joyce8/EMBER2024-capa huggingface dataset:
Function at 0x647be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b0a5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ecx + 4], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.wxColour.0
call fcn.00532170
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxANIDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x647f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b124
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40
call fcn.007fff35
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x647fe4
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.wxColour.0
call fcn.00532170
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxANIDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x648e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b0a5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ecx + 4], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.wxColour.0
call fcn.00532170
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxGIFDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6490a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b207
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x144
call fcn.007fff35
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x64914e
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.wxColour.0
call fcn.00532170
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxGIFDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64fff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
test dword [esi - 4], eax
invalid
call dword [ebx]
mov byte [ebp - 0x3b9], 0xa
cld
invalid
dec dword [edx]
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0064f73b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0064f6f0
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0064f73b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0064f6f0
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0064f72b
js 0x650189
invalid
and al, 0xe1
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0064f73b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0064f6f0
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.0064f72b
iretd
Function at 0x66cc70
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
mov eax, dword [0xa5d1d4]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov ebx, dword [esp + 0x2cc]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x2c8]
push edi
mov edi, dword [esp + 0x2d0]
push 0x2b4
push 0
push eax
mov dword [esp + 0x18], esi
call fcn.00802480
mov eax, dword [esp + 0x2e4]
add esp, 0xc
or eax, 0x1010
cmp dword [edi + 0x14], 8
jb 0x66ccc8
mov edi, dword [edi]
push eax
push 0x2b4
lea eax, [esp + 0x18]
push eax
push 0x10
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x66ccfd
mov dword [esi], vtable.wxObject.0
mov eax, dword [0xa5ab24]
mov dword [esi + 4], eax
test eax, eax
je 0x66ccf5
inc dword [eax + 4]
mov dword [esi], vtable.wxBitmap.0
jmp 0x66cd10
push ebx
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0066cd30
add esp, 0x10
mov ecx, dword [esp + 0x2c4]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.008001d2
add esp, 0x2bc
ret
Function at 0x6747b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x1c4
push 0xffffffffffffffff
push 0x86f820
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp + 0x1c0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0x1cc]
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 0x1d0]
lea ecx, [ebp + 0xe0]
push eax
push edi
push dword [0xe84368]
mov dword [ebp - 0x14], 0
call fcn.0066e460
push esi
push ebx
push dword [0xe7a1c4]
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00501b80
push eax
lea ecx, [ebp + 0x140]
mov byte [ebp - 4], 1
call fcn.0051d780
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
mov dword [ebp - 0x64], vtable.wxObject.0
call fcn.0073d950
cmp dword [ebp + 0x18c], 0
mov byte [ebp - 4], 0
je 0x674875
mov eax, dword [edi]
lea ecx, [ebp + 0x18c]
push ecx
mov ecx, edi
call dword [eax + 0x3e4]
mov dword [ebp + 0x138], eax
lea eax, [ebp + 0xe0]
mov ecx, edi
push eax
call fcn.004faf90
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov byte [ebp - 0xd], al
call esi
test ax, ax
js 0x6748f7
push 0x10
call esi
test ax, ax
js 0x6748f7
push 0x12
call esi
test ax, ax
js 0x6748f7
cmp ebx, 0x20
je 0x6748b1
cmp ebx, 0xd
jne 0x6748f7
push 0
push 9
push 0x110a
push dword [edi + 0x13c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x6748f7
mov dword [ebp - 0x18], eax
lea ecx, [ebp]
lea eax, [ebp - 0x18]
push eax
push edi
push dword [0xe8436c]
call fcn.0066e460
lea eax, [ebp]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00672d30
lea ecx, [ebp]
call fcn.0062abf0
lea ecx, [ebp + 0x19c]
call fcn.00436d10
lea ecx, [ebp + 0x140]
mov dword [ebp - 4], 4
mov dword [ebp + method.wxObject.virtual_0], vtable.wxObject.0
call fcn.0073d950
lea ecx, [ebp + 0x10c]
call fcn.00436d10
lea ecx, [ebp + 0xe0]
mov dword [ebp - 4], 5
mov dword [ebp + 0xe0], vtable.wxObject.0
call fcn.0073d950
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1c0]
xor ecx, ebp
call fcn.008001d2
lea esp, [ebp + 0x1c4]
pop ebp
ret 8
Function at 0x68d270
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x68d2a4
push esi
call fcn.00691cc0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x68d29b
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x68d2ab
cmp eax, 0xcb
jne 0x68d323
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x68d30e
mov eax, dword [esi + 8]
test eax, eax
je 0x68d2c6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x68d309
cmp eax, 2
je 0x68d30e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x68d2b7
cmp eax, 3
je 0x68d2ee
cmp eax, 1
jne 0x68d2b7
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x68d2b7
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x68d2b7
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0068d360
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x68d345
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0068d360
add esp, 4
pop edi
pop esi
ret

Function at 0x68d360
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x68d38c
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x68d433
mov ecx, dword [esi + 0x78]
lea edi, [esi + 0x78]
cmp ecx, dword [esi + 0x60]
jae 0x68d402
mov eax, dword [esi + 8]
mov ebx, ecx
test eax, eax
je 0x68d3c9
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov ebx, dword [edi]
add esp, 4
mov ecx, dword [esi + 0xc0]
mov eax, dword [esi + 0x184]
cmp ecx, 0x10
jne 0x68d3df
mov eax, dword [eax + 0xc]
jmp 0x68d3ec
cmp ecx, 0xc
jne 0x68d3e9
mov eax, dword [eax + 8]
jmp 0x68d3ec
mov eax, dword [eax + 4]
push 0
push edi
push 0
push esi
call eax
mov ecx, dword [edi]
add esp, 0x10
cmp ecx, ebx
je 0x68d449
cmp ecx, dword [esi + 0x60]
jb 0x68d3a7
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [edi], 0
xor ecx, ecx
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], cl
jne 0x68d3a2
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x6bb780
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1a8]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x20], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x18]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x6bb8b3
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x24]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x6bb7fe
mov eax, dword [esi + 0x1c]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x1c]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x6bb844
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x6bb832
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x6bb820
cmp dword [esp + 0x18], 1
jne 0x6bb891
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x6bb870
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x6bb7e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x6f0a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [esi + 0x38]
call fcn.00707540
push eax
push esi
call fcn.007076b0
push 0x108
push 0
push edi
call fcn.006f0340
mov ebp, 1
mov dword [edi + 0x34], 0x10001
mov dword [edi + 0x2c], 0x10001
mov eax, 2
mov word [edi + 0x54], ax
add esp, 0x14
mov dword [edi + 0x38], 0x10001
xor eax, eax
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0xd8], 0x20002
mov word [edi + 0xdc], bp
mov dword [esi + 0x334], fcn.00437080
mov dword [esi + 0x340], 0
mov dword [esi + 0x344], 0x6f19e0
mov dword [esi + 0x348], 0x6f10b0
mov dword [esi + 0x34c], 0
mov word [edi + 0x56], bp
mov word [edi + 0x30], bp
mov dword [edi + 0x28], 0
mov dword [edi + 0x40], 0x10000
mov word [edi + 0x74], ax
mov dword [edi + 0x78], eax
cmp dword [esi + 0x358], eax
jbe 0x6f0b7d
push ebx
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x354]
cmp dword [ebx + eax + 4], 0
je 0x6f0b4d
push dword [ebx + eax + 0xc]
push esi
call fcn.00706a80
add esp, 8
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x358]
jb 0x6f0b33
push dword [esi + 0x354]
push esi
call fcn.00706a80
add esp, 8
mov dword [esi + 0x358], 0
mov dword [esi + 0x354], 0
pop ebx
mov eax, dword [0xea4408]
test eax, eax
je 0x6f0b8c
push esi
call eax
add esp, 4
push 1
push 0x103
push esi
call fcn.006f0fc0
and dword [esi + 0xc], 0xfffffbf7
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
ret
Function at 0x759220
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x87581e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
push 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push 0x1004
push dword [ebp + 0xc]
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x7592cb
cmp word [ebp - 0x30], 0x30
jne 0x7592a5
cmp word [ebp - 0x2e], 0
je 0x7592cb
lea ecx, [ebp - 0x30]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7592b0
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00437690
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret
Function at 0x761070
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x7610a1
push esi
mov esi, ecx
movzx ecx, si
lea edx, [edx + 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x761081
pop esi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x761490
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x876241
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0xea52ac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0xea47f4]
cmp eax, dword [ecx + 0xc]
jg 0x7614e6
mov eax, 0xea47dc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xea47f4
call fcn.008008ed
add esp, 4
cmp dword [0xea47f4], 0xffffffff
jne 0x7614d0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.FlsAlloc
push 0x8ab8cc
mov dword [ebp - 4], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.FlsFree
push 0x8ab8cc
mov dword [0xea47dc], eax
mov dword [0xea47e0], 0
call edi
push eax
call esi
push str.FlsGetValue
push 0x8ab8cc
mov dword [0xea47e4], eax
call edi
push eax
call esi
push str.FlsSetValue
push 0x8ab8cc
mov dword [0xea47e8], eax
call edi
push eax
call esi
mov ecx, dword [0xea47dc]
mov dword [0xea47ec], eax
test ecx, ecx
je 0x761592
cmp dword [0xea47e4], 0
je 0x761592
cmp dword [0xea47e8], 0
je 0x761592
test eax, eax
je 0x761592
push 0x7612d0
call ecx
jmp 0x7615ca
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xea47e4], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0xea47e8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0xea47dc], 0
mov dword [0xea47e0], ecx
mov dword [0xea47ec], eax
call ecx
jmp 0x7615ca
push 0xea47f4
mov dword [0xea47f0], eax
call fcn.008008a3
add esp, 4
jmp 0x7614d0
Function at 0x779980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x87848d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0xea47c8], 0
je 0x7799cd
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0xea47c8]
je 0x7799cd
push 0
call fcn.00741400
add esp, 4
mov bl, al
jmp 0x7799da
mov bl, byte [0xa5c73c]
mov byte [0xa5c73c], 0
mov byte [ebp - 0x11], bl
mov byte [ebp - 0xd], bl
push 0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00779c00
test al, al
jne 0x7799f8
xor bh, bh
jmp 0x779a23
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x779a05
xor eax, eax
jmp 0x779a0d
cmp dword [eax + 0x14], 8
jb 0x779a0d
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bh
cmp dword [0xea47c8], 0
mov dword [ebp - 4], 1
je 0x779a4d
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0xea47c8]
je 0x779a4d
push dword [ebp - 0x11]
call fcn.00741400
add esp, 4
jmp 0x779a53
mov byte [0xa5c73c], bl
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x78d020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84009d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov cl, bl
mov eax, dword [ebp + 8]
and cl, 1
mov byte [ebp - 0x31], cl
lea ecx, [ebp - 0x30]
push eax
shr ebx, 1
call fcn.004cb460
mov dword [ebp - 4], 0
and bl, 1
je 0x78d0d6
lea eax, [ebp - 0x30]
push eax
call fcn.007a8fb0
add esp, 4
test al, al
je 0x78d0d6
nop
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x78d0d6
cmp esi, 3
jne 0x78d0a5
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x30]
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
je 0x78d0dc
jmp 0x78d0ba
cmp esi, 0x31
jne 0x78d0ba
lea eax, [ebp - 0x30]
push eax
call fcn.00789ee0
add esp, 4
test al, al
jne 0x78d0d6
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x30]
call fcn.00739190
lea eax, [ebp - 0x30]
push eax
call fcn.007a8fb0
add esp, 4
test al, al
jne 0x78d080
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
cmp ecx, 8
lea eax, [ebp - 0x30]
cmovae eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78d0f5
xor bl, bl
jmp 0x78d0fc
test al, 0x10
jne 0x78d0fc
mov bl, byte [ebp - 0x31]
lea ecx, [ebp - 0x30]
call fcn.00436d10
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret

Function at 0x78ea80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x879f9b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi], vtable.wxStringTokenizer.0
xor eax, eax
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 7
mov word [edi + 0xc], ax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
mov dword [edi + 0x2c], eax
mov dword [ebp - 0x14], esi
call fcn.00737b00
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.00737b00
mov dword [esi], eax
push dword [ebp + 0x10]
mov ecx, edi
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
mov dword [edi + 0x38], 0
push dword [ebp + 8]
call fcn.0078ee70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc