joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a8a1971
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x6a8a19ac
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str.vad_init:_invalid_parameter_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x6a8a1a28
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [esp + 0xc], 0x3260000
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x98
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.6a8acf2c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6a8a1a10
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str.vad_init:_can_not_malloc_state_structure_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x6a8a1a28
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6a8a1a2a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret

Function at 0x6a8a1a2a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x6a8a1a68
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.vad_reset:_invalid_parameter_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x6a8a1b90
mov eax, dword [ebp + 8]
mov word [eax + 0x88], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x86], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x82], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x80], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x82], 0
mov dword [ebp - 0xc], 0
jmp 0x6a8a1ad9
mov dword [ebp - 0x10], 0
jmp 0x6a8a1ad0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
lea ecx, [edx + edx]
mov edx, dword [ebp - 0x10]
add edx, ecx
add edx, 0x30
mov word [eax + edx*2], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x6a8a1ab6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jle 0x6a8a1aad
mov dword [ebp - 0xc], 0
jmp 0x6a8a1afb
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add edx, 0x38
mov word [eax + edx*2 + 4], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 5
jle 0x6a8a1ae8
mov dword [ebp - 0xc], 0
jmp 0x6a8a1b48
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov word [eax + edx*2], 0x96
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add edx, 0x18
mov word [eax + edx*2], 0x96
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add edx, 8
mov word [eax + edx*2 + 8], 0x96
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add edx, 0x20
mov word [eax + edx*2 + 8], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jle 0x6a8a1b0a
mov eax, dword [ebp + 8]
mov word [eax + 0x8a], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x8c], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x8e], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x90], 0x802
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0
mov eax, 0
leave
ret
Function at 0x6a8a2170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x6a8a21ae
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], str.dtx_enc_init:_invalid_parameter_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x6a8a2231
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [esp + 0xc], 0x3260000
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x1ac
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.6a8acf2c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6a8a2212
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.dtx_enc_init:_can_not_malloc_state_structure_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x6a8a2231
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6a8a2233
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret

Function at 0x6a8a2233
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x6a8a2271
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x21
mov dword [esp + 4], 1
mov dword [esp], str.dtx_enc_reset:_invalid_parameter_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x6a8a2347
mov eax, dword [ebp + 8]
mov word [eax + 0x110], 0
mov eax, dword [ebp + 8]
mov word [eax + 0x112], 0
mov dword [ebp - 0xc], 0
jmp 0x6a8a22ba
mov eax, dword [ebp - 0xc]
shl eax, 4
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.6a89ddf7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 7
jle 0x6a8a2292
mov eax, dword [ebp + 8]
mov word [eax + 0x114], 0x5555
mov eax, dword [ebp + 8]
add eax, 0x100
mov dword [esp + 4], 8
mov dword [esp], eax
call fcn.6a89ddcc
mov eax, dword [ebp + 8]
mov word [eax + 0x116], 7
mov eax, dword [ebp + 8]
mov word [eax + 0x118], 0x7fff
mov dword [ebp - 0xc], 0
jmp 0x6a8a2319
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add edx, 0x44
mov dword [eax + edx*4 + 0xc], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1b
jle 0x6a8a2305
mov dword [ebp - 0xc], 0
jmp 0x6a8a233c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
add edx, 0x60
mov dword [eax + edx*4 + 0xc], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 6
jle 0x6a8a2328
mov eax, 1
leave
ret
Function at 0x6a8add0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x3c]
dec eax
mov word [ebp - 0x1a], ax
movsx eax, word [ebp - 0x1a]
mov edx, 1
mov ebx, edx
mov cl, al
shl ebx, cl
mov eax, ebx
mov word [ebp - 0x1c], ax
movsx eax, word [ebp - 0x3c]
mov edx, 1
mov ebx, edx
mov cl, al
shl ebx, cl
mov eax, ebx
dec eax
mov word [ebp - 0x1e], ax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x6a8addb3
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
and eax, dword [ebp - 0x1c]
test ax, ax
jne 0x6a8add97
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
mov edx, dword [ebp - 0xc]
mov word [ebp + edx*2 - 0x28], ax
inc dword [ebp - 0xc]
jmp 0x6a8addb0
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
mov edx, dword [ebp - 0x10]
mov word [ebp + edx*2 - 0x30], ax
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x6a8add66
cmp dword [ebp - 0xc], 4
ja 0x6a8adf8c
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, 0x6add7e40
mov eax, dword [eax]
jmp eax
mov dword [ebp - 0x18], 0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str.Error_in_function_quant_4p_4N_n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x3c]
shl eax, 2
sub eax, 2
mov word [ebp - 0x20], ax
movsx eax, word [ebp - 0x20]
mov edx, dword [ebp - 0xc]
and edx, 3
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.6a8ad72e
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x60
pop ebx
pop esi
pop ebp
ret
Function at 0x6a8adfeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x3c]
dec eax
mov word [ebp - 0x1a], ax
movsx eax, word [ebp - 0x1a]
mov edx, 1
mov ebx, edx
mov cl, al
shl ebx, cl
mov eax, ebx
mov word [ebp - 0x1c], ax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x6a8ae07b
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
and eax, dword [ebp - 0x1c]
test ax, ax
jne 0x6a8ae05f
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
mov edx, dword [ebp - 0xc]
mov word [ebp + edx*2 - 0x2e], ax
inc dword [ebp - 0xc]
jmp 0x6a8ae078
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
mov edx, dword [ebp - 0x10]
mov word [ebp + edx*2 - 0x38], ax
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jle 0x6a8ae02e
cmp dword [ebp - 0xc], 5
ja 0x6a8ae3bb
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, 0x6add7e74
mov eax, dword [eax]
jmp eax
mov dword [ebp - 0x18], 0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], 0x6add7e54
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x18]
add esp, 0x50
pop ebx
pop esi
pop ebp
ret

Function at 0x6a8ae3f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x3c]
dec eax
mov word [ebp - 0x1a], ax
movsx eax, word [ebp - 0x1a]
mov edx, 1
mov ebx, edx
mov cl, al
shl ebx, cl
mov eax, ebx
mov word [ebp - 0x1c], ax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x6a8ae483
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
and eax, dword [ebp - 0x1c]
test ax, ax
jne 0x6a8ae467
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
mov edx, dword [ebp - 0xc]
mov word [ebp + edx*2 - 0x28], ax
inc dword [ebp - 0xc]
jmp 0x6a8ae480
mov eax, dword [ebp - 0x14]
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov ax, word [eax]
mov edx, dword [ebp - 0x10]
mov word [ebp + edx*2 - 0x34], ax
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jle 0x6a8ae436
cmp dword [ebp - 0xc], 6
ja 0x6a8ae721
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, 0x6add7eb0
mov eax, dword [eax]
jmp eax
mov dword [ebp - 0x18], 0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], 0x6add7e8c
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0xc]
mov ebx, eax
and ebx, 3
mov edx, dword [ebp - 0x3c]
mov eax, edx
shl eax, 1
add eax, edx
shl eax, 1
sub eax, 4
cwde
mov edx, ebx
mov cl, al
shl edx, cl
mov eax, edx
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x54
pop ebx
pop ebp
ret
Function at 0x6a9e8d6d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x6a9e8d9c
mov eax, 0xfffffffe
jmp 0x6a9e8e34
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
lea eax, [ebp - 0x1a]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xa
je 0x6a9e8dce
mov eax, 0xfffffffd
jmp 0x6a9e8e34
mov dword [esp + 8], 3
mov dword [esp + 4], 0x6ae44168
lea eax, [ebp - 0x1a]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x6a9e8e2a
mov al, byte [ebp - 0x14]
movzx eax, al
and eax, 0x7f
mov edx, eax
shl edx, 0x15
mov al, byte [ebp - 0x13]
movzx eax, al
and eax, 0x7f
shl eax, 0xe
or edx, eax
mov al, byte [ebp - 0x12]
movzx eax, al
and eax, 0x7f
shl eax, 7
or edx, eax
mov al, byte [ebp - 0x11]
movzx eax, al
and eax, 0x7f
or eax, edx
add eax, 0xa
mov dword [ebp - 0xc], eax
jmp 0x6a9e8e31
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x6a9e917e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb68
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x120]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14f0c]
test eax, eax
jg 0x6a9e91aa
mov eax, 0xffffffff
jmp 0x6a9e928b
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6a9e91e3
mov eax, 0xffffffff
jmp 0x6a9e928b
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.6a9e8d6d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x6a9e91ff
mov eax, dword [ebp - 0x14]
jmp 0x6a9e928b
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp + 8], 0xb40
lea eax, [ebp - 0xb58]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6a9e8e36
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb40
jbe 0x6a9e9249
mov eax, 0xffffffff
jmp 0x6a9e928b
cmp dword [ebp - 0x18], 0
jne 0x6a9e9256
mov eax, 0
jmp 0x6a9e928b
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
lea eax, [ebp - 0xb58]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x6a9e9286
mov eax, 0xffffffff
jmp 0x6a9e928b
mov eax, 0
leave
ret
Function at 0x6aa0a4d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
cmp dword [ebp + 0x14], 9
jle 0x6aa0a51a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x11
mov dword [esp + 4], 1
mov dword [esp], str.fft_size_too_big_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
cmp dword [ebp + 0x14], 0
jle 0x6aa0a5bb
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6aa0a393
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6aa0a071
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6aa0a071
mov eax, dword [ebp + 0x14]
mov edx, 1
mov ebx, edx
mov cl, al
shl ebx, cl
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 0x14]
shl edx, 2
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ebx, dword [ebp + 0x14]
shl ebx, 2
add eax, ebx
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.6aa0a1d8
jmp 0x6aa0a5bc
nop
add esp, 0x34
pop ebx
pop ebp
ret

Function at 0x6aa0a5c2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x820
cmp dword [ebp + 0x10], 8
jle 0x6aa0a607
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x12
mov dword [esp + 4], 1
mov dword [esp], str.rfft_size_too_big_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp + 0x10]
mov edx, 8
mov ebx, edx
mov cl, al
shl ebx, cl
mov eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x808]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6aa0a4d9
mov eax, dword [ebp + 0x10]
dec eax
mov edx, 8
mov ebx, edx
mov cl, al
shl ebx, cl
mov eax, ebx
mov edx, dword [ebp + 0x10]
dec edx
mov ebx, 8
mov esi, ebx
mov cl, dl
shl esi, cl
mov dword [ebp - 0x80c], esi
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x80c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x808]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
add esp, 0x820
pop ebx
pop esi
pop ebp
ret
Function at 0x6aa16214
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.ORC_CODE
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6aa16247
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6aa340b2
mov dword [0x6b357f14], eax
mov dword [esp], str.backup
call fcn.6aa1628d
mov dword [0x6b49bd7c], eax
mov dword [esp], str.emulate
call fcn.6aa1628d
mov dword [0x6b49bd80], eax
mov dword [esp], str.debug
call fcn.6aa1628d
mov dword [0x6b49bd84], eax
mov dword [esp], str.randomize
call fcn.6aa1628d
mov dword [0x6b49bd78], eax
leave
ret

Function at 0x6aa198a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.ORC_DEBUG
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6aa198ef
mov dword [ebp - 0x14], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jbe 0x6aa198ef
mov eax, dword [ebp - 0x10]
mov dword [0x6aadd4a4], eax
mov dword [esp + 0x10], str.orc_0.4.16_debug_init
mov dword [esp + 0xc], 0x42
mov dword [esp + 8], str._orc_debug_init
mov dword [esp + 4], str.orcdebug.c
mov dword [esp], 3
call fcn.6aa199c0
leave
ret

Function at 0x6aa3490a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x10000
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x10000
leave
ret
Function at 0x6aaa1028
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
fld qword [esp + 0x7c]
fstp qword [esp + 0x20]
mov edi, esi
mov ebx, 0x40
xor eax, eax
test esi, 1
je 0x6aaa1053
stosb byte es:[edi], al
mov bl, 0x3f
test edi, 2
je 0x6aaa1060
stosw word es:[edi], ax
sub ebx, 2
mov ecx, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
test bl, 2
je 0x6aaa106e
stosw word es:[edi], ax
and bl, 1
je 0x6aaa1074
stosb byte es:[edi], al
mov edi, 1
mov cl, dl
shl edi, cl
mov dword [esi + 0x14], edx
mov dword [esi + 0x10], edi
mov ecx, edi
sar ecx, 2
mov dword [esp + 0x28], ecx
mov dword [esi + 0x3c], 0
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
sub edx, 2
mov dword [esp + 4], edx
mov dword [esp], esi
call sym.avcodec_54.dll_ff_fft_init
test eax, eax
js 0x6aaa11c8
mov ecx, 2
mov eax, edi
cdq
idiv ecx
shl eax, 2
mov dword [esp], eax
call sub.avutil_52.dll_av_malloc
mov ebx, eax
mov dword [esi + 0x18], eax
test eax, eax
je 0x6aaa11c8
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x6aaa10e4
dec eax
jne 0x6aaa11c8
jmp 0x6aaa10f5
mov ecx, dword [esp + 0x28]
lea eax, [ebx + ecx*4]
mov dword [esi + 0x1c], eax
mov ebp, 1
jmp 0x6aaa1100
lea eax, [ebx + 4]
mov dword [esi + 0x1c], eax
mov ebp, 2
fld dword [0x6ab5e0a0]
fldz
fld qword [esp + 0x20]
fxch st(1)
fucompp
fnstsw ax
sahf
jbe 0x6aaa111f
fiadd dword [esp + 0x28]
fstp qword [esp + 0x38]
jmp 0x6aaa1123
fstp qword [esp + 0x38]
fld qword [esp + 0x20]
fabs
fstp qword [esp]
call sub.msvcrt.dll_sqrt
fstp qword [esp + 0x30]
lea eax, [ebp*4]
mov dword [esp + 0x20], eax
imul ebp, ebp, 0xfffffffc
mov dword [esp + 0x2c], ebp
add ebx, ebp
mov dword [esp + 0x40], ebx
xor ebx, ebx
xor ebp, ebp
mov eax, esi
mov esi, ebp
mov ebp, eax
jmp 0x6aaa11ba
fld qword [esp + 0x38]
push esi
fiadd dword [esp]
fld xword [0x6ab5e0b0]
fmulp st(1)
mov dword [esp], edi
fidiv dword [esp]
pop eax
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
fst qword [esp]
fstp qword [esp + 0x10]
call sub.msvcrt.dll_cos
fld qword [esp + 0x30]
fxch st(1)
fchs
fmul st(1)
mov eax, dword [esp + 0x40]
fstp dword [eax + ebx]
fld qword [esp + 0x10]
fstp qword [esp]
fstp xword [esp + 0x10]
call sub.msvcrt.dll_sin
mov edx, dword [ebp + 0x1c]
add edx, ebx
fchs
fld xword [esp + 0x10]
fmulp st(1)
mov ecx, dword [esp + 0x2c]
fstp dword [edx + ecx]
inc esi
add ebx, dword [esp + 0x20]
cmp esi, dword [esp + 0x28]
jl 0x6aaa1159
xor eax, eax
jmp 0x6aaa11d3
mov dword [esp], esi
call sym.avcodec_54.dll_ff_mdct_end
or eax, 0xffffffff
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401040
Capabilities:
Create process on windows
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov word [ebp - 0x210], 0x500
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], edi
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x214]
mov dword [ebp - 0x21c], edi
push eax
mov dword [ebp - 0x214], edi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4010ce
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x218]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4010bb
call esi
mov edi, eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4010d8
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x4010d8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
test edi, edi
jne 0x401156
cmp dword [ebp - 0x21c], edi
jne 0x401156
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401156
push 0x38
lea eax, [ebp - 0x254]
mov dword [ebp - 0x258], 0x3c
push edi
push eax
call fcn.0040df90
add esp, 0xc
mov ecx, 0x41d3f0
call fcn.00403100
mov dword [ebp - 0x24c], eax
lea ecx, [ebp - 0x258]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
push ecx
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x23c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401168
call esi
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004097e9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004097e9
mov esp, ebp
pop ebp
ret