joyce8/EMBER2024-capa huggingface dataset:
Function at 0x639c94
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x639c9c
push ecx
push ebx
xor eax, eax
push ebp
push 0x639de6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005f0598
mov edx, dword [ebp - 0x10]
mov eax, 0x65e230
call fcn.00408aec
lea eax, [ebp - 0x14]
mov ecx, dword [0x65e230]
mov edx, 0x639e00
call fcn.00409a14
mov eax, dword [ebp - 0x14]
call fcn.005f8c94
mov eax, dword [0x656980]
cmp byte [eax], 0
je 0x639cf7
mov eax, dword [0x65e230]
call fcn.005f8408
lea edx, [ebp - 0x18]
mov eax, dword [0x65e230]
call fcn.005a26bc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x639e20
call fcn.00409a14
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x639d8d
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005ab17c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.004207d8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005a4c90
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x70
call fcn.005ab14c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x419944]
call fcn.00426604
call fcn.00407e08
lea eax, [ebp - 8]
call fcn.00611fdc
cmp dword [ebp - 8], 0
je 0x639dbe
lea eax, [ebp - 0xc]
mov ecx, 0x639e3c
mov edx, dword [ebp - 4]
call fcn.00409a14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00639c3c
mov eax, dword [ebp - 0xc]
call fcn.00612034
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639ded
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040876c
ret

Function at 0x63c590
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x65e51d], 1
call fcn.005f2474
test al, al
jne 0x63c5e2
push 5
mov eax, dword [0x65687c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x65687c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x656890]
mov eax, dword [eax + 0x138]
mov cl, 2
xor edx, edx
call fcn.0063c358
ret

Function at 0x63fa9c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x63fac1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x641794
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x6417c0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x6417c9
call fcn.00640654
mov eax, 0xa
call fcn.005a50a4
call fcn.00640654
call fcn.00641760
test al, al
jne 0x64179e
pop ebx
ret

Function at 0x641ccc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x656334]
cmp dword [eax], 0
je 0x641d77
mov eax, dword [0x656334]
mov eax, dword [eax]
call fcn.004f960c
test al, al
je 0x641d77
mov eax, dword [0x656334]
mov eax, dword [eax]
cmp byte [eax + 0x215], 0
je 0x641d21
cmp byte [ebx + 0x3e1], 0
jne 0x641d21
mov eax, dword [0x65687c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x641d25
xor eax, eax
jmp 0x641d27
mov al, 1
mov ebx, eax
mov eax, dword [0x656334]
mov eax, dword [eax]
call fcn.004f9238
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x641d77
test bl, bl
je 0x641d63
push 5
mov eax, dword [0x656334]
mov eax, dword [eax]
call fcn.004f9238
push eax
call sub.user32.dll_ShowWindow
jmp 0x641d77
push 0
mov eax, dword [0x656334]
mov eax, dword [eax]
call fcn.004f9238
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x641e28
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x65e4d7], 0
push 0x641fb4
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x641fd0
push ebx
call fcn.0041218c
mov esi, eax
test esi, esi
je 0x641ed0
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x641ed0
cmp word [esp], 0
je 0x641ed0
mov byte [0x65e4d7], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x641e94
sub ax, 0xb4
je 0x641ea0
sub ax, 0x8464
je 0x641eac
sub ax, 0x2400
je 0x641eb8
jmp 0x641ec4
mov byte [0x656175], 1
jmp 0x641f6c
mov byte [0x656175], 3
jmp 0x641f6c
mov byte [0x656175], 2
jmp 0x641f6c
mov byte [0x656175], 4
jmp 0x641f6c
mov byte [0x656175], 0
jmp 0x641f6c
push 0x641ff0
push ebx
call fcn.0041218c
test eax, eax
je 0x641f18
lea edx, [esp + 8]
push edx
call eax
push 0x642018
push ebx
call fcn.0041218c
mov esi, eax
test esi, esi
je 0x641f22
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x641f22
cmp dword [esp + 4], 0
je 0x641f22
mov byte [0x65e4d7], 1
jmp 0x641f22
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x641f41
sub ax, 5
je 0x641f4a
sub ax, 3
je 0x641f53
sub ax, 3
je 0x641f5c
jmp 0x641f65
mov byte [0x656175], 1
jmp 0x641f6c
mov byte [0x656175], 3
jmp 0x641f6c
mov byte [0x656175], 2
jmp 0x641f6c
mov byte [0x656175], 4
jmp 0x641f6c
mov byte [0x656175], 0
cmp byte [0x65e4d7], 0
je 0x641fad
call fcn.005ed83c
test al, al
je 0x641fa6
push 0x642038
push ebx
call fcn.0041218c
test eax, eax
je 0x641fa6
push 0x64206c
push 0x64208c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041218c
test eax, eax
jne 0x641fad
mov byte [0x65e4d7], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x6420a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x642118
mov edx, 0x80000002
xor eax, eax
call fcn.005a414c
test eax, eax
jne 0x642111
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x64216c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x642108
cmp dword [ebp - 0xc], 4
jne 0x642108
cmp dword [ebp - 8], 4
jne 0x642108
movzx eax, word [ebp - 0x10]
mov word [0x65e4ec], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x642314
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6423c3
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x65e4e8], eax
cmp byte [0x65e4d6], 0
je 0x6423c3
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x6423b4
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6423c3
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x65e4ec], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x65e4ee], al
movzx eax, word [esp + 0x22c]
mov word [0x65e4f0], ax
jmp 0x6423c3
cmp eax, 4
jne 0x6423c3
call fcn.006420a8
call fcn.00642184
add esp, 0x230
ret

Function at 0x6432f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x643398
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6433b4
push ebx
push 0x6433c4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00409a9c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405ce4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x643376
mov eax, dword [0x656890]
mov eax, dword [eax + 0x1c8]
call fcn.00643248
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64339f
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x643ca0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x643e8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005a3d1c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.005f041c
test al, al
jne 0x643d0d
xor eax, eax
push ebp
push 0x643d03
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.005f0914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x643d0d
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
mov eax, dword [0x65e5cc]
call fcn.004097c0
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x643d3c
mov eax, dword [0x656890]
mov eax, dword [eax + 0x1c4]
call fcn.00643248
push 0x80
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x65a634]
push eax
push 0
mov ecx, 0x643e9c
mov edx, 0x643ea0
xor eax, eax
call fcn.00412eac
mov dword [ebp - 8], eax
push 0x643408
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x65e5f8], eax
xor eax, eax
push ebp
push 0x643e57
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x65687c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.005a36e8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x643ebc
call fcn.00421be4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.005a35c8
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004099bc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.006432f0
mov dword [ebp - 0xc], eax
call fcn.006433cc
test al, al
jne 0x643e37
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x643e15
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x643e5e
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x644f1c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6451d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65687c]
mov eax, dword [eax]
mov edx, 0x6451ec
call fcn.00595fa4
push 5
mov eax, dword [0x65687c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x645197
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0063c81c
lea eax, [ebp - 0x10]
call fcn.005a3b94
mov eax, dword [ebp - 0x10]
call fcn.0042170c
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005a36e8
mov edx, dword [ebp - 0x14]
mov eax, 0x65e5cc
call fcn.00408aec
call fcn.006435b0
lea ecx, [ebp - 0x18]
mov edx, 0x645200
mov eax, dword [0x65e5cc]
call fcn.005a27a8
mov edx, dword [ebp - 0x18]
mov eax, 0x65e5d0
call fcn.00408aec
lea ecx, [ebp - 0x1c]
mov edx, 0x645218
mov eax, dword [0x65e5cc]
call fcn.005a27a8
mov edx, dword [ebp - 0x1c]
mov eax, 0x65e5d4
call fcn.00408aec
push 2
push 0
push 1
mov ecx, dword [0x65e5cc]
mov dl, 1
mov eax, dword [0x5a9318]
call fcn.005a9c6c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x645074
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005a9c2c
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005a9c04
cmp dword [ebp - 0xc], 0x67734d49
je 0x64504f
mov cl, 1
xor edx, edx
mov eax, dword [0x65e5d4]
call fcn.005ab2c0
jmp 0x64505e
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x65e5cc]
call fcn.005ab2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64507b
mov eax, dword [ebp - 4]
call fcn.004069c8
ret
Function at 0x64531c
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x645459
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x645474
mov edx, ebx
call fcn.00409a14
mov eax, dword [ebp - 0x25c]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x645433
xor eax, eax
push ebp
push 0x64542c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x645490
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0042188c
test eax, eax
jne 0x6453fd
test byte [ebp - 0x258], 0x10
jne 0x6453fd
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00409864
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409a14
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x6453f5
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.0042110c
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x64538d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x645433
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x645460
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x64549c
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x64559a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040870c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005a2c40
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x6455b4
call fcn.00421be4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x64553a
test esi, 0x10
jne 0x64556a
test esi, 1
je 0x64553a
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x645564
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00408aec
jmp 0x645577
inc edi
cmp edi, 0xa
je 0x645577
inc ebx
cmp ebx, 0x3e8
jne 0x6454db
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6455a1
lea eax, [ebp - 0x14]
call fcn.0040870c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x6ff4a690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6ff592d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6ff592d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6ff4a6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x70067054]
test esi, esi
jle 0x6ff4a810
mov eax, dword [0x70067058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6ff4a724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6ff4a7a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6ff4a710
mov dword [esp], ebx
call fcn.6ff4aee0
mov edi, eax
test eax, eax
je 0x6ff4a837
mov eax, dword [0x70067058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6ff4b020
mov edx, dword [0x70067058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6ff4a817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6ff4a7a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6ff4a7b0
add dword [0x70067054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x70067058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6ff4a7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6ff4a690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6ff4a72e
mov eax, dword [0x70067058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6ff4a690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6ff4a690
lea esi, [esi]
nop
Function at 0x6ff4ab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x70067064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x7006705c]
sub esp, 4
test ebx, ebx
je 0x6ff4aba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6ff4ab9e
test esi, esi
je 0x6ff4ab9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ff4ab80
mov dword [esp], 0x70067064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6ff4aee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6ff40000], 0x5a4d
jne 0x6ff4af05
mov ecx, dword [0x6ff4003c]
cmp dword [ecx + 0x6ff40000], 0x4550
lea edx, [ecx + 0x6ff40000]
je 0x6ff4af10
ret
cmp word [ecx + 0x6ff40018], 0x10b
jne 0x6ff4af05
push esi
movzx eax, word [ecx + 0x6ff40014]
push ebx
movzx esi, word [ecx + 0x6ff40006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6ff40000
test si, si
je 0x6ff4af58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6ff4af4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6ff4af5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6ff4af40
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6ff50290
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x700670c0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x700670c4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6ff50300
mov dword [esp + 4], 0x6ff501a0
mov dword [esp], eax
mov dword [0x700670bc], eax
call fcn.6ff59b50
test eax, eax
jne 0x70016d79
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6ff502ea
Function at 0x6ff5c3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x70020df5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x70020e59]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6ff4b1c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.70015980
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x7001e248], 0
jne 0x6ff5c4e6
mov byte [0x7001e248], 1
call fcn.700137f0
test eax, eax
je 0x6ff5c4b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6ff4a340
mov dword [esp], 2
mov esi, dword [fcn.6ff592d0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6ff5c4a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x700215f9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x70016164
jmp 0x7001615c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6ff5c46a
mov dword [esp], 2
call dword [0x7001d0a0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x70016157
mov dword [esp], 2
call dword [0x7001d0a0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x700215a8
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6ff59a38
call fcn.70013b20
call fcn.700136e0
call fcn.70013820
jmp 0x70016157