joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fb4b0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x709e6d
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x2ec], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x300]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x82e960], 0
mov ebx, dword [esp + 0x310]
mov esi, dword [esp + 0x314]
je 0x5fb537
cmp dword [edi], 0
jne 0x5fb537
push 0
push str.IsOpened__
push str.wxRegKey::GetNextKey
push 0x473
push str....._srcmsw_registry.cpp
call fcn.005c6f20
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x5fb537
mov byte [0x87c8e0], 0
int3
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x5fb6e5
lea eax, [ecx + 1]
mov dword [esi], eax
lea eax, [esp + 0xf0]
push 0x105
push eax
push ecx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x5fb6e9
cmp eax, 0x103
jne 0x5fb583
mov dword [edi + 0x30], 0
xor al, al
mov dword [esi], 0xffffffff
jmp 0x5fb6fa
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x5fb6e5
push str.Cant_enumerate_subkeys_of_key__s
lea ecx, [esp + 0x6c]
call fcn.00418040
xor eax, eax
mov dword [esp + 0x308], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov byte [esp + 0x308], 1
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00420160
add esp, 8
lea ecx, [esp + 0x34]
push eax
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x4c]
mov byte [esp + 0x30c], 2
call fcn.00418040
push 1
lea eax, [esp + 0x8c]
mov byte [esp + 0x30c], 3
push eax
mov ecx, edi
call fcn.005fb3b0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, eax
call fcn.0041f670
push 0x721844
push str.wxRegKey::GetNextKey
push 0x489
push str....._srcmsw_registry.cpp
push 1
lea ecx, [esp + 0xc8]
mov byte [esp + 0x328], 5
call fcn.00439de0
mov esi, eax
mov byte [esp + 0x314], 6
lea eax, [esp + 0x40]
push eax
push dword [edi + 0x30]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x60]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0x31c], 7
call fcn.005f8550
lea ecx, [esp + 0xa8]
mov byte [esp + 0x308], 4
call fcn.0043f270
lea ecx, [esp + 0x88]
call fcn.00418210
lea ecx, [esp + 0x48]
call fcn.00418210
lea ecx, [esp + 0x34]
mov byte [esp + 0x308], 1
call fcn.00420020
lea ecx, [esp + 0x14]
call fcn.00418210
lea ecx, [esp + 0x68]
call fcn.00418210
xor al, al
jmp 0x5fb6fa
lea eax, [esp + 0xf0]
mov ecx, ebx
push eax
call fcn.00429330
mov al, 1
mov ecx, dword [esp + 0x300]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2ec]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x2fc
ret 8
Function at 0x5fb730
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x709eed
mov eax, dword fs:[0]
push eax
sub esp, 0x8e8
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x8e4], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x8f8]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x82e960], 0
mov ebx, dword [esp + 0x908]
mov esi, dword [esp + 0x90c]
je 0x5fb7b7
cmp dword [edi], 0
jne 0x5fb7b7
push 0
push str.IsOpened__
push str.wxRegKey::GetNextValue
push 0x446
push str....._srcmsw_registry.cpp
call fcn.005c6f20
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x5fb7b7
mov byte [0x87c8e0], 0
int3
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x5fb975
push 0
push 0
push 0
lea eax, [ecx + 1]
mov dword [esp + 0x20], 0x400
mov dword [esi], eax
lea eax, [esp + 0x20]
push 0
push eax
lea eax, [esp + 0x108]
push eax
push ecx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x5fb979
cmp eax, 0x103
jne 0x5fb813
mov dword [edi + 0x30], 0
xor al, al
mov dword [esi], 0xffffffff
jmp 0x5fb98a
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x5fb975
push str.Cant_enumerate_values_of_key__s
lea ecx, [esp + 0x70]
call fcn.00418040
xor eax, eax
mov dword [esp + 0x900], 0
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x900], 1
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00420160
add esp, 8
lea ecx, [esp + 0x38]
push eax
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x50]
mov byte [esp + 0x904], 2
call fcn.00418040
push 1
lea eax, [esp + 0x90]
mov byte [esp + 0x904], 3
push eax
mov ecx, edi
call fcn.005fb3b0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, eax
call fcn.0041f670
push 0x721844
push str.wxRegKey::GetNextValue
push 0x45c
push str....._srcmsw_registry.cpp
push 1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x920], 5
call fcn.00439de0
mov esi, eax
mov byte [esp + 0x90c], 6
lea eax, [esp + 0x44]
push eax
push dword [edi + 0x30]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x64]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0x914], 7
call fcn.005f8550
lea ecx, [esp + 0xac]
mov byte [esp + 0x900], 4
call fcn.0043f270
lea ecx, [esp + 0x8c]
call fcn.00418210
lea ecx, [esp + 0x4c]
call fcn.00418210
lea ecx, [esp + 0x38]
mov byte [esp + 0x900], 1
call fcn.00420020
lea ecx, [esp + 0x18]
call fcn.00418210
lea ecx, [esp + 0x6c]
call fcn.00418210
xor al, al
jmp 0x5fb98a
lea eax, [esp + 0xf4]
mov ecx, ebx
push eax
call fcn.00429330
mov al, 1
mov ecx, dword [esp + 0x8f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8e4]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x8f4
ret 8
Function at 0x5fba20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x709f67
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0xe4], eax
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0xf4]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x104]
push 0
call fcn.005fc120
test al, al
je 0x5fbc20
cmp dword [esi + 0x10], 0
jne 0x5fba7b
xor esi, esi
jmp 0x5fba83
cmp dword [esi + 0x14], 8
jb 0x5fba83
mov esi, dword [esi]
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x5fbc24
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x5fbc20
push str.Cant_read_value_of_key__s
lea ecx, [esp + 0x4c]
call fcn.00418040
xor eax, eax
mov dword [esp + 0xfc], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x2c], eax
mov byte [esp + 0xfc], 1
call fcn.005eae80
test eax, eax
je 0x5fbb1d
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call fcn.005ecae0
test eax, eax
jne 0x5fbb2a
lea eax, [esp + 0x48]
push eax
call fcn.005ed1e0
add esp, 4
push eax
lea ecx, [esp + 0x38]
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x6c]
mov byte [esp + 0x100], 2
call fcn.00418040
push 1
lea eax, [esp + 0x8c]
mov byte [esp + 0x100], 3
push eax
mov ecx, edi
call fcn.005fb3b0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, eax
call fcn.0041f670
push 0x721844
push str.wxRegKey::GetValueType
push 0x36d
push str....._srcmsw_registry.cpp
push 1
lea ecx, [esp + 0xc8]
mov byte [esp + 0x11c], 5
call fcn.00439de0
mov esi, eax
mov byte [esp + 0x108], 6
lea eax, [esp + 0x40]
push eax
push dword [edi + 0x30]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x80]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0x110], 7
call fcn.005f8550
lea ecx, [esp + 0xa8]
mov byte [esp + 0xfc], 4
call fcn.0043f270
lea ecx, [esp + 0x88]
call fcn.00418210
lea ecx, [esp + 0x68]
call fcn.00418210
lea ecx, [esp + 0x34]
mov byte [esp + 0xfc], 1
call fcn.00420020
lea ecx, [esp + 0x14]
call fcn.00418210
lea ecx, [esp + 0x48]
call fcn.00418210
xor eax, eax
jmp 0x5fbc28
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xf4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xe4]
xor ecx, esp
call fcn.006d1ba7
add esp, 0xf4
ret 4
Function at 0x5fbeb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x709fa8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x87e974], 0
je 0x5fbefb
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x87e974]
je 0x5fbefb
push 0
call fcn.005e3e40
add esp, 4
mov bl, al
jmp 0x5fbf08
mov bl, byte [0x82e9e4]
mov byte [0x82e9e4], 0
mov byte [esp + 0x10], bl
mov byte [esp + 0xf], bl
push 0
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.005fc120
test al, al
jne 0x5fbf29
xor bh, bh
jmp 0x5fbf55
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x10], 0
jne 0x5fbf37
xor eax, eax
jmp 0x5fbf3f
cmp dword [eax + 0x14], 8
jb 0x5fbf3f
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bh
cmp dword [0x87e974], 0
mov dword [esp + 0x1c], 0xffffffff
je 0x5fbf81
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x87e974]
je 0x5fbf81
push dword [esp + 0x10]
call fcn.005e3e40
add esp, 4
jmp 0x5fbf87
mov byte [0x82e9e4], bl
mov al, bh
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x5fcb80
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x70a1f7
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x10c]
mov ebx, dword [esp + 0x110]
push 0
call fcn.005fc120
test al, al
je 0x5fcde4
cmp dword [esi + 0x10], 0
jne 0x5fcbe3
xor eax, eax
jmp 0x5fcbef
cmp dword [esi + 0x14], 8
jb 0x5fcbed
mov eax, dword [esi]
jmp 0x5fcbef
mov eax, esi
lea ecx, [esp + 0x10]
push ecx
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x5fcc5c
mov eax, dword [esp + 0x10]
mov ecx, ebx
test eax, eax
je 0x5fcc55
push eax
call fcn.005ed210
cmp dword [esi + 0x10], 0
jne 0x5fcc27
xor esi, esi
jmp 0x5fcc2f
cmp dword [esi + 0x14], 8
jb 0x5fcc2f
mov esi, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov ecx, ebx
mov dword [edi + 0x30], eax
call fcn.00575af0
jmp 0x5fcc5c
push 0
call fcn.00575af0
cmp dword [edi + 0x30], 0
je 0x5fce0f
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x5fcde4
push str.Cant_read_value_of_key__s
lea ecx, [esp + 0x54]
call fcn.00418040
xor eax, eax
mov dword [esp + 0x104], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x34], eax
mov byte [esp + 0x104], 1
call fcn.005eae80
test eax, eax
je 0x5fcce1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x54]
push ecx
mov ecx, eax
call fcn.005ecae0
test eax, eax
jne 0x5fccee
lea eax, [esp + 0x50]
push eax
call fcn.005ed1e0
add esp, 4
push eax
lea ecx, [esp + 0x40]
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x74]
mov byte [esp + 0x108], 2
call fcn.00418040
push 1
lea eax, [esp + 0x94]
mov byte [esp + 0x108], 3
push eax
mov ecx, edi
call fcn.005fb3b0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, eax
call fcn.0041f670
push 0x721844
push str.wxRegKey::QueryValue
push 0x3cb
push str....._srcmsw_registry.cpp
push 1
lea ecx, [esp + 0xd0]
mov byte [esp + 0x124], 5
call fcn.00439de0
mov esi, eax
mov byte [esp + 0x110], 6
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x30]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x88]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0x118], 7
call fcn.005f8550
lea ecx, [esp + 0xb0]
mov byte [esp + 0x104], 4
call fcn.0043f270
lea ecx, [esp + 0x90]
call fcn.00418210
lea ecx, [esp + 0x70]
call fcn.00418210
lea ecx, [esp + 0x3c]
mov byte [esp + 0x104], 1
call fcn.00420020
lea ecx, [esp + 0x1c]
call fcn.00418210
lea ecx, [esp + 0x50]
call fcn.00418210
xor al, al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.006d1ba7
add esp, 0xf8
ret 8
mov al, 1
jmp 0x5fcde6
Function at 0x5fce20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x70a277
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x10c]
mov ebx, dword [esp + 0x110]
push 0
call fcn.005fc120
test al, al
je 0x5fd036
cmp dword [esi + 0x10], 0
mov dword [esp + 0x14], 4
jne 0x5fce8b
xor eax, eax
jmp 0x5fce97
cmp dword [esi + 0x14], 8
jb 0x5fce95
mov eax, dword [esi]
jmp 0x5fce97
mov eax, esi
lea ecx, [esp + 0x14]
push ecx
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x5fd061
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x5fd036
push str.Cant_read_value_of_key__s
lea ecx, [esp + 0x54]
call fcn.00418040
xor eax, eax
mov dword [esp + 0x104], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x34], eax
mov byte [esp + 0x104], 1
call fcn.005eae80
test eax, eax
je 0x5fcf33
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x54]
push ecx
mov ecx, eax
call fcn.005ecae0
test eax, eax
jne 0x5fcf40
lea eax, [esp + 0x50]
push eax
call fcn.005ed1e0
add esp, 4
push eax
lea ecx, [esp + 0x40]
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x74]
mov byte [esp + 0x108], 2
call fcn.00418040
push 1
lea eax, [esp + 0x94]
mov byte [esp + 0x108], 3
push eax
mov ecx, edi
call fcn.005fb3b0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, eax
call fcn.0041f670
push 0x721844
push str.wxRegKey::QueryValue
push 0x38d
push str....._srcmsw_registry.cpp
push 1
lea ecx, [esp + 0xd0]
mov byte [esp + 0x124], 5
call fcn.00439de0
mov esi, eax
mov byte [esp + 0x110], 6
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x30]
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x88]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0x118], 7
call fcn.005f8550
lea ecx, [esp + 0xb0]
mov byte [esp + 0x104], 4
call fcn.0043f270
lea ecx, [esp + 0x90]
call fcn.00418210
lea ecx, [esp + 0x70]
call fcn.00418210
lea ecx, [esp + 0x3c]
mov byte [esp + 0x104], 1
call fcn.00420020
lea ecx, [esp + 0x1c]
call fcn.00418210
lea ecx, [esp + 0x50]
call fcn.00418210
xor al, al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.006d1ba7
add esp, 0xf8
ret 8
cmp dword [0x82e960], 0
je 0x5fd0ac
push esi
mov ecx, edi
call fcn.005fba20
add eax, 0xfffffffc
cmp eax, 1
jbe 0x5fd0ac
push str.Type_mismatch_in_wxRegKey::QueryValue__.
push str.IsNumericValue_szValue_
push str.wxRegKey::QueryValue
push 0x394
push str....._srcmsw_registry.cpp
call fcn.005c7220
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x5fd0ac
mov byte [0x87c8e0], 0
int3
mov al, 1
jmp 0x5fd038
Function at 0x601d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x704a78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x2c]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x3c], 0
call fcn.00640da0
mov dword [esp + 0x38], 0xffffffff
mov dword [eax], edi
push dword [esp + 0x24]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [esp + 0x20], 8
jb 0x601dbf
push dword [esp + 0xc]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
push 8
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x18]
mov edx, eax
add esp, 4
mov dword [ecx], edx
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx]
mov dword [ecx], edi
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx]
mov dword [ecx + 4], 0
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
add eax, 4
mov dword [esi + 0x18], eax
mov eax, edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x30
ret 4

Function at 0x603fb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x70afde
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov ecx, dword [esp + 0x20]
mov dword [esi], vtable.wxZipEntry.0
mov dword [esi + 0xc], 0x141e00
mov dword [esi + 0x10], 0xffff0000
mov eax, dword [ecx]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x34], eax
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x4c], 7
mov dword [esi + 0x48], 0
mov word [esi + 0x38], ax
mov dword [esp + 0x14], 0
mov dword [esi + 0x50], eax
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x7c], 7
mov dword [esi + 0x78], eax
mov word [esi + 0x68], ax
mov dword [esi + 0x80], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x14], 2
cmp dword [eax + 0x10], 0
je 0x6040b8
push 0
push eax
mov ecx, esi
call fcn.0060b930
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x604520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70b0b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxRawInputStream.0
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x18], 1
test ecx, ecx
je 0x604565
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov byte [esp + 0x18], 0
call fcn.005c92f0
mov ecx, dword [esi + 0x34]
cmp ecx, eax
je 0x6045aa
mov eax, 0xffff
add word [ecx + 8], ax
jne 0x6045a2
mov edi, dword [esi + 0x34]
test edi, edi
je 0x6045a2
cmp byte [edi + 0xa], 0
je 0x604599
push dword [edi]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.005c92f0
mov dword [esi + 0x34], eax
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0060e6d0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x60bc70
Capabilities:
Enumerate pe sections
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x70bba0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
push dword [esp + 0x3c]
lea eax, [esp + 0x40]
add ecx, 0x10
push eax
call fcn.0041f710
mov esi, eax
mov dword [esp + 0x30], 0
call fcn.005c92f0
mov dword [esp + 0x10], eax
push esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 1
call fcn.0055efd0
mov byte [esp + 0x30], 3
call fcn.005c92f0
mov ecx, dword [esp + 0x3c]
mov edx, 0xffff
cmp ecx, eax
je 0x60bd15
add word [ecx + 8], dx
jne 0x60bd0c
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x60bd0c
cmp byte [esi + 0xa], 0
je 0x60bd03
push dword [esi]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.005c92f0
mov dword [esp + 0x3c], eax
mov esi, dword [esp + 0x10]
mov ebx, 0x7cec1e
mov eax, dword [esi]
test eax, eax
cmovne ebx, eax
mov eax, ebx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x60bd30
sub eax, edx
movzx eax, ax
mov dword [esp + 0x14], eax
mov eax, dword [0x87c828]
test eax, eax
jne 0x60bd53
call fcn.005c3860
mov dword [0x87c828], eax
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0x1c]
push eax
push edi
call fcn.006368a0
mov ecx, dword [esp + 0x18]
push dword [esp + 0x14]
mov byte [esp + 0x34], 4
push dword [ecx + 0xc]
movzx eax, word [ecx + 6]
push dword [ecx + 8]
push eax
movzx eax, word [ecx + 4]
push eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
lea ecx, [esp + 0x34]
push eax
push 0x6054b50
call fcn.00636930
mov ecx, eax
call fcn.00636900
mov ecx, eax
call fcn.00636900
mov ecx, eax
call fcn.00636900
mov ecx, eax
call fcn.00636900
mov ecx, eax
call fcn.00636930
mov ecx, eax
call fcn.00636930
mov ecx, eax
call fcn.00636900
mov eax, dword [esp + 0x14]
mov ecx, edi
mov edx, dword [edi]
movzx eax, ax
push eax
push ebx
call dword [edx + 0x28]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x10]
call eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
mov bl, al
call fcn.006368d0
mov dword [esp + 0x30], 0xffffffff
call fcn.005c92f0
cmp esi, eax
je 0x60be2b
mov eax, 0xffff
add word [esi + 8], ax
jne 0x60be26
cmp byte [esi + 0xa], 0
je 0x60be1d
push dword [esi]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.005c92f0
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8