi
jle 0x6aa1da50
mov eax, dword [0x6abe5218]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6aa1d964
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6aa1d9e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6aa1d950
mov dword [esp], ebx
call fcn.6aa1e120
mov edi, eax
test eax, eax
je 0x6aa1da77
mov eax, dword [0x6abe5218]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6aa1e260
mov edx, dword [0x6abe5218]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6aa1da57
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6aa1d9e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6aa1d9f0
add dword [0x6abe5214], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6abe5218]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6aa1d9e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6aa1d8d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6aa1d96e
mov eax, dword [0x6abe5218]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6aa1d8d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6aa1d8d0
lea esi, [esi]
nop
Function at 0x6aa1dd90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6abe5224
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6abe521c]
sub esp, 4
test ebx, ebx
je 0x6aa1dde5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6aa1ddde
test esi, esi
je 0x6aa1ddde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6aa1ddc0
mov dword [esp], 0x6abe5224
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6aa1e120
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6aa00000], 0x5a4d
jne 0x6aa1e145
mov ecx, dword [0x6aa0003c]
cmp dword [ecx + 0x6aa00000], 0x4550
lea edx, [ecx + 0x6aa00000]
je 0x6aa1e150
ret
cmp word [ecx + 0x6aa00018], 0x10b
jne 0x6aa1e145
push esi
movzx eax, word [ecx + 0x6aa00014]
push ebx
movzx esi, word [ecx + 0x6aa00006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6aa00000
test si, si
je 0x6aa1e198
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6aa1e18e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6aa1e19a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6aa1e180
xor eax, eax
pop ebx
pop esi
ret
Function at 0x6aa5a5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6ab3d4b1
push ebx
sub esp, 0x9c
mov eax, dword [0x6ab3d4b0]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6ab3d515]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6aa1e3f0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.6ab24fa0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6ab352e4], 0
jne 0x6aa5a6e6
mov byte [0x6ab352e4], 1
call fcn.6ab22ed0
test eax, eax
je 0x6aa5a6b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6aa1d570
mov dword [esp], 2
mov esi, dword [fcn.6aa2bdc0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6aa5a6a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6ab3c19d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6ab23eb0
jmp 0x6ab23ea8
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6aa5a66a
mov dword [esp], 2
call dword [0x6ab340f8]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6ab23ea3
mov dword [esp], 2
call dword [0x6ab340f8]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x6ab4a270
call fcn.6ab15d50
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.6ab22c70
add esp, 0x18
pop ebx
ret
Function at 0x6aac4cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x6aac4d00
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x6aac4cd1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x10017e2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10017e39
pop dword [ebp - 0x2c]
mov eax, 0xd363981a
add eax, 0x3c9de61f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x237dcfcf
add dword [ebp - 0x3c], 0x2ad4757c
mov dword [ebp - 0x38], 0xb0a137ec
sub dword [ebp - 0x38], 0x7e6deba7
mov dword [ebp - 0x34], 0xcbb6c3e0
add dword [ebp - 0x34], 0x8095804e
mov dword [ebp - 0x30], 0xa02d4e52
add dword [ebp - 0x30], 0x5fd2b1ae
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x4d0e95dd
add eax, 0xc2f30a2b
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x354abeb6
sub dword [ebp - 0x3c], 0xc0d85560
mov dword [ebp - 0x38], 0x5177adec
sub dword [ebp - 0x38], 0x100b4c77
mov dword [ebp - 0x34], 0xa6123ecf
sub dword [ebp - 0x34], 0x42a2d263
mov dword [ebp - 0x30], 0x61fc6e07
sub dword [ebp - 0x30], 0x61fc6e07
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1a5
push 0
call eax
mov ecx, 0xdae02934
sub ecx, 0xdadfe204
mov edi, eax
mov ebx, 0xf1f219fc
sub ebx, 0xe1efcffc
add ebx, dword [ebp - 0x2c]
mov edx, 0x8947e2dd
sub edx, 0x97840606
sub dword [ebp - 0x24], eax
mov esi, dword [ebx]
add dword [ebp - 0x24], esi
xor esi, edx
add dword [ebp - 0x10], ebx
mov dword [edi], esi
sub dword [ebp - 0x28], edx
add edi, 0x6bab7a36
add edi, 0x945485ce
add ebx, 4
loop 0x10017f56
add eax, 0xbc291275
sub eax, 0xbc2802e2
mov ebx, eax
add eax, 0xdea21144
add eax, 0x215deec1
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x41d82a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4af050
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
ror byte [ecx + 0x43455008], 0x6f
insd dword es:[edi], dx
jo 0x41d8aa
arpl word [edx + esi], si
pop edi
das
lcall 0x5cc7, 0x49981d72
lodsd eax, dword [esi]
invalid
push eax
pop edx
call 0xf8ef8ce5
leave
std
adc edx, edx
jae 0x41d83f
dec esp
cmpsb byte [esi], byte es:[edi]
mov dword [esi], ebp
rcr edx, cl
and byte [ecx], al
dec eax
push edx
sbb al, 0xb7
dec edx
enter 0x5096, 0xffffffffffffffc9
sbb al, 0x28
xchg esp, eax
dec edi
fadd dword [esi - 0x521f6eb3]
and eax, edi
enter 0x6cb9, 0x78
inc eax
jae 0x41d8f1
invalid
adc al, 0x95
sub eax, 0xa069f402
arpl word [eax + 0x5a], cx
lcall 0x516a, 0xac8b5ab6
sar byte [edx + 0x34], 0x1a
xor al, 0x1a
std
pop ebp
pushal
je 0x41d904
mov byte [0xa434d03e], al
mov esp, 0x1e3ab214
in eax, dx
jp 0x41d90c
cmp byte [ecx - 0x2fd61aa8], dl
push cs
xchg edx, eax
sub al, 0x77
call 0x996e1582
adc byte [eax + ecx*2 - 4], al
or byte [edx + edi + 0x6c4e49e2], dl
invalid