joyce8/EMBER2024-capa huggingface dataset:
Function at 0x647d50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b2c5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ecx + 4], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.wxColour.0
call fcn.005322e0
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxANIDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x648090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b344
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40
call fcn.008000f5
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x648154
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.wxColour.0
call fcn.005322e0
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxANIDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x648ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b2c5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ecx + 4], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.wxColour.0
call fcn.005322e0
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxGIFDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x649210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x86b427
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x144
call fcn.008000f5
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x6492be
mov dword [esi + 4], 1
mov dword [esi], vtable.wxAnimationDecoder.0
lea ecx, [esi + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.wxColour.0
call fcn.005322e0
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], vtable.wxGIFDecoder.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x66cdf0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
mov eax, dword [0xa5e224]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov ebx, dword [esp + 0x2cc]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x2c8]
push edi
mov edi, dword [esp + 0x2d0]
push 0x2b4
push 0
push eax
mov dword [esp + 0x18], esi
call fcn.00802640
mov eax, dword [esp + 0x2e4]
add esp, 0xc
or eax, 0x1010
cmp dword [edi + 0x14], 8
jb 0x66ce48
mov edi, dword [edi]
push eax
push 0x2b4
lea eax, [esp + 0x18]
push eax
push 0x10
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x66ce7d
mov dword [esi], vtable.wxObject.0
mov eax, dword [0xa5bb7c]
mov dword [esi + 4], eax
test eax, eax
je 0x66ce75
inc dword [eax + 4]
mov dword [esi], vtable.wxBitmap.0
jmp 0x66ce90
push ebx
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0066ceb0
add esp, 0x10
mov ecx, dword [esp + 0x2c4]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00800392
add esp, 0x2bc
ret
Function at 0x674910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x1c4
push 0xffffffffffffffff
push 0x86fa40
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp + 0x1c0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0x1cc]
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 0x1d0]
lea ecx, [ebp + 0xe0]
push eax
push edi
push dword [0xe853b8]
mov dword [ebp - 0x14], 0
call fcn.0066e5e0
push esi
push ebx
push dword [0xe7b214]
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00501cf0
push eax
lea ecx, [ebp + 0x140]
mov byte [ebp - 4], 1
call fcn.0051d8e0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
mov dword [ebp - 0x64], vtable.wxObject.0
call fcn.0073da90
cmp dword [ebp + 0x18c], 0
mov byte [ebp - 4], 0
je 0x6749d5
mov eax, dword [edi]
lea ecx, [ebp + 0x18c]
push ecx
mov ecx, edi
call dword [eax + 0x3e4]
mov dword [ebp + 0x138], eax
lea eax, [ebp + 0xe0]
mov ecx, edi
push eax
call fcn.004fb100
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov byte [ebp - 0xd], al
call esi
test ax, ax
js 0x674a57
push 0x10
call esi
test ax, ax
js 0x674a57
push 0x12
call esi
test ax, ax
js 0x674a57
cmp ebx, 0x20
je 0x674a11
cmp ebx, 0xd
jne 0x674a57
push 0
push 9
push 0x110a
push dword [edi + 0x13c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x674a57
mov dword [ebp - 0x18], eax
lea ecx, [ebp]
lea eax, [ebp - 0x18]
push eax
push edi
push dword [0xe853bc]
call fcn.0066e5e0
lea eax, [ebp]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00672e90
lea ecx, [ebp]
call fcn.0062ad60
lea ecx, [ebp + 0x19c]
call fcn.00436e00
lea ecx, [ebp + 0x140]
mov dword [ebp - 4], 4
mov dword [ebp + method.wxObject.virtual_0], vtable.wxObject.0
call fcn.0073da90
lea ecx, [ebp + 0x10c]
call fcn.00436e00
lea ecx, [ebp + 0xe0]
mov dword [ebp - 4], 5
mov dword [ebp + 0xe0], vtable.wxObject.0
call fcn.0073da90
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1c0]
xor ecx, ebp
call fcn.00800392
lea esp, [ebp + 0x1c4]
pop ebp
ret 8
Function at 0x68d3e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x68d414
push esi
call fcn.00691e40
add esp, 4
cmp byte [esi + 0x40], 0
je 0x68d40b
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x68d41b
cmp eax, 0xcb
jne 0x68d493
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x68d47e
mov eax, dword [esi + 8]
test eax, eax
je 0x68d436
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x68d479
cmp eax, 2
je 0x68d47e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x68d427
cmp eax, 3
je 0x68d45e
cmp eax, 1
jne 0x68d427
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x68d427
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x68d427
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0068d4d0
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x68d4b5
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0068d4d0
add esp, 4
pop edi
pop esi
ret

Function at 0x68d4d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x68d4fc
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x68d5a3
mov ecx, dword [esi + 0x78]
lea edi, [esi + 0x78]
cmp ecx, dword [esi + 0x60]
jae 0x68d572
mov eax, dword [esi + 8]
mov ebx, ecx
test eax, eax
je 0x68d539
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov ebx, dword [edi]
add esp, 4
mov ecx, dword [esi + 0xc0]
mov eax, dword [esi + 0x184]
cmp ecx, 0x10
jne 0x68d54f
mov eax, dword [eax + 0xc]
jmp 0x68d55c
cmp ecx, 0xc
jne 0x68d559
mov eax, dword [eax + 8]
jmp 0x68d55c
mov eax, dword [eax + 4]
push 0
push edi
push 0
push esi
call eax
mov ecx, dword [edi]
add esp, 0x10
cmp ecx, ebx
je 0x68d5b9
cmp ecx, dword [esi + 0x60]
jb 0x68d517
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [edi], 0
xor ecx, ecx
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], cl
jne 0x68d512
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x6bb910
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1a8]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x20], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x18]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x6bba43
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x24]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x6bb98e
mov eax, dword [esi + 0x1c]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x1c]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x6bb9d4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x6bb9c2
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x6bb9b0
cmp dword [esp + 0x18], 1
jne 0x6bba21
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x6bba00
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x6bb970
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x6f0ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [esi + 0x38]
call fcn.00707680
push eax
push esi
call fcn.007077f0
push 0x108
push 0
push edi
call fcn.006f0480
mov ebp, 1
mov dword [edi + 0x34], 0x10001
mov dword [edi + 0x2c], 0x10001
mov eax, 2
mov word [edi + 0x54], ax
add esp, 0x14
mov dword [edi + 0x38], 0x10001
xor eax, eax
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0xd8], 0x20002
mov word [edi + 0xdc], bp
mov dword [esi + 0x334], fcn.00437170
mov dword [esi + 0x340], 0
mov dword [esi + 0x344], 0x6f1b20
mov dword [esi + 0x348], 0x6f11f0
mov dword [esi + 0x34c], 0
mov word [edi + 0x56], bp
mov word [edi + 0x30], bp
mov dword [edi + 0x28], 0
mov dword [edi + 0x40], 0x10000
mov word [edi + 0x74], ax
mov dword [edi + 0x78], eax
cmp dword [esi + 0x358], eax
jbe 0x6f0cbd
push ebx
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x354]
cmp dword [ebx + eax + 4], 0
je 0x6f0c8d
push dword [ebx + eax + 0xc]
push esi
call fcn.00706bc0
add esp, 8
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x358]
jb 0x6f0c73
push dword [esi + 0x354]
push esi
call fcn.00706bc0
add esp, 8
mov dword [esi + 0x358], 0
mov dword [esi + 0x354], 0
pop ebx
mov eax, dword [0xea5458]
test eax, eax
je 0x6f0ccc
push esi
call eax
add esp, 4
push 1
push 0x103
push esi
call fcn.006f1100
and dword [esi + 0xc], 0xfffffbf7
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
ret
Function at 0x759350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x875a3e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
push 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push 0x1004
push dword [ebp + 0xc]
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x7593fb
cmp word [ebp - 0x30], 0x30
jne 0x7593d5
cmp word [ebp - 0x2e], 0
je 0x7593fb
lea ecx, [ebp - 0x30]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7593e0
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00437780
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret
Function at 0x7611a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x7611d1
push esi
mov esi, ecx
movzx ecx, si
lea edx, [edx + 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x7611b1
pop esi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x7615c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x876461
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0xea62fc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0xea5844]
cmp eax, dword [ecx + 0xc]
jg 0x761616
mov eax, 0xea582c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xea5844
call fcn.00800aad
add esp, 4
cmp dword [0xea5844], 0xffffffff
jne 0x761600
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.FlsAlloc
push 0x8ac94c
mov dword [ebp - 4], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.FlsFree
push 0x8ac94c
mov dword [0xea582c], eax
mov dword [0xea5830], 0
call edi
push eax
call esi
push str.FlsGetValue
push 0x8ac94c
mov dword [0xea5834], eax
call edi
push eax
call esi
push str.FlsSetValue
push 0x8ac94c
mov dword [0xea5838], eax
call edi
push eax
call esi
mov ecx, dword [0xea582c]
mov dword [0xea583c], eax
test ecx, ecx
je 0x7616c2
cmp dword [0xea5834], 0
je 0x7616c2
cmp dword [0xea5838], 0
je 0x7616c2
test eax, eax
je 0x7616c2
push 0x761400
call ecx
jmp 0x7616fa
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xea5834], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0xea5838], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0xea582c], 0
mov dword [0xea5830], ecx
mov dword [0xea583c], eax
call ecx
jmp 0x7616fa
push 0xea5844
mov dword [0xea5840], eax
call fcn.00800a63
add esp, 4
jmp 0x761600
Function at 0x779af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8786ad
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0xea5818], 0
je 0x779b3d
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0xea5818]
je 0x779b3d
push 0
call fcn.00741540
add esp, 4
mov bl, al
jmp 0x779b4a
mov bl, byte [0xa5d794]
mov byte [0xa5d794], 0
mov byte [ebp - 0x11], bl
mov byte [ebp - 0xd], bl
push 0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00779d70
test al, al
jne 0x779b68
xor bh, bh
jmp 0x779b93
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x779b75
xor eax, eax
jmp 0x779b7d
cmp dword [eax + 0x14], 8
jb 0x779b7d
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bh
cmp dword [0xea5818], 0
mov dword [ebp - 4], 1
je 0x779bbd
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0xea5818]
je 0x779bbd
push dword [ebp - 0x11]
call fcn.00741540
add esp, 4
jmp 0x779bc3
mov byte [0xa5d794], bl
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x78d1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8402bd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov cl, bl
mov eax, dword [ebp + 8]
and cl, 1
mov byte [ebp - 0x31], cl
lea ecx, [ebp - 0x30]
push eax
shr ebx, 1
call fcn.004cb5a0
mov dword [ebp - 4], 0
and bl, 1
je 0x78d256
lea eax, [ebp - 0x30]
push eax
call fcn.007a9150
add esp, 4
test al, al
je 0x78d256
nop
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x78d256
cmp esi, 3
jne 0x78d225
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x30]
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
je 0x78d25c
jmp 0x78d23a
cmp esi, 0x31
jne 0x78d23a
lea eax, [ebp - 0x30]
push eax
call fcn.0078a050
add esp, 4
test al, al
jne 0x78d256
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x30]
call fcn.007392d0
lea eax, [ebp - 0x30]
push eax
call fcn.007a9150
add esp, 4
test al, al
jne 0x78d200
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
cmp ecx, 8
lea eax, [ebp - 0x30]
cmovae eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78d275
xor bl, bl
jmp 0x78d27c
test al, 0x10
jne 0x78d27c
mov bl, byte [ebp - 0x31]
lea ecx, [ebp - 0x30]
call fcn.00436e00
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret

Function at 0x78ec00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x87a1bb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi], vtable.wxStringTokenizer.0
xor eax, eax
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 7
mov word [edi + 0xc], ax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
mov dword [edi + 0x2c], eax
mov dword [ebp - 0x14], esi
call fcn.00737c40
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.00737c40
mov dword [esi], eax
push dword [ebp + 0x10]
mov ecx, edi
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
mov dword [edi + 0x38], 0
push dword [ebp + 8]
call fcn.0078eff0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x7937e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x87a865
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [edi + 4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00792f20
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp eax, 2
jne 0x793874
push 0x8e3838
lea ecx, [ebp - 0x70]
call fcn.00436310
push 0x89c8f4
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00436310
push 1
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.00738300
lea ecx, [ebp - 0x50]
call fcn.00436e00
lea ecx, [ebp - 0x70]
call fcn.00436e00
lea eax, [ebp - 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x78], 0
cmp dword [ebp - 0x1c], 8
mov ecx, dword [edi + 4]
cmovae eax, dword [ebp - 0x30]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
call fcn.00731f70
lea ecx, [ebp - 0x30]
call fcn.00436e00
push dword [edi + 8]
mov eax, dword [ebp - 0x74]
push 1
push dword [eax + 4]
push dword [eax]
call fcn.00806d0c
push dword [edi + 8]
call fcn.00806178
add esp, 0x14
mov dword [ebp - 4], 4
call fcn.00737c40
mov ecx, dword [ebp - 0x74]
cmp ecx, eax
je 0x79390a
mov eax, 0xffff
add word [ecx + 8], ax
jne 0x793905
mov esi, dword [ebp - 0x74]
test esi, esi
je 0x793905
cmp byte [esi + 0xa], 0
je 0x7938fa
push dword [esi]
call fcn.00805aaa
add esp, 4
push 0xc
push esi
call fcn.00800125
add esp, 8
call fcn.00737c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret 4