joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf42d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf42d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xf42d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf42d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xf42d94
push eax
push esi
call fcn.00f4520b
add esp, 8
pop esi
ret 0x10

Function at 0xf42da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf42e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xf42e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xf5b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f44dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xf42dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xf42e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf42ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xf42eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xf5b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f44dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xf42eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xf42e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xf43000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xf43131
push esi
call fcn.00f46145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00f35080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xf43131
push 0
push ebp
call fcn.00f353a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00f35260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xf4308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00f352f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xf43121
push 0xf5b918
push edi
call fcn.00f443f0
push eax
push ebx
push esi
call fcn.00f42f60
push 0xf5b8f8
push edi
call fcn.00f443f0
push eax
push ebx
push esi
call fcn.00f42f60
push 0xf5b8d8
push edi
call fcn.00f443f0
push eax
push ebx
push esi
call fcn.00f42f60
push 0xf5b8c0
push edi
call fcn.00f443f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00f42f60
push 0xf5b8a0
push edi
call fcn.00f443f0
push eax
push ebx
push esi
call fcn.00f42f60
push 0xf5b888
push edi
call fcn.00f443f0
push eax
push ebx
push esi
call fcn.00f42f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xf441b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f44140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f44140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f44140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f44140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf44bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf44c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf5687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf44c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf44c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7ffc7b97
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, str.qXm
nop
mov ebx, 0x4304d8
mov ecx, 0x58d63971
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
add byte [eax], al
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4

Function at 0x40940c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x4d25a8]
push ebx
push esi
inc eax

Function at 0x40bec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], ecx
or ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov eax, dword [edi + 4]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
movsx eax, word [eax + 8]
sub eax, ecx
je 0x40bf27
sub eax, 1
je 0x450474
sub eax, 0x32
jne 0x4503eb
push edi
mov ecx, esi
call fcn.0040dfd0
lea ecx, [esp + 0x18]
call fcn.0040cfa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov ecx, esi
or al, 0x8b
into
push edi
call fcn.0040dd50
test ebx, ebx
js 0x40bf15
jmp 0x45048e
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
and al, 0x88
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, al
test byte [eax + edx*4], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + 0x15083], cl
add byte [ebx], dh
ror byte [ecx - 0x76e7dbbc], 0x84
and al, 0x9c
add byte [eax], al
add byte [eax + 0xa02484], cl
add byte [eax], al
dec esp
and al, 0xc
jl 0x40c237
or byte [ecx + ecx*8 + 0x471b850f], al
add al, 0
add byte [ebx + 0x187e80f0], cl
add byte [edi], cl
test ebx, edi
inc esi
add al, 0
add byte [edi], cl
test dword [ebx], edi
inc edi
add al, 0
add al, 0
add bh, bh
je 0x40c3b9
and al, 0xe8
jns 0x40c3d3
add dword [eax], eax
ret
inc esp
and al, 0x44
add dword [eax], eax
add byte [eax], al
adc al, 0x91
into
inc esp
and al, 0x18
add al, 3
invalid
add al, 0x8e
Function at 0x41adf5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, word [ebx]
movzx eax, ax
sal byte [ebx], 0xd2
movzx eax, byte [eax + 0x4c2140]
lea ecx, [ebx + eax*2]
call fcn.0041c935
Function at 0x41b4ca
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
in al, dx
and esp, 0xfffffff8
sub esp, 0x6c
push ebx
mov ebx, dword [edx]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x54], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x40], ebx
mov eax, dword [edi]
mov dword [esp + 0x28], eax
mov eax, dword [0x4d261c]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
test eax, eax
jne 0x45859c
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x70], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], esi
mov esi, dword [ebp + 0x34]
lea ecx, [edx + 4]
push 0xfffffffffffffffe
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x10]
sar eax, 1
mov dword [esp + 0x64], eax
mov eax, 0x85
mov dword [esp + 0x74], ebx
mov dword [esp + 0x10], ecx
cmp word [ebx], ax
je 0x41b6e1
movzx eax, word [ebx + 4]
mov dword [esp + 0x50], eax
mov word [esp + 0x6c], ax
or dword [ebx + 0xc], eax
jmp 0x41b4cc

Function at 0x41b731
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x124], ecx
mov ecx, dword [ecx]
push esi
mov esi, dword [eax]

Function at 0x469692
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe1f
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420e34
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4696ed
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4696e4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x5e1787
Capabilities:
Encode data using xor

Disassembly:
xor al, 9
outsd dx, dword [esi]
insd dword es:[edi], dx
jmp 0x5e17e5
test eax, 0xcec59730
stosd dword es:[edi], eax
xor eax, 0x32ab3ba5
mov cl, 0x3f
stosd dword es:[edi], eax
cmp eax, 0xd180d625
neg eax
test eax, 0x6756253d
cmp ecx, ecx
xchg ebx, eax
push eax
xchg edi, eax
sti
xor eax, 0x9f306e1b
cmp eax, 0xbb3bccc0
sbb dword [esi], esi
pushfd
cmp eax, 0x9c1bd125
sub edi, ebx
xor eax, 0x2402f4b3
mov bh, 0xce
add byte [esi], dh
popal
jl 0x5e1760
inc ecx
leave
daa
mov dword [esi + 0x364da062], esp
out 0x1c, eax
sti
or eax, 0x9487cdd6
ret 0x15b1
lea esp, [edi]
mov dword [edx + 0x35f7a062], esi
or dword [edi], ecx
insd dword es:[edi], dx
jmp 0x5e1871
or al, 0x29
invalid
Function at 0x10001920
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10009d18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1000d0c8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.10001650
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10001980
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.10001550
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.10001650
cmp dword [esp + 0x28], 8
jb 0x100019cb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1000263d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x10002ad6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000d0c8]
jne 0x10002ae0
repz ret
jmp fcn.10004fac
Function at 0x78aafd78
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x78b2
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0x2523b1d3
inc esi
mov ch, 0x78
lodsb al, byte [esi]
cld
stosb byte es:[edi], al
js 0x78aafc79
inc esi
mov ch, 0x78
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cld
stosb byte es:[edi], al
js 0x78aafce5
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add ah, dh
cld
stosb byte es:[edi], al
js 0x78aafcf5
std
stosb byte es:[edi], al
js 0x78aafc89
cld
stosb byte es:[edi], al
js 0x78aafcfd
nop
nop
nop
inc eax
inc ebp
mov ch, 0x78
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor eax, 0x78b2
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop esp
inc ebp
mov ch, 0x78
cmp al, 0xfd
stosb byte es:[edi], al
js 0x78aafd3d
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ebp + edi*8 - 0x56], cl
js 0x78aafda5
std
stosb byte es:[edi], al
js 0x78aafce1
cld
stosb byte es:[edi], al
js 0x78aafd55
nop
nop
nop
pop esp
inc ebp
mov ch, 0x78
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
xchg edi, eax
mov dl, 0x78
lcall 0, 0x78b235
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp + eax*2 - 0x4b], bh
js 0x78aafd25
std
stosb byte es:[edi], al
js 0x78aafd95
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add byte [ebp + edi*8 - 0x24b8756], ah
std
stosb byte es:[edi], al
js 0x78aafe01
std
stosb byte es:[edi], al
js 0x78aafd3d
cld
stosb byte es:[edi], al
js 0x78aafdb1
nop
nop
nop
jl 0x78aafdfb
mov ch, 0x78
add al, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov esi, edi
mov ecx, dword [esp + 0x14]
mov al, byte [edi]
add esi, 1
cmp al, dl
je 0x78aafe0e
test al, al
je 0x78aafe08
mov al, byte [esi]
add esi, 1
cmp al, dl
je 0x78aafe0e
ret 0xa74
test al, al
jne 0x78aafdfb
pop esi
pop ebx
pop edi
xor eax, eax
ret
mov al, byte [esi]
add esi, 1
cmp al, dh
jne 0x78aafe00
lea edi, [esi - 1]
mov ah, byte [ecx + 2]
test ah, ah
je 0x78aafe49
mov al, byte [esi]
add esi, 2
cmp al, ah
jne 0x78aafde8
mov al, byte [ecx + 3]
test al, al
je 0x78aafe49
mov ah, byte [esi - 1]
add ecx, 2
cmp al, ah
je 0x78aafe1a
jmp 0x78aafde8
lea eax, [edi - 1]
pop esi
pop ebx
pop edi
ret

Function at 0x78ab0807
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78b54610]
jne sym.MSVCR100.dll___report_gsfailure
repz ret
Function at 0x78ab1d3f
Capabilities:
Accept command line arguments
Get thread local storage value

Disassembly:
push 8
push 0x78ab1de0
call fcn.78ab0950
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x78abb8b1
xor edi, edi
cmp eax, edi
je 0x78ac7b31
cmp eax, 2
jne 0x78ab2967
call sym.MSVCR100.dll___set_flsgetvalue
push dword [0x78b548b4]
push dword [0x78b548b8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
test eax, eax
jne 0x78ab1dd1
push 0x214
push 1
call sym.MSVCR100.dll__calloc_crt
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x78ac7b77
push esi
push dword [0x78b548b4]
push dword [0x78b54e50]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
call eax
test eax, eax
je 0x78ad7484
push edi
push esi
call sym.MSVCR100.dll__initptd
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
call fcn.78ab1d38
xor eax, eax
inc eax
call fcn.78ab0995
ret
cmp eax, 3
jne 0x78ab1dd1
push edi
call fcn.78ab28f9
pop ecx
jmp 0x78ab1dd1
call fcn.78abb359
test eax, eax
je 0x78ac7b77
call fcn.78abba14
test eax, eax
je 0x78ad7437
call fcn.78abb3da
test eax, eax
js 0x78ad7441
call fcn.78abb502
mov dword [0x78b55428], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [sym.MSVCR100.dll__acmdln], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [sym.MSVCR100.dll__wcmdln], eax
call fcn.78abb8a6
call fcn.78abb925
test eax, eax
js 0x78ac7b7e
push 0
call fcn.78abc427
pop ecx
test eax, eax
jne 0x78ac7b7e
inc dword [0x78b55424]
jmp 0x78ab1dd1
cmp dword [0x78b55424], edi
jle 0x78ac7b77
dec dword [0x78b55424]
mov dword [ebp - 4], edi
cmp dword [0x78b55eac], edi
je 0x78ad7448
call fcn.78ac7ac7
cmp dword [ebp + 0xc], edi
je 0x78ad7452
mov dword [ebp - 4], 0xfffffffe
call fcn.78ac7b6d
jmp 0x78ab1dd1
xor eax, eax
jmp 0x78ab1dd9
call fcn.78b26d78
jmp 0x78ad7441
call fcn.78b266ba
jmp 0x78ac7b77
call fcn.78afc6e7
jmp 0x78ad7437
call sym.MSVCR100.dll__cexit
jmp 0x78ac7b4e
call fcn.78b26d78
call fcn.78afc6e7
call fcn.78b266ba
jmp 0x78ac7b5c
push esi
call sym.MSVCR100.dll_free
pop ecx
jmp 0x78ac7b77

Function at 0x78ab23db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x78ad7b05
test dword [ebp + 0xc], 0xfffffff9
jne 0x78ad7b05
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x78ac09bb
test al, 0x10
jne 0x78ab241d
test al, 1
je 0x78ab241d
test byte [ebp + 0xc], 2
jne 0x78ad7b22
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR100.dll__dosmaperr
pop ecx
call sym.MSVCR100.dll__errno
mov eax, dword [eax]
jmp 0x78ab241f
call sym.MSVCR100.dll___doserrno
mov dword [eax], esi
call sym.MSVCR100.dll__errno
push 0x16
pop esi
mov dword [eax], esi
call sym.MSVCR100.dll__invalid_parameter_noinfo
mov eax, esi
jmp 0x78ab241f
call sym.MSVCR100.dll___doserrno
mov dword [eax], 5
call sym.MSVCR100.dll__errno
mov dword [eax], 0xd
jmp 0x78ac09c8
Function at 0x78ab8468
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call sym.MSVCR100.dll__getptd
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
je 0x78ae17ac
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x78ab849b
cmp byte [eax], 0
jne 0x78ae17b8
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x78ab84ae
cmp byte [eax], 0
jne 0x78ae17cd
mov ebx, dword [ebx]
test ebx, ebx
je 0x78ab84bd
cmp byte [ebx], 0
jne 0x78ae182d
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x78ab85a8
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.78ab85ac
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x78ab85a8
cmp esi, 0xfde8
je 0x78ab85a8
cmp esi, 0xfde9
je 0x78ab85a8
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x78ab85a8
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x78ab85a8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x78ab854d
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x78ab85a0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
je 0x78ae185f
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x78ab85a8
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x78ab85a8
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call sym.MSVCR100.dll__itoa_s
add esp, 0x10
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x78ab85a3
or dword [edi + 8], 0x104
jmp 0x78ab84c4
push ebx
push 0x16
push 0x78ae1a90
call fcn.78b2ef4a
add esp, 0xc
jmp 0x78ab849b
mov eax, dword [ebx]
test eax, eax
je 0x78ae17e1
cmp byte [eax], 0
je 0x78ae17e1
mov esi, edi
call fcn.78b2f3c7
jmp 0x78ae17e8
mov esi, edi
call fcn.78b2f42e
cmp dword [edi + 8], 0
jne 0x78ab84da
push edi
push 0x40
push 0x78ae1888
call fcn.78b2ef4a
add esp, 0xc
test eax, eax
je 0x78ab84d0
mov ebx, dword [ebx]
test ebx, ebx
je 0x78ae1821
cmp byte [ebx], 0
je 0x78ae1821
mov esi, edi
call fcn.78b2f3c7
jmp 0x78ab84d0
mov esi, edi
call fcn.78b2f42e
jmp 0x78ab84d0
push ebx
call sym.MSVCR100.dll_strlen
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x78b2f034
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x78ab84d0
and dword [edi + 8], 0
jmp 0x78ab84d0
push 0x78ae1b48
push 0x40
push ebx
call sym.MSVCR100.dll_strcpy_s
add esp, 0xc
test eax, eax
je 0x78ab8579
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call sym.MSVCR100.dll__invoke_watson
int3
Function at 0x78ab85ac
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x78ab85bf
cmp byte [esi], 0
jne 0x78ac28a1
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x78ae179c
cmp dword [ebp - 4], 0
je 0x78ae17a0
mov eax, dword [ebp - 4]
leave
ret
push 0x78ac28bc
push esi
call sym.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x78ab85bf
jmp 0x78ae175e
push 0x78ae17a8
push esi
call sym.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x78ae178d
push 2
lea eax, [ebp - 4]
push eax
push 0x2000000b
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x78ab85e5
jmp 0x78ae179c
push esi
call sym.MSVCR100.dll_atol
pop ecx
mov dword [ebp - 4], eax
jmp 0x78ab85e5
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetACP]
leave
ret