joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70d38e
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x7c9662
call fcn.007337aa
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x70d3b8
lea eax, [ebp + 8]
push eax
call fcn.0061b3a0
pop ecx
jmp 0x70d533
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x70d3e6
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x70d3e6
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x70d533
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x70d52e
cmp dword [esi + 0x3c], ebx
jne 0x70d40f
push eax
push edi
call fcn.0070cb37
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x70d533
jmp 0x70d52e
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.00614100
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x70d500
cmp eax, 1
jg 0x70d53b
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x70d4a5
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0072b81c
add esp, 0x10
cmp edi, eax
jne 0x70d522
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x70d56b
test edi, edi
ja 0x70d4cb
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x70d527
push 8
call fcn.00460c90
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x70d45c
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.004073b0
mov eax, 0xffff
call fcn.0073382d
ret 4
cmp eax, 3
jne 0x70d522
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.0070cb37
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x70d55a
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004073b0
mov ax, si
jmp 0x70d533
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004073b0
mov ax, word [ebp + 8]
jmp 0x70d533

Function at 0x71fe0b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x89b044]
jne 0x71fe15
repz ret
jmp fcn.00736cac
Function at 0x7252b5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x7252e6
call fcn.00726201
mov dword [eax], esi
call fcn.007261ee
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0071ff90
add esp, 0x14
push 0x16
pop eax
jmp 0x72533b
test dword [ebp + 0xc], 0xfffffff9
jne 0x7252c2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x725313
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00726214
pop ecx
call fcn.007261ee
mov eax, dword [eax]
jmp 0x72533b
test al, 0x10
jne 0x725339
test al, 1
je 0x725339
test byte [ebp + 0xc], 2
je 0x725339
call fcn.00726201
mov dword [eax], 5
call fcn.007261ee
mov dword [eax], 0xd
jmp 0x72530a
xor eax, eax
pop esi
pop ebp
ret
Function at 0x74c78a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.007365e6
and dword [ebp - 4], 0
cmp dword [0x8a27b8], 0
mov ebx, eax
jne 0x74c83b
push 0x824a34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x74c8ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x824a28
push edi
call esi
test eax, eax
je 0x74c8ec
push eax
call fcn.00736574
mov dword [esp], 0x824a18
push edi
mov dword [0x8a27b8], eax
call esi
push eax
call fcn.00736574
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x8a27bc], eax
call esi
push eax
call fcn.00736574
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x8a27c0], eax
call esi
push eax
call fcn.00736574
pop ecx
mov dword [0x8a27c8], eax
test eax, eax
je 0x74c83b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00736574
pop ecx
mov dword [0x8a27c4], eax
mov eax, dword [0x8a27c4]
cmp eax, ebx
je 0x74c893
cmp dword [0x8a27c8], ebx
je 0x74c893
push eax
call fcn.007365ef
push dword [0x8a27c8]
mov esi, eax
call fcn.007365ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x74c893
test edi, edi
je 0x74c893
call esi
test eax, eax
je 0x74c88a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x74c88a
test byte [ebp - 0xc], 1
jne 0x74c893
or dword [ebp + 0x10], 0x200000
jmp 0x74c8cc
mov eax, dword [0x8a27bc]
cmp eax, ebx
je 0x74c8cc
push eax
call fcn.007365ef
pop ecx
test eax, eax
je 0x74c8cc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x74c8cc
mov eax, dword [0x8a27c0]
cmp eax, ebx
je 0x74c8cc
push eax
call fcn.007365ef
pop ecx
test eax, eax
je 0x74c8cc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x8a27b8]
call fcn.007365ef
pop ecx
test eax, eax
je 0x74c8ec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x74c8ee
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7517e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x751815
call fcn.00726201
mov dword [eax], esi
call fcn.007261ee
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0071ff90
add esp, 0x14
push 0x16
pop eax
jmp 0x75186a
test dword [ebp + 0xc], 0xfffffff9
jne 0x7517f1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x751842
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00726214
pop ecx
call fcn.007261ee
mov eax, dword [eax]
jmp 0x75186a
test al, 0x10
jne 0x751868
test al, 1
je 0x751868
test byte [ebp + 0xc], 2
je 0x751868
call fcn.00726201
mov dword [eax], 5
call fcn.007261ee
mov dword [eax], 0xd
jmp 0x751839
xor eax, eax
pop esi
pop ebp
ret
Function at 0x75813d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.007365e6
and dword [ebp - 4], 0
cmp dword [0x8a2868], 0
mov ebx, eax
jne 0x7581ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x75829f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x75829f
push eax
call fcn.00736574
mov dword [esp], 0x824a18
push edi
mov dword [0x8a2868], eax
call esi
push eax
call fcn.00736574
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x8a286c], eax
call esi
push eax
call fcn.00736574
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x8a2870], eax
call esi
push eax
call fcn.00736574
pop ecx
mov dword [0x8a2878], eax
test eax, eax
je 0x7581ee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00736574
pop ecx
mov dword [0x8a2874], eax
mov eax, dword [0x8a2874]
cmp eax, ebx
je 0x758246
cmp dword [0x8a2878], ebx
je 0x758246
push eax
call fcn.007365ef
push dword [0x8a2878]
mov esi, eax
call fcn.007365ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x758246
test edi, edi
je 0x758246
call esi
test eax, eax
je 0x75823d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x75823d
test byte [ebp - 0xc], 1
jne 0x758246
or dword [ebp + 0x10], 0x200000
jmp 0x75827f
mov eax, dword [0x8a286c]
cmp eax, ebx
je 0x75827f
push eax
call fcn.007365ef
pop ecx
test eax, eax
je 0x75827f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x75827f
mov eax, dword [0x8a2870]
cmp eax, ebx
je 0x75827f
push eax
call fcn.007365ef
pop ecx
test eax, eax
je 0x75827f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x8a2868]
call fcn.007365ef
pop ecx
test eax, eax
je 0x75829f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x7582a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7628b0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x7cb798
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x760080
push 0x8a2888
call fcn.007611f0
mov eax, dword [0x8a2890]
add esp, 8
test eax, eax
je 0x76290a
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.007203ea
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.00581190
int3
Function at 0x762940
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x7cb7c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x8a2890]
test eax, eax
jne 0x762972
xor esi, esi
jmp 0x76297b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x7629a7
cmp dword [esi + 0x14], 0
jne 0x7629e9
cmp dword [esi + 0x10], 0
jne 0x7629f0
push 0
call fcn.007628b0
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x7629d5
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x7629d5
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x762a30
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x762a1e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x7629f0
cmp dword [esi + 0x14], 0
je 0x762997
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x762a55
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x762a86
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x762a86
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x762a86
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x762a3a
jmp 0x762991
Function at 0x762b20
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x7cb818
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x762aa0
push 0
push 0
call fcn.007263d8
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x762b8b
lea ecx, [esp + 0x10]
call fcn.007203ea
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00581190
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x762bb1
cmp eax, 0xffffffff
je 0x762bb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x762ce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7cb878
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405b10
mov dword [esp + 0x18], 0
test edi, edi
je 0x762d24
add edi, 0x28
jmp 0x762d26
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x762d3e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x7637e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7cba88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00417bd0
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x76382a
add edi, 0x28
jmp 0x76382c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x763844
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x763880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7cbab8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00417bd0
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x7638ca
add edi, 0x28
jmp 0x7638cc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x7638e4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x763920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7cbae8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00417bd0
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x76396a
add edi, 0x28
jmp 0x76396c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x763984
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x7675a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x7675d1
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movzx edi, word [ecx]
lea esi, [esi + edi - 0x61c88647]
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x7675b0
pop edi
pop esi
ret
Function at 0x775f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7cc288
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00417bd0
mov dword [esp + 0x18], 0
test edi, edi
je 0x775f84
add edi, 0x28
jmp 0x775f86
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x775f9e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x779430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7cc8c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00417bd0
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x77947a
add edi, 0x28
jmp 0x77947c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x779494
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x781f00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x7cd323
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0077ccf0
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0077ccf0
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.0077ccf0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x790810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x7fc3f9
mov dword [esp], eax
mov dword [esp + 4], 0x827154
mov dword [esp + 8], 0x8151f0
mov dword [esp + 0xc], 0x827150
mov dword [esp + 0x10], 0x82554c
mov dword [esp + 0x14], 0x80a240
mov dword [esp + 0x18], 0x80aa6c
mov dword [esp + 0x1c], 0x825570
mov dword [esp + 0x20], 0x82f398
mov dword [esp + 0x24], 0x82714c
mov dword [esp + 0x28], 0x827148
mov dword [esp + 0x2c], 0x825548
mov dword [esp + 0x30], 0x81cb30
mov dword [esp + 0x34], 0x827144
mov dword [esp + 0x38], 0x80bee8
mov dword [esp + 0x3c], 0x827140
mov dword [esp + 0x40], 0x82713c
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x826e94
mov dword [esp + 0x4c], 0x80a19c
mov dword [esp + 0x50], 0x80f864
mov dword [esp + 0x54], 0x80f580
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x82712c
mov dword [esp + 0x64], 0x827128
mov dword [esp + 0x68], 0x80bb10
mov dword [esp + 0x6c], 0x825558
mov dword [esp + 0x70], 0x80bee0
mov dword [esp + 0x74], 0x826e8c
mov dword [esp + 0x78], 0x826e6c
mov dword [esp + 0x7c], 0x80ab3c
mov dword [esp + 0x80], 0x826e5c
mov dword [esp + 0x84], 0x826e54
mov dword [esp + 0x88], 0x826e50
mov dword [esp + 0x8c], 0x826e90
mov dword [esp + 0x90], 0x827124
mov dword [esp + 0x94], 0x81c5ac
mov dword [esp + 0x98], 0x8151b0
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x80a190
mov dword [esp + 0xc0], 0x80a164
mov dword [esp + 0xc4], 0x80a150
mov dword [esp + 0xc8], 0x80a198
mov dword [esp + 0xcc], str.ZYXWTSRQPONMLKJHGFEDCBA
mov dword [esp + 0xd0], 0x80a188
mov dword [esp + 0xd4], 0x825590
mov dword [esp + 0xd8], 0x826e64
mov dword [esp + 0xdc], 0x80a168
mov dword [esp + 0xe0], 0x80a170
mov dword [esp + 0xe4], 0x827120
mov dword [esp + 0xe8], 0x80a17c
mov dword [esp + 0xec], 0x80a160
cmp cl, 0x3c
jae 0x790a2d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret