joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14043c8c0]
mov rax, qword [rsi]
test rax, rax
je 0x14006a000
cmp qword [rax + 0x28], 0
jne 0x140069fe8
lea rcx, [0x14049acb8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x140069ff5
call fcn.140069420
mov rax, qword [rsi]
test rax, rax
je 0x140069e90
cmp qword [rax + 0x30], 0
jne 0x140069eb0
lea rdx, [0x140079708]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140069ec4
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.14006e130
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140069e60
test rax, rax
jne 0x140069eb0
call fcn.14006e130
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x140069e7e
call fcn.140068f60
cmp qword [0x14049e050], 0
mov rbx, rax
je 0x140069e7e
test rax, rax
je 0x140069e7e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14006ffd0
cmp eax, 1
je 0x14006a06d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400720a6
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x14006a048
cmp qword [rax + 0x30], 0
je 0x14006a030
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400720a6
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x140069e4c
mov rax, qword [rsi]
jmp 0x140069e59
call fcn.14006e130
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x140069e38
test rax, rax
jne 0x140069fe8
call fcn.14006e130
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x140069e4c
jmp 0x140069e51
lea rdx, [0x140079708]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x140069fbe
call fcn.14006e130
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x14006a030
test rax, rax
jne 0x140069fba
call fcn.14006e130
jmp 0x140069fba
call fcn.1400692f0
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14043c8c0]
mov rdx, qword [rax]
lea rax, [0x14049acc8]
mov qword [rdx + 0x10], rax
ret
Function at 0x14006dfb0
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14006dfd0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x14006e018
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14006dfc4
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14006e005
Function at 0x14006e130
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14049ada0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x14006e153
lea rax, [0x14049ada8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x14006e19b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x14006e198
lea rax, [0x14049ade0]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x14006e1cb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x14006e1c8
xor ecx, ecx
mov byte [0x14049adf9], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x14049ae02], rdx
lea r8, [0x14049ada0]
lea rbx, [0x14049adfa]
mov qword [0x14049ae12], rdx
mov qword [0x14049ae22], rdx
mov qword [0x14049ae32], rdx
xor edx, edx
mov qword [0x14049adfa], rax
mov qword [0x14049ae0a], rax
mov qword [0x14049ae1a], rax
mov qword [0x14049ae2a], rax
mov byte [0x14049ae3a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14006e3a6
lea rcx, [0x14049ade0]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x14006e2f1
lea rsi, [0x14049ace0]
lea r8, [0x14049ae3a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x14006e29d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x14006e290
lea rcx, [0x14049ade0]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x14006e393
lea rcx, [0x14006e040]
mov qword [0x14049ace0], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14049ace0]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x14049ade0]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x14049ae3a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x14006e3c6
nop dword [rax]
cmp byte [rax], 0x41
jne 0x14006e343
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x14006e330
mov rax, rdx
mov qword [0x14049ace0], rax
lea rsi, [0x14049ace0]
jmp 0x14006e369
cmp rdx, rsi
je 0x14006e2cf
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x14006e360
cmp rdx, rsi
je 0x14006e2cf
mov qword [rdx + 8], rsi
lea rcx, [0x14006e040]
call sub.msvcrt.dll__onexit
jmp 0x14006e2cf
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.14006dfb0
xor eax, eax
jmp 0x14006e2e8
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.14006dfb0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.14006dfb0
xor eax, eax
jmp 0x14006e34f
Function at 0x140001270
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r9, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea r8, str.netsh
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0xfffffff5
cmp rax, 0x20
jbe case.default.0x1400012f7
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.DNS_disabled_successfully.
call fcn.140001930
mov rcx, rax
lea rdx, [0x140001b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xf
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 9
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_disable_DNS._Error_code:
mov ebx, eax
call fcn.140001930
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xf
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
Function at 0x401ab0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
sub rsp, 0x88
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov rsi, r8
mov rbp, rcx
lea r8, str.EPSONNET_EPDEVMGR.EXE_MUTEX
xor edx, edx
xor ecx, ecx
mov qword [rax - 0x20], rdi
mov ebx, r9d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401afe
mov eax, 0xffffffff
jmp 0x401b99
mov qword [rsp + 0x60], r12
xor r12d, r12d
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], r13
lea r13, [0x00404360]
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, rsi
mov rdx, rbp
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x40], r12
mov qword [0x00406088], rax
call fcn.00401990
test rdi, rdi
mov ebx, eax
je 0x401b5a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov r13, qword [rsp + 0x58]
test rcx, rcx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], r12d
mov r12, qword [rsp + 0x60]
je 0x401b97
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401b97
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret
Function at 0x4032f0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x00400000], 0x5a4d
je 0x40332d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x4033bb
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x403351
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4033bb
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x403398
cmp ecx, 0x20b
je 0x403370
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4033bb
cmp dword [rax + 0x84], 0xe
ja 0x403384
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4033bb
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x4033bb
cmp dword [rax + 0x74], 0xe
ja 0x4033a9
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4033bb
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x004060a8], 0xffffffffffffffff
mov qword [0x004060b0], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x004060a4]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x004060a0]
mov dword [rcx], eax
call fcn.00403590
cmp dword [0x00406070], 0
jne 0x403415
lea rcx, [fcn.00403590]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x00404208]
lea rcx, [0x00404200]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x0040609c]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00406098]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x004041f8]
lea rcx, [0x004041d8]
call fcn.00495000
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x4034b6
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x4034a6
cmp al, 0x22
je 0x4034a6
jmp 0x403490
cmp byte [r8], 0x22
jne 0x4034c6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4034c6
cmp byte [r8], 0x20
jbe 0x4034c6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4034b6
movzx eax, byte [r8]
test al, al
je 0x4034dc
cmp al, 0x20
ja 0x4034dc
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4034c6
test byte [rsp + 0x8c], 1
je 0x4034f1
movzx r9d, word [rsp + 0x90]
jmp 0x4034f7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.00401ab0
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x403513
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x403537
mov eax, edi
jmp 0x403540
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x459de0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x459e01
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x459e7d
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x459e22
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x459e7d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x459e60
cmp ecx, 0x20b
je 0x459e3e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x459e7d
cmp dword [rax + 0x84], 0xe
ja 0x459e4f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x459e7d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x459e7d
cmp dword [rax + 0x74], 0xe
ja 0x459e6e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x459e7d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call qword [0x0045b430]
mov qword [0x0047dd28], 0xffffffffffffffff
mov qword [0x0047dd30], 0xffffffffffffffff
mov rcx, qword [0x0045b428]
mov eax, dword [0x0047bd04]
mov dword [rcx], eax
mov rcx, qword [0x0045b420]
mov eax, dword [0x0047bd00]
mov dword [rcx], eax
call fcn.00458e60
cmp dword [0x0047b750], 0
jne 0x459ed7
lea rcx, [fcn.00458e60]
call qword [0x0045b418]
lea rdx, [0x0045b4a8]
lea rcx, [0x0045b4a0]
call fcn.00459fd4
mov r11d, dword [0x0047bcfc]
mov dword [rsp + 0x68], r11d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x0047bcf8]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [0x0045b408]
lea rdx, [0x0045b498]
lea rcx, [0x0045b440]
call fcn.00459fd4
mov r11, qword [rsp + 0x38]
mov rax, qword [0x0045b3f8]
mov qword [rax], r11
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.004569d4
mov edi, eax
mov dword [rsp + 0x34], eax
test ebx, ebx
jne 0x459f63
mov ecx, eax
call qword [0x0045b400]
call qword [0x0045b3f0]
jmp 0x459f84
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x6bac13a0
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov esi, edx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x4c], edx
mov edx, 2
mov qword [rsp + 0x38], rcx
lea rcx, [0x6bb49020]
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rbx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x6bac143f
xor edx, edx
mov rcx, rbx
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x6bac143f
test esi, esi
jle 0x6bac1429
xor eax, eax
mov r9, rbp
mov r8d, esi
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6bac1434
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6bac143f
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub esi, edx
jmp 0x6bac1408
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6bac1466
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov rdi, rcx
mov ebx, edx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x4c], edx
mov edx, 0x80000000
lea rbp, [rsp + 0x4c]
mov qword [rsp + 0x30], rcx
lea rcx, [0x6bb49020]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
xor eax, eax
cmp rsi, 0xffffffffffffffff
je 0x6bac14f7
test ebx, ebx
jle 0x6bac14dc
xor eax, eax
mov r9, rbp
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6bac14ec
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x6bac14f7
mov edx, dword [rsp + 0x4c]
add rdi, rdx
sub ebx, edx
jmp 0x6bac14bb
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6bac1550
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x6bb46670]
movsxd rcx, dword [rsi + 4]
call sub.msvcrt.dll_malloc
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rax
mov ecx, 0x400
call rdi
mov edx, dword [rsi + 4]
mov rcx, rbx
call fcn.6bac1466
test eax, eax
je 0x6bac1521
mov edx, dword [rsi + 4]
lea r8, [rsi + 8]
mov rcx, rbx
call fcn.6bac16a5
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x6bb49020]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cMSSE__d_server
call fcn.6bac1370
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea r8, [0x6bac1448]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x6bac1500
Function at 0x6bac1607
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x6bac1637
xor edx, edx
xor eax, eax
mov qword [0x6bb49060], rcx
xor r9d, r9d
mov dword [rsp + 0x20], edx
lea r8, [0x6bac15f0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x6bac16a5
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r9d, 4
movsxd r12, edx
mov rdi, rcx
mov rbp, r8
xor ecx, ecx
mov r8d, 0x3000
mov rdx, r12
mov rsi, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
xor eax, eax
cmp esi, eax
jle 0x6bac16f0
mov rdx, rax
and edx, 3
mov dl, byte [rbp + rdx]
xor dl, byte [rdi + rax]
mov byte [rbx + rax], dl
inc rax
jmp 0x6bac16d7
mov rcx, rbx
lea r9, [rsp + 0x3c]
mov r8d, 0x20
call fcn.6bac1673
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
xor edx, edx
mov r9, rbx
mov dword [rsp + 0x20], edx
lea r8, [0x6bac1670]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x6bac18e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6bac7350
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.6bac7350
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x6bac1950
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6bb490b4]
mov rbx, rcx
test esi, esi
jle 0x6bac1a80
mov rax, qword [0x6bb490b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x6bac199b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x6bac1a25
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x6bac1980
mov rcx, rbx
call fcn.6bac21b0
mov rdi, rax
test rax, rax
je 0x6bac1aa2
mov rax, qword [0x6bb490b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.6bac22f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x6bb490b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6bac1a87
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6bac1a1e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x6bac1a30
add dword [0x6bb490b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x6bb490b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6bac1a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6bac18e0
nop dword [rax]
xor esi, esi
jmp 0x6bac19a8
mov rax, qword [0x6bb490b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.6bac18e0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.6bac18e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x6bac1e20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x6bb490e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6bb490c0]
test rbx, rbx
je 0x6bac1e7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6bac1e73
test rsi, rsi
je 0x6bac1e73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6bac1e58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]