joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75ccf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x847970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
lea eax, [esp + 0xb]
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
call fcn.00478ac0
mov dword [esp + 0x28], vtable.ucs2string.0
mov esi, dword [esp + 0x50]
mov ecx, dword [0x956848]
mov dword [esp + 0x44], ebx
mov eax, dword [esi + 0xc]
lea eax, [eax + ecx + 0xa]
mov ecx, dword [esp + 0x38]
cmp ecx, eax
jae 0x75cd4f
push ebx
push eax
lea ecx, [esp + 0x34]
call fcn.00404d30
push 0xffffffffffffffff
push ebx
push 0x956840
lea ecx, [esp + 0x38]
call fcn.0042d470
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004067c0
add esp, 8
cmp eax, ebx
mov byte [esp + 0x44], 1
je 0x75cd7c
add eax, 4
jmp 0x75cd7e
xor eax, eax
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x38]
call fcn.0042d470
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], bl
call fcn.00404f20
push 0x944dc8
call fcn.007ac4d2
add esp, 4
lea ecx, [esp + 0x2c]
push eax
push 0x944dc8
call fcn.004036a0
mov edx, dword [esp + 0x54]
push ebx
push 0x10
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00481d80
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x50], 2
call fcn.0042d470
push 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], bl
call fcn.00404f20
push 0x944dc8
call fcn.007ac4d2
mov edx, dword [esp + 0x38]
or ecx, 0xffffffff
mov esi, eax
sub ecx, edx
add esp, 4
cmp ecx, esi
ja 0x75ce0d
call fcn.007c4d19
cmp esi, ebx
jbe 0x75ce4d
mov edx, dword [esp + 0x34]
push ebx
lea ecx, [esp + 0x30]
lea edi, [edx + esi]
push edi
call fcn.00404d30
test al, al
je 0x75ce4d
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push esi
push 0x944dc8
lea eax, [ecx + eax*2]
push eax
call fcn.004069b0
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x40], edi
add esp, 0xc
mov word [edx + edi*2], bx
mov edi, dword [esp + 0x4c]
mov al, byte [esp + 0x50]
push ebx
lea esi, [edi + 4]
mov ecx, esi
mov byte [esi], al
call fcn.00404f20
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
push ebx
push ecx
mov ecx, esi
mov byte [esp + 0x50], 3
mov dword [edi], vtable.ucs2string.0
call fcn.00403760
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x75ceb0
mov cl, byte [eax - 1]
cmp cl, bl
je 0x75cea4
dec cl
mov byte [eax - 1], cl
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
add eax, 0xfffffffe
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x75dbb0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x847aaa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
mov byte [esi + 9], bl
lea edi, [esi + 0xc]
push ebx
push ebx
mov ecx, edi
mov dword [esp + 0x4c], ebx
mov dword [edi + 4], ebx
call fcn.00435f60
mov dword [edi + 8], eax
push ebx
lea ecx, [esi + 0x18]
mov byte [esp + 0x48], 1
call fcn.0042d560
lea ecx, [esi + 0x24]
call fcn.0041d560
mov dword [esi], vtable.SshKeys::PublicKeyInfo.0
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x2c]
push eax
mov dword [esp + 0x48], 2
call fcn.00478ac0
mov edi, 0x9511f8
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x44], 3
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], vtable.utf8string.0
push ecx
push 0x9511f8
lea ecx, [esp + 0x34]
call fcn.004030a0
push ebx
mov byte [esp + 0x48], 4
mov dword [esp + 0x24], ebx
call fcn.00449810
add esp, 4
mov dword [esp + 0x24], ebx
mov cl, byte [0x878824]
lea edi, [esi + 0x38]
mov dword [esp + 0x14], edi
lea ebp, [edi + 0xc]
mov byte [edi + 8], cl
mov ecx, ebp
mov dword [esp + 0x18], ebp
call fcn.004034c0
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push ebx
push edx
mov ecx, ebp
mov byte [esp + 0x50], 6
mov dword [ebp], vtable.utf8string.0
call fcn.00428c90
lea eax, [edi + 0x28]
push 1
push eax
mov byte [esp + 0x4c], 7
mov dword [edi + 0x20], ebx
call fcn.005826c0
add esp, 8
lea ecx, [edi + 0x30]
call fcn.0041d560
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 8
push ecx
lea ecx, [edi + 0x44]
call fcn.0042d5a0
push ebx
lea ecx, [edi + 0x50]
mov byte [esp + 0x48], 9
call fcn.005e55cb
mov dword [edi], vtable.SshKeys::HostKeyData.0
xor ecx, ecx
xor eax, eax
push ebx
xor edi, edi
call fcn.007d7349
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 0xb
push 1
call fcn.00404c40
mov edx, dword [esp + 0x4c]
mov ecx, esi
push edx
mov dword [esi], vtable.SshKeys::HostKey.1.0
mov dword [esi + 0x38], vtable.SshKeys::HostKey.0
call fcn.0078f440
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x75ef90
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x847d7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 2
lea eax, [esi + 8]
mov dword [esp + 0x18], esi
push eax
mov dword [esp + 0x18], ebx
call fcn.0077c930
lea ecx, [esi + 0x1c]
push 3
push ecx
mov dword [esp + 0x34], ebx
call fcn.0077c930
lea edx, [esi + 0x30]
push ebx
push edx
mov byte [esp + 0x3c], 1
call fcn.0077c930
add esp, 0x18
lea eax, [esp + 0xf]
lea ecx, [esi + 0x4c]
push eax
mov byte [esp + 0x28], 2
mov dword [esi + 0x44], 0xffffffff
call fcn.00478ac0
mov dword [esi + 0x48], vtable.ascstring.0
push 0x18
mov byte [esp + 0x28], 3
call fcn.007d7320
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
cmp edi, ebx
je 0x75f069
mov dword [edi + 4], 0x85bc30
mov dword [edi + 0x14], vtable.IRefCountable.0
mov dword [esp + 0x10], 1
push ebx
mov ecx, edi
mov byte [esp + 0x28], 5
call fcn.0048fa00
mov ecx, dword [edi + 4]
mov dword [edi], vtable.ClientLib::NoneAuth.1.0
mov dword [esp + 0x24], 4
mov edx, dword [ecx + 4]
mov dword [edx + edi + 4], vtable.ClientLib::NoneAuth.0
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x10]
mov dword [eax + edi], ecx
jmp 0x75f06b
xor edi, edi
lea ecx, [esi + 0x5c]
push edi
mov byte [esp + 0x28], 3
mov dword [ecx], ebx
call fcn.00690310
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x80]
mov dword [esp + 0x18], ecx
mov byte [ecx + 0xc], 1
mov dword [ecx], vtable.TSecHandle_struct__SecHandle__class_WDeleteSecurityContext_.0
mov dword [ecx + 4], 0xffffffff
mov dword [ecx + 8], 0xffffffff
mov byte [esp + 0x24], 0xd
call fcn.005840c0
mov dl, byte [esp + 0xf]
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xa0], dl
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov al, byte [esp + 0xf]
mov dl, byte [esp + 0xf]
lea ecx, [esi + 0xb4]
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov byte [esi + 0xb2], bl
mov byte [esi + 0xb3], bl
mov byte [esp + 0x24], 0xf
mov byte [ecx], al
mov byte [ecx + 1], dl
mov byte [ecx + 8], bl
call fcn.0043b390
mov al, byte [esp + 0xf]
mov dl, byte [esp + 0xf]
lea ecx, [esi + 0xc8]
mov byte [esi + 0xc4], bl
mov byte [esp + 0x24], 0x10
mov byte [ecx], al
mov byte [ecx + 1], dl
mov byte [ecx + 8], bl
call fcn.00771d60
mov al, byte [esp + 0xf]
mov dl, byte [esp + 0xf]
lea ecx, [esi + 0xd8]
mov byte [esp + 0x24], 0x11
mov byte [ecx], al
mov byte [ecx + 1], dl
mov byte [ecx + 8], bl
call fcn.00771d60
mov ecx, dword [esp + 0x1c]
mov dword [esi], vtable.ClientLib::AuthState.0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x764b70
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x848b40
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 0x74]
sub esp, 0x64
lea ecx, [eax + 0x24]
add eax, 0x30
push edi
push eax
mov eax, dword [esp + 0x7c]
push ecx
mov ecx, dword [0x951a20]
push 0
push 0
push 0
push 0
push 2
push eax
push 0
push 0
push str.AcquireCredentialsHandleA
push ecx
call fcn.0057d750
add esp, 0xc
call eax
mov edi, eax
test edi, edi
je 0x764c52
mov dl, byte [esp + 0x78]
push esi
push 0
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], dl
call fcn.00404f20
push str.AcquireCredentialsHandle__
mov dword [esp + 0x78], 0
mov dword [esp + 0xc], vtable.ucs2string.0
call fcn.007ac4d2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.00404d30
test al, al
je 0x764c2b
mov eax, dword [esp + 0x10]
push esi
push str.AcquireCredentialsHandle__
push eax
call fcn.004069b0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [ecx + esi*2], 0
lea edx, [esp + 8]
push edi
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x7c], 1
call fcn.005844f0
lea eax, [esp + 0x1c]
push 0x89b94c
push eax
call fcn.007ac5c6
pop esi
mov ecx, dword [esp + 0x68]
pop edi
mov dword fs:[0], ecx
add esp, 0x70
ret 4
Function at 0x76f030
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x84a1f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
xor ebx, ebx
push ebp
mov dword [esp + 0x14], ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [esi + esi + 4]
push eax
call fcn.007d7320
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x14], 1
mov byte [esp + 0x15], 1
inc esi
mov dword [esp + 0x20], ebx
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [esp + 0x28]
mov cl, byte [esp + 0x28]
push 0
mov ebp, eax
lea esi, [ebx + 4]
mov byte [esi], cl
mov ecx, esi
call fcn.00404f20
cmp ebp, 0xffffffff
mov byte [esp + 0x20], 1
mov dword [ebx], vtable.ucs2string.0
jne 0x76f0e7
push edi
call fcn.007ac4d2
add esp, 4
mov ebp, eax
mov ecx, esi
push 1
push ebp
call fcn.00404d30
test al, al
je 0x76f11b
mov edx, dword [esi + 4]
push ebp
push edi
push edx
call fcn.004069b0
mov eax, dword [esi + 4]
mov dword [esi + 8], ebp
add esp, 0xc
mov word [eax + ebp*2], 0
jmp 0x76f11b
push 1
push ebp
mov ecx, esi
call fcn.00404d30
test al, al
je 0x76f11b
mov eax, dword [esi + 4]
mov ecx, edi
test ebp, ebp
jbe 0x76f10f
mov edx, ebp
mov bx, word [ecx]
add ecx, 2
mov word [eax], bx
add eax, 2
dec edx
jne 0x76f100
mov ecx, dword [esi + 4]
mov dword [esi + 8], ebp
mov word [ecx + ebp*2], 0
test edi, edi
je 0x76f128
push edi
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x76fc00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x84a3ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 8], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.004413f0
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], edi
call fcn.004413f0
lea ecx, [esp + 0x58]
mov dword [esp + 0x54], edi
call fcn.004413f0
mov ecx, dword [esp + 0x124]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x120], edi
call fcn.006d1780
test al, al
jne 0x76fdcd
mov ecx, dword [esp + 0x128]
push ebx
mov eax, dword [ecx + 8]
cmp eax, edi
je 0x76fca4
push 0x8ff1f8
push ecx
lea ecx, [esp + 0x78]
push ecx
call fcn.0044de30
mov ebx, 1
add esp, 0xc
mov esi, eax
mov dword [esp + 0xc], ebx
mov byte [esp + 0x120], bl
jmp 0x76fcca
mov dl, byte [esp + 0x13]
push edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], dl
call fcn.00404c40
mov ebx, 2
mov dword [esp + 0xc], ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x120], ebx
lea eax, [esp + 0x90]
push 0x8ff1f4
push eax
lea ecx, [esp + 0x2c]
call fcn.006d38c0
mov ecx, dword [eax + 8]
mov dword [esp + 0x120], 3
cmp ecx, edi
je 0x76fcf7
mov eax, dword [eax + 4]
jmp 0x76fcfc
mov eax, 0x95121c
push eax
lea ecx, [esp + 0x84]
push esi
push ecx
call fcn.0044de30
add esp, 0xc
mov esi, eax
mov byte [esp + 0x120], 4
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0xffffffffffffffff
push edi
push esi
lea ecx, [esp + 0xb4]
call fcn.0041def0
lea edx, [esp + 0xa4]
lea ecx, [esp + 0xcc]
push edx
mov byte [esp + 0x124], 5
call fcn.00432800
lea ecx, [esp + 0xa4]
call fcn.00403b50
push 1
lea ecx, [esp + 0x84]
mov dword [esp + 0x124], 0xa
call fcn.00404c40
lea ecx, [esp + 0x90]
mov byte [esp + 0x120], 9
call fcn.0040e080
test bl, 2
je 0x76fd97
push 1
lea ecx, [esp + 0x18]
and ebx, 0xfffffffd
call fcn.00404c40
test bl, 1
pop ebx
je 0x76fda8
push 1
lea ecx, [esp + 0x70]
call fcn.00404c40
lea eax, [esp + 0xc8]
push 0x89547c
push eax
mov dword [esp + 0xd0], vtable.CryptBlockError.0
mov byte [esp + 0x124], 0
call fcn.007ac5c6
lea ecx, [esp + 0x58]
mov dword [esp + 0x11c], 0xd
call fcn.00432a70
lea ecx, [esp + 0x40]
mov byte [esp + 0x11c], 0xc
call fcn.00432a70
lea ecx, [esp + 0x28]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x30]
xor esi, esi
cmp eax, edi
mov dword [esp + 0x11c], 0xe
je 0x76fe31
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + esi*4]
cmp ecx, edi
je 0x76fe28
push 1
call fcn.004332d0
mov eax, dword [esp + 0x2c]
mov dword [eax + esi*4], edi
mov eax, dword [esp + 0x30]
inc esi
cmp esi, eax
jne 0x76fe0f
lea ecx, [esp + 0x28]
mov dword [esp + 0x11c], 0xffffffff
call fcn.0040e050
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret
Function at 0x778bf0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x84b673
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x28]
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [eax]
push esi
push edi
lea edi, [ebp + 8]
xor ebx, ebx
mov dword [ebp], ecx
mov dword [esp + 0x38], edi
mov dword [edi + 4], ebx
mov byte [edi + 8], 1
mov byte [edi + 9], bl
lea esi, [edi + 0xc]
push ebx
push ebx
mov ecx, esi
mov dword [esp + 0x38], ebx
mov dword [esi + 4], ebx
call fcn.00435f60
mov dword [esi + 8], eax
lea esi, [edi + 0x18]
push ebx
push ebx
mov ecx, esi
mov byte [esp + 0x38], 1
mov dword [esi + 4], ebx
call fcn.00435f60
mov dword [esi + 8], eax
lea esi, [edi + 0x24]
mov byte [esp + 0x30], 2
mov ecx, esi
call fcn.004034c0
mov dword [esi], vtable.utf8string.0
mov dword [edi], vtable.SshKeys::PublicKeyInfo.0
push 0xffffffffffffffff
push 0x9511f8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 3
call fcn.00415e50
lea esi, [edi + 0x40]
mov dword [esp + 0x10], esi
mov ecx, esi
mov byte [esp + 0x30], 4
call fcn.004034c0
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push ebx
push edx
mov ecx, esi
mov byte [esp + 0x3c], 5
mov dword [esi], vtable.ascstring.0
call fcn.00428c90
lea ecx, [esi + 0x18]
mov byte [esp + 0x30], 6
mov dword [esi + 0x14], ebx
call fcn.004034c0
mov dword [esi + 0x18], vtable.utf8string.0
lea ecx, [esi + 0x2c]
push ebx
push ebx
mov byte [esp + 0x38], 7
mov dword [ecx + 4], ebx
call fcn.00435f60
mov dword [esi + 0x34], eax
lea ecx, [esi + 0x38]
push ebx
push ebx
mov byte [esp + 0x38], 8
mov dword [ecx + 4], ebx
call fcn.00435f60
mov dword [esi + 0x40], eax
push ebx
lea ecx, [esi + 0x48]
mov byte [esp + 0x34], 9
mov byte [esi + 0x44], bl
call fcn.0042d560
mov al, byte [0x878748]
lea ecx, [esi + 0x58]
push 1
push ecx
mov byte [esp + 0x38], 0xa
mov byte [esi + 0x54], al
call fcn.005826c0
add esp, 8
push ebx
lea ecx, [esi + 0x60]
mov byte [esp + 0x34], 0xb
call fcn.005e55cb
push 1
lea ecx, [esp + 0x1c]
call fcn.00404c40
mov edx, dword [esp + 0x3c]
mov ecx, edi
push edx
mov byte [esp + 0x34], 0xc
mov dword [edi], vtable.SshKeys::Keypair.0
call fcn.00786d00
mov ecx, dword [esp + 0x28]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x77b4a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x84bc5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 8], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.004413f0
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], edi
call fcn.004413f0
lea ecx, [esp + 0x58]
mov dword [esp + 0x54], edi
call fcn.004413f0
mov ecx, dword [esp + 0x124]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x120], edi
call fcn.006d1170
test al, al
jne 0x77b66d
mov ecx, dword [esp + 0x128]
push ebx
mov eax, dword [ecx + 8]
cmp eax, edi
je 0x77b544
push 0x8ff1f8
push ecx
lea ecx, [esp + 0x78]
push ecx
call fcn.0044de30
mov ebx, 1
add esp, 0xc
mov esi, eax
mov dword [esp + 0xc], ebx
mov byte [esp + 0x120], bl
jmp 0x77b56a
mov dl, byte [esp + 0x13]
push edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], dl
call fcn.00404c40
mov ebx, 2
mov dword [esp + 0xc], ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x120], ebx
lea eax, [esp + 0x90]
push 0x8ff1f4
push eax
lea ecx, [esp + 0x2c]
call fcn.006d38c0
mov ecx, dword [eax + 8]
mov dword [esp + 0x120], 3
cmp ecx, edi
je 0x77b597
mov eax, dword [eax + 4]
jmp 0x77b59c
mov eax, 0x95121c
push eax
lea ecx, [esp + 0x84]
push esi
push ecx
call fcn.0044de30
add esp, 0xc
mov esi, eax
mov byte [esp + 0x120], 4
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0xffffffffffffffff
push edi
push esi
lea ecx, [esp + 0xb4]
call fcn.0041def0
lea edx, [esp + 0xa4]
lea ecx, [esp + 0xcc]
push edx
mov byte [esp + 0x124], 5
call fcn.00432800
lea ecx, [esp + 0xa4]
call fcn.00403b50
push 1
lea ecx, [esp + 0x84]
mov dword [esp + 0x124], 0xa
call fcn.00404c40
lea ecx, [esp + 0x90]
mov byte [esp + 0x120], 9
call fcn.0040e080
test bl, 2
je 0x77b637
push 1
lea ecx, [esp + 0x18]
and ebx, 0xfffffffd
call fcn.00404c40
test bl, 1
pop ebx
je 0x77b648
push 1
lea ecx, [esp + 0x70]
call fcn.00404c40
lea eax, [esp + 0xc8]
push 0x89547c
push eax
mov dword [esp + 0xd0], vtable.CryptBlockError.0
mov byte [esp + 0x124], 0
call fcn.007ac5c6
lea ecx, [esp + 0x58]
mov dword [esp + 0x11c], 0xd
call fcn.00432a70
lea ecx, [esp + 0x40]
mov byte [esp + 0x11c], 0xc
call fcn.00432a70
lea ecx, [esp + 0x28]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x30]
xor esi, esi
cmp eax, edi
mov dword [esp + 0x11c], 0xe
je 0x77b6d1
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + esi*4]
cmp ecx, edi
je 0x77b6c8
push 1
call fcn.004332d0
mov eax, dword [esp + 0x2c]
mov dword [eax + esi*4], edi
mov eax, dword [esp + 0x30]
inc esi
cmp esi, eax
jne 0x77b6af
lea ecx, [esp + 0x28]
mov dword [esp + 0x11c], 0xffffffff
call fcn.0040e050
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret
Function at 0x77bc00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x84bc80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov al, byte [esp + 0x2c]
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], edi
mov byte [esp + 0x1c], al
call fcn.00404c40
mov dword [esp + 0x14], vtable.ascstring.0
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], edi
mov eax, dword [ebx + 0xc]
cmp eax, ecx
ja 0x77bc5d
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.0040f500
jmp 0x77bcb0
sub eax, ecx
or edx, 0xffffffff
mov esi, eax
sub edx, ecx
cmp edx, esi
ja 0x77bc6f
call fcn.007c4d19
cmp esi, edi
jbe 0x77bcb0
mov eax, dword [esp + 0x20]
push edi
lea ecx, [esp + 0x1c]
lea ebp, [eax + esi]
push ebp
call fcn.00404a50
test al, al
je 0x77bcb0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
xor eax, eax
push ebp
lea edi, [edx + ecx]
mov ecx, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x1c]
call fcn.004049b0
mov eax, dword [esp + 0x1c]
mov esi, dword [ebx + 8]
test eax, eax
je 0x77bce2
mov cl, byte [eax - 1]
test cl, cl
je 0x77bcd6
mov eax, dword [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x20]
call fcn.00404a50
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x77bce2
mov byte [eax - 1], 0
mov eax, dword [esp + 0x1c]
mov edx, eax
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x77bcef
xor eax, eax
jmp 0x77bcf4
mov eax, dword [ebx + 0xc]
add eax, ecx
cmp esi, eax
je 0x77bd16
mov al, byte [esi]
inc esi
cmp al, 0x40
jle 0x77bd0e
cmp al, 0x5b
jge 0x77bd0e
movsx eax, al
add eax, 0x20
mov byte [edx], al
inc edx
jmp 0x77bce4
movsx eax, al
mov byte [edx], al
inc edx
jmp 0x77bce4
mov edi, dword [esp + 0x38]
mov cl, byte [esp + 0x3c]
push 0
lea esi, [edi + 4]
mov byte [esi], cl
mov ecx, esi
call fcn.00404c40
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push 0
push edx
mov ecx, esi
mov byte [esp + 0x3c], 1
mov dword [edi], vtable.ascstring.0
call fcn.00402e90
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x77bd66
mov cl, byte [eax - 1]
dec eax
test cl, cl
je 0x77bd5d
dec cl
mov byte [eax], cl
jmp 0x77bd66
push eax
call fcn.007d7349
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x789920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x84d3b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
lea ecx, [esp + 0x1c]
call fcn.0078c910
push 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], 0
call fcn.0047f6f0
mov eax, dword [esp + 0x34]
push eax
call fcn.0060417d
add esp, 4
mov dword [esp + 0x1c], 0x868f08
mov esi, dword [esp + 0x50]
mov dword [esp + 0x48], 1
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.005f63c9
mov edi, dword [esp + 0x54]
push 8
push edi
lea ecx, [esp + 0x24]
call fcn.005f63c9
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
lea ebx, [eax + 0x38]
call dword [eax + 0x1c]
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x24]
call dword [ebx]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, ebx
push 0x10
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
call fcn.005f63c9
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.005f63c9
push 8
push edi
lea ecx, [esp + 0x24]
call fcn.005f63c9
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
lea esi, [eax + 0x38]
call dword [eax + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
call dword [esi]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add ebx, 0x10
mov dword [ebx], ecx
mov ecx, dword [esp + 0x18]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, edi
xor eax, eax
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x4c], 0xffffffff
call fcn.007d7349
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, edi
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.007d7349
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.00511420
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret