joyce8/EMBER2024-capa huggingface dataset:
Function at 0x717a14
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x717ab6
cmp dword [ebx + 0xac], 0
jne 0x717ab0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x717954
call fcn.0075fcea
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x717ab0
push 3
mov eax, dword [esp + 4]
push eax
call fcn.0075fe28
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.0075fe3a
test al, 8
je 0x717a76
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x717ab0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004c123c
push eax
call fcn.0075fffc
dec esi
cmp esi, 0xffffffff
jne 0x717a85
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x717df8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x77a480]
cmp dword [eax + 0x190], 0
je 0x717f61
test bl, bl
jne 0x717eb4
cmp dword [esi + 0xb4], 0
jne 0x717ea9
mov eax, esi
call fcn.0071b15c
push eax
push 0x717cf8
call fcn.0075fcea
cmp dword [esi + 0x58], 0
je 0x717e7a
mov eax, dword [0x77a480]
cmp byte [eax + 0xeb], 0
je 0x717e7a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x717e5b
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x717e7a
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.00760026
dec edi
cmp edi, 0xffffffff
jne 0x717e63
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x717ea9
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004c123c
push eax
call fcn.0076001a
dec edi
cmp edi, 0xffffffff
jne 0x717e89
inc dword [esi + 0xb4]
jmp 0x717f61
cmp dword [esi + 0xb4], 0
jle 0x717f61
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x717f61
cmp dword [esi + 0x58], 0
je 0x717f16
mov eax, dword [0x77a480]
cmp byte [eax + 0xeb], 0
je 0x717f16
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x717ef7
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x717f16
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.00760026
dec edi
cmp edi, 0xffffffff
jne 0x717eff
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x717f45
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004c123c
push eax
call fcn.0076001a
dec edi
cmp edi, 0xffffffff
jne 0x717f25
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x705b7c]
call fcn.0041c590
pop edi
pop esi
pop ebx
ret
Function at 0x718d58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x718db5
cmp byte [ebx + 0xeb], 0
jne 0x718db5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call fcn.0075fe4c
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00419298
mov eax, dword [esi]
test eax, eax
je 0x718da2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x718dc2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004194f0
jmp 0x718dc2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004194f0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x71a9e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x71aa55
mov eax, esi
call fcn.0061c11c
test al, al
je 0x71aa55
mov eax, dword [ebx + 0x98]
call fcn.0061bcb4
push eax
call fcn.0075fe9a
test eax, eax
je 0x71aa55
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x71aa46
push 0
mov eax, dword [ebx + 0x98]
call fcn.0061bcb4
push eax
call fcn.00760026
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00611eec
jmp 0x71aa55
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0071a7f0
pop esi
pop ebx
ret
Function at 0x72d1f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x77a8d0], 0
jne 0x72d20f
call fcn.0072d1b4
mov eax, edi
dec eax
test eax, eax
jl 0x72d237
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x77a4d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x72d219
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x730310
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x730341
dec al
je 0x73037c
dec al
je 0x7303c0
dec al
je 0x730432
jmp 0x7304cd
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x7304cd
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x730351
jmp 0x7304cd
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7304cd
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x73038c
jmp 0x7304cd
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7304cd
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x7303f3
xor edx, edx
mov dword [esp + 4], edx
jmp 0x730408
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x730420
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x7303d0
jmp 0x7304cd
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7304cd
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x730499
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.0072d240
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x73044e
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x7481b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov byte [ebp - 5], al
mov al, byte [edx]
mov bl, al
xor bl, byte [ebp + 0xc]
lock cmpxchg byte [edx], bl
jne 0x7481cd
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
movzx eax, al
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x748748
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov word [ebp - 6], ax
mov ax, word [edx]
mov bx, ax
xor bx, word [ebp + 0xc]
lock cmpxchg word [edx], bx
jne 0x748760
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
movzx eax, ax
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x748ca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx]
mov ebx, eax
xor ebx, dword [ebp + 0xc]
lock cmpxchg dword [edx], ebx
jne 0x748cbd
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x749f68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x1c]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, edx
mov ebx, eax
xor ebx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x14]
lock cmpxchg8b qword [edi]
jne 0x749f91
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x74a1cc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x74a2fe
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x74a2fe
cmp dword [esp + 0x28], 0
je 0x74a2fe
mov dword [esp], 0x76fdac
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
test esi, esi
je 0x74a2fe
mov ebp, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], 0x76fdb5
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [edi], eax
mov dword [esp], esi
mov dword [esp + 4], 0x76fdce
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebx], eax
mov dword [esp], esi
mov dword [esp + 4], 0x76fde9
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [esp], esi
mov dword [esp + 4], 0x76fe08
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebp], eax
mov dword [esp], esi
mov dword [esp + 4], 0x76fe23
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [esp], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 4], 0x76fe51
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [esi], eax
mov eax, dword [edi]
mov dword [0x77b034], eax
cmp dword [ebp], 0
jne 0x74a2b2
mov dword [ebp], 0x74a19c
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jne 0x74a2c1
mov dword [eax], 0x74a18c
mov ecx, dword [esi]
test ecx, ecx
je 0x74a2ee
cmp dword [edi], 0
je 0x74a2fe
cmp dword [ebx], 0
je 0x74a2fe
mov esi, dword [esp + 0x28]
cmp dword [esi], 0
je 0x74a2fe
cmp dword [ebp], 0
je 0x74a2fe
cmp dword [eax], 0
je 0x74a2fe
xor eax, eax
test ecx, ecx
setne al
jmp 0x74a300
mov dword [esi], 0x74a18c
mov ecx, 0x74a18c
cmp dword [edi], 0
jne 0x74a2cc
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x74c010
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x7704bc], eax
jbe 0x74c04d
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x77b148]
call sub.KERNEL32.DLL_ReadFile
add esp, 0xc
cmp eax, 1
jne 0x74c054
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
jmp 0x74c06a
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x74c066
add esp, 0xc
ret
sub esp, 0xc
push ecx
call fcn.0074cd90
add esp, 0x10
add esp, 0xc
ret

Function at 0x74c088
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x7704bc], eax
jbe 0x74c0c5
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x77b148]
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
cmp eax, 1
jne 0x74c0d6
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
call fcn.0074cd90
add esp, 0x10
add esp, 0xc
ret
call fcn.0074ce30
add esp, 0xc
ret

Function at 0x74dd10
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
cmp eax, 1
jne 0x74dd2d
xor eax, eax
add esp, 0xc
ret
add esp, 0xc
jmp fcn.0074ce30
Function at 0x751a88
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov dword [esp + 0x18], edx
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], 0x1001
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.0074b2a4
mov word [esp + eax + 0x1c], 0x5f
mov edi, dword [esi + 4]
mov dword [esp], ebp
call fcn.0074b2a4
lea ecx, [esp + eax + 0x1c]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], 0x1002
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.0074b2a4
mov word [esp + eax + 0x1c], 0x2e
mov edi, dword [esi]
mov dword [esp], ebp
call fcn.0074b2a4
lea eax, [esp + eax + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0xa
call fcn.00754f84
mov edi, dword [esi + 0x24]
test edi, edi
je 0x751b7c
mov dword [esp], edi
call fcn.0074b2a4
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0074b2a4
mov ecx, ebp
mov ebp, eax
mov dword [esp], ecx
call fcn.0074b2a4
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0074a5a8
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x751bd1
jmp 0x751c19
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0074b2a4
mov ebx, eax
mov edi, ebp
mov dword [esp], ebp
call fcn.0074b2a4
mov ebp, eax
lea eax, [ebx + ebp + 3]
mov dword [esp], eax
call fcn.0074a590
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x751c19
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0074b2a4
lea eax, [ebp + eax + 3]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.0074b13f
mov ebp, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0074b158
mov edi, dword [esi + 0x24]
mov dword [esp], edi
call fcn.0074b2a4
mov word [edi + eax], 0x3d
mov eax, dword [esi + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.0074b158
mov esi, dword [esi + 0x24]
mov dword [esp], esi
call fcn.0074b2a4
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x751c1b
xor eax, eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x753674
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0074a590
add esp, 0x10
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0074a590
add esp, 0x10
mov dword [edi], eax
test edi, edi
je 0x7536e7
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x7536f6
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
xor ecx, ecx
and ecx, ebx
mov dword [esp + 8], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0074a590
add esp, 0x10
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0074a590
add esp, 0x10
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0074a590
add esp, 0x10
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp + 8]
sub esp, 0xc
push 4
call fcn.0074a590
add esp, 0x10
mov esi, eax
test esi, esi
je 0x7537e0
push 4
push esi
push 0x11
push dword [esp + 0x2c]
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0xc
test eax, eax
je 0x7537ef
push esi
call fcn.00754808
add esp, 0x10
mov word [edi + 0x14], ax
sub esp, 0xc
push esi
call fcn.0074a5a0
add esp, 0x10
mov eax, 1
jmp 0x7537fa
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
jmp 0x7537f8
push esi
call fcn.0074a5a0
add esp, 0x10
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x757568
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov edi, eax
test edi, edi
je 0x75762e
sub esp, 0xc
lea eax, [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
add esp, 0xc
movzx eax, word [esp + 0xa]
mov dword [esp + 0x18], eax
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 8]
movzx ebp, word [esp + 0x10]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x14]
movzx ebx, word [esp + 0x16]
sub esp, 0xc
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x3c]
push 0x7717d0
push 0x77b450
call fcn.0076006e
add esp, 0x24
push 0x77b450
call fcn.0074b2a4
add esp, 4
push 0
lea ebx, [esp + 0x18]
push ebx
push eax
push 0x77b450
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x40]
push esi
call fcn.0074b2a4
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x757660
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa0]
mov eax, dword [0x77b470]
test eax, eax
mov ecx, dword [0x77b46c]
jne 0x757725
test ecx, ecx
jne 0x757725
cmp dword [0x771a18], 0
je 0x75775b
sub esp, 4
lea esi, [esp + 0x14]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 4
push 0x5c
push esi
call fcn.00756e04
add esp, 0x10
test eax, eax
jne 0x7576d0
sub esp, 8
push 0x3a
push esi
call fcn.00756e04
add esp, 0x10
test eax, eax
je 0x7576d3
inc eax
mov esi, eax
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x757716
call sub.KERNEL32.DLL_GetCurrentThreadId
sub esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0x7577f0
push eax
call fcn.0075fce4
add esp, 4
cmp dword [esp + 0xc], 0
mov eax, 0x11010
mov ecx, 0x12010
cmove ecx, eax
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x7577a8
cmp ecx, 0xffffffff
je 0x7577a8
test ecx, ecx
je 0x75773c
sub esp, 0xc
push edi
call ecx
add esp, 0x10
mov eax, dword [0x77b470]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x7577a8
cmp byte [eax], 0
je 0x7577a8
sub esp, 8
push edi
push eax
call fcn.00757568
add esp, 0xa0
jmp 0x7577ae
sub esp, 0xc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea ebx, [esp + 0x1c]
push 0
push ebx
push 2
push 0x7717f4
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.0074b2a4
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x7717f4
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x759934
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x64
mov esi, dword [esp + 0x70]
mov dword [esp], 0x78352c
call sub.KERNEL32.DLL_EnterCriticalSection
sub esp, 4
mov eax, dword [0x7869dc]
cmp eax, 0x232
jl 0x75999e
mov eax, dword [esp + 0x74]
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0x20726f72
mov dword [esp + 0x1c], 0x72652065
mov dword [esp + 0x18], 0x726f6870
mov dword [esp + 0x14], 0x616d6553
mov dword [esp + 4], eax
lea edi, [esp + 0x14]
mov dword [esp], edi
call fcn.0074b158
mov dword [esp], edi
call fcn.007577d0
mov eax, dword [0x7869dc]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x78352c]
mov dword [esp], eax
call sub.KERNEL32.DLL_InitializeCriticalSection
sub esp, 4
mov eax, dword [0x7869dc]
lea ecx, [eax + 1]
mov dword [0x7869dc], ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x78352c]
mov dword [esi], eax
mov dword [esp], 0x78352c
call sub.KERNEL32.DLL_LeaveCriticalSection
add esp, 0x60
pop esi
pop edi
ret

Function at 0x7599e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x58
mov eax, dword [esp + 0x60]
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], 0x20726f72
mov dword [esp + 0x10], 0x72652065
mov dword [esp + 0xc], 0x726f6870
mov dword [esp + 8], 0x616d6553
mov dword [esp + 4], eax
lea esi, [esp + 8]
mov dword [esp], esi
call fcn.0074b158
mov dword [esp], esi
call fcn.007577d0
add esp, 0x58
pop esi
ret