joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
pop ebp
jmp fcn.1003b6a4

Function at 0x1003e030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1003e0dd
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [esi + 4], 0
jne 0x1003e0dd
call ebx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
call ebx
mov dword [eax], 0
push dword [esi]
push edi
push 1
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1003e092
add dword [esi + 8], eax
sub edi, eax
jb 0x1003e0e7
add dword [ebp - 0x10], eax
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x1003e0a7
call ebx
cmp dword [eax], 4
je 0x1003e0a7
call ebx
cmp dword [eax], 0
je 0x1003e0c5
call ebx
mov eax, dword [eax]
mov dword [esi + 4], eax
call ebx
cmp dword [eax], 0
jne 0x1003e0b9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
test edi, edi
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jne 0x1003e052
jmp 0x1003e0dd
push dword [esi]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 4
test eax, eax
je 0x1003e08a
mov dword [esi + 4], 9
jmp 0x1003e08a
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
ud2

Function at 0x1003f520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
cmp ebx, 0x400
jb 0x1003f57a
mov dword [ebp - 0x10], edx
mov eax, 0x400
push eax
push edx
call sym.absl.dll__CityHash32_hash_internal_absl__YAIPBDI_Z
mov ecx, 0xcc9e2d51
add esp, 8
add eax, edi
adc esi, 0
mul ecx
imul esi, ecx
add esi, edx
mov edx, dword [ebp - 0x10]
mov edi, eax
xor edi, esi
add ebx, 0xfffffc00
mov eax, 0x400
add edx, eax
cmp ebx, 0x3ff
ja 0x1003f53b
cmp ebx, 9
jb 0x1003f590
push ebx
push edx
call sym.absl.dll__CityHash32_hash_internal_absl__YAIPBDI_Z
mov ecx, 0xcc9e2d51
add esp, 8
jmp 0x1003f5f5
cmp ebx, 4
jb 0x1003f5c5
mov eax, dword [edx + ebx - 4]
shl ebx, 3
add bl, 0xe0
mov dword [ebp - 0x10], 0
mov ecx, ebx
shld dword [ebp - 0x10], eax, cl
shl eax, cl
xor ecx, ecx
test bl, 0x20
mov ebx, dword [ebp - 0x10]
cmovne ebx, eax
cmovne eax, ecx
mov ecx, 0xcc9e2d51
or eax, dword [edx]
jmp 0x1003f5f7
test ebx, ebx
je 0x1003f608
mov ecx, ebx
shr ecx, 1
movzx eax, byte [edx + ecx]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + ebx - 1]
shl ecx, 3
shl dword [ebp - 0x10], cl
lea ecx, [ebx*8 - 8]
shl eax, cl
movzx ecx, byte [edx]
or eax, ecx
mov ecx, 0xcc9e2d51
or eax, dword [ebp - 0x10]
xor ebx, ebx
add eax, edi
adc ebx, esi
mul ecx
imul ebx, ecx
add ebx, edx
mov edi, eax
xor edi, ebx
mov esi, ebx
mov eax, edi
mov edx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003f740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
cmp edx, 0x400
jae 0x1003f761
mov edi, esi
jmp 0x1003f7a9
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ebx
mov ecx, 0x400
push ecx
push ebx
mov ebx, eax
call sym.absl.dll__CityHash64_hash_internal_absl__YA_KPBDI_Z
mov ecx, 0xcc9e2d51
add esp, 8
mov edi, edx
add eax, ebx
mov ebx, dword [ebp - 0x10]
adc edi, esi
mul ecx
imul edi, ecx
add edi, edx
mov edx, dword [ebp - 0x14]
xor eax, edi
add edx, 0xfffffc00
mov ecx, 0x400
add ebx, ecx
mov esi, edi
cmp edx, 0x3ff
ja 0x1003f761
cmp edx, 0x11
jb 0x1003f7c8
push edx
push ebx
mov esi, eax
call sym.absl.dll__CityHash64_hash_internal_absl__YA_KPBDI_Z
mov ecx, 0xcc9e2d51
add esp, 8
mov ebx, eax
mov eax, esi
jmp 0x1003f8a9
cmp edx, 9
jb 0x1003f828
mov ecx, dword [ebx + edx - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [ebp - 0x18], ecx
shl dl, 3
mov cl, 0x80
sub cl, dl
mov edx, dword [ebp - 0x18]
shr edx, cl
mov esi, dword [ebp - 0x18]
shrd dword [ebp - 0x10], esi, cl
mov dword [ebp - 0x14], 0
test cl, 0x20
mov ecx, 0xcc9e2d51
mov esi, dword [ebp - 0x10]
cmovne esi, edx
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
cmove esi, edx
mov dword [ebp - 0x14], esi
add eax, dword [ebx]
adc edi, dword [ebx + 4]
mov ebx, dword [ebp - 0x10]
mul ecx
imul edi, ecx
add edi, edx
mov edx, dword [ebp - 0x14]
xor eax, edi
jmp 0x1003f8a9
cmp edx, 4
jb 0x1003f86e
mov esi, dword [ebx + edx - 4]
shl edx, 3
add dl, 0xe0
mov dword [ebp - 0x14], 0
mov ecx, edx
shld dword [ebp - 0x14], esi, cl
shl esi, cl
mov dword [ebp - 0x10], esi
test dl, 0x20
mov edx, dword [ebp - 0x14]
cmovne edx, esi
mov esi, 0
mov ecx, dword [ebp - 0x10]
cmovne ecx, esi
mov dword [ebp - 0x10], ecx
mov ecx, 0xcc9e2d51
mov esi, dword [ebp - 0x10]
or esi, dword [ebx]
mov ebx, esi
jmp 0x1003f8a9
test edx, edx
je 0x1003f8b6
mov ecx, edx
shr ecx, 1
mov dword [ebp - 0x14], edx
movzx esi, byte [ebx + ecx]
mov dword [ebp - 0x10], esi
movzx esi, byte [ebx + edx - 1]
shl ecx, 3
mov edx, dword [ebp - 0x10]
shl edx, cl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx*8 - 8]
shl esi, cl
movzx ecx, byte [ebx]
mov ebx, esi
or ebx, ecx
mov ecx, 0xcc9e2d51
or ebx, edx
xor edx, edx
add eax, ebx
adc edi, edx
mul ecx
imul edi, ecx
add edi, edx
xor eax, edi
mov edx, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10040dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [ecx + edx]
test edx, edx
jle 0x10040e01
movdqa xmm0, xmmword [0x10050680]
movdqa xmm1, xmmword [0x10050690]
mov edx, ecx
movdqu xmm2, xmmword [edx]
pxor xmm3, xmm3
pcmpgtb xmm3, xmm2
pand xmm3, xmm0
pxor xmm3, xmm1
movdqu xmmword [edx], xmm3
add edx, 0x10
cmp edx, eax
jb 0x10040de2
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 7]
movsd qword [eax + 8], xmm1
movsd qword [eax + 1], xmm0
mov byte [eax], 0xff
pop ebp
ret

Function at 0x10042ae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push 0
push 0x10052270
push eax
call fcn.10042b06
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]

Function at 0x10042b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push 0
push 0x10052270
push eax
call fcn.10042b06
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10042b90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push 0
push 0x10052270
push eax
call fcn.10042b06
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10042bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [edx + eax*8]
mov edi, dword [edx + eax*8 + 4]
xor dword [ecx + eax*8 + 0x10], esi
xor dword [ecx + eax*8 + 0x14], edi
inc eax
cmp eax, 0x1e
jne 0x10042bdd
pop esi
pop edi
pop ebp
ret
Function at 0x100432c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x10072168]
xor eax, ebp
mov dword [ebp - 0x10], eax
test esi, esi
je 0x1004333c
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10043322
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push str.Microsoft_Primitive_Provider
push 0x100532d2
push eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x10043326
shl edi, 2
xor ebx, ebx
push ebx
push edi
push esi
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
push ebx
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
test esi, esi
setns bl
jmp 0x1004333e
mov bl, 1
jmp 0x1004333e
push str.Failed_to_open_crypto_provider.
push 0x5e
push 0x1005330c
push 2
call sym.absl.dll__RawLog_raw_logging_internal_absl__YAXW4LogSeverity_2_PBDH1ZZ
add esp, 0x10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045530
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10043360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100433e5
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
lea eax, [edx + eax*4]
mov dword [ebp - 0x10], eax
lea ecx, [ecx*4]
mov ebx, 0x43b0d7e5
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0x14], 0
je 0x100433d9
xor esi, esi
mov dword [ebp - 0x18], edx
imul eax, ebx, 0x931e8875
xor ebx, dword [edx]
imul ebx, eax
mov ecx, ebx
shr ecx, 0x10
mov edx, edi
imul edi, dword [edi + esi], 0xca01f9dd
xor ecx, ebx
imul ecx, ecx, 0xb68c08eb
add ecx, edi
mov edi, ecx
shr edi, 0x10
xor edi, ecx
mov ecx, dword [ebp - 0x14]
mov dword [edx + esi], edi
mov edi, edx
mov edx, dword [ebp - 0x18]
add esi, 4
mov ebx, eax
cmp ecx, esi
jne 0x10043399
jmp 0x100433db
mov eax, ebx
add edx, 4
mov ebx, eax
cmp edx, dword [ebp - 0x10]
jne 0x1004338e
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4331a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x45c2c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x11], 0x37
mov byte [ebp - 0x10], 0x38
mov byte [ebp - 0xf], 0x39
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x46
mov dword [ebp - 4], 0
jmp 0x433202
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x43324d
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jae 0x43324d
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx + 0x218]
sar eax, 4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov al, byte [ebp + eax - 0x18]
mov byte [edx + ecx*2], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x218]
and edx, 0xf
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + edx - 0x18]
mov byte [ecx + eax*2 + 1], dl
jmp 0x4331f9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + eax*2], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00406f12
mov esp, ebp
pop ebp
ret

Function at 0x434180
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x435410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x457ce0
push 0x409c40
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe8
push ebx
push esi
push edi
mov eax, dword [0x45c2c4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x435519
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x24]
jae 0x435507
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jae 0x4354ab
mov ecx, dword [ebp - 0x1c]
movzx edx, byte [ecx]
push edx
call fcn.004352c0
add esp, 4
movzx eax, al
test eax, eax
jne 0x4354ab
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x435482
mov edx, dword [ebp - 0x1c]
movzx eax, byte [edx]
push eax
call fcn.004352c0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4354d0
mov edx, dword [ebp - 0x1c]
mov byte [edx], 0
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x24]
jae 0x435502
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax]
push ecx
call fcn.004352c0
add esp, 4
movzx edx, al
test edx, edx
je 0x435502
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4354d9
jmp 0x43546a
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x435532
mov dword [ebp - 4], 0xfffffffe
jmp 0x435532
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4364b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
fldz
fstp dword [eax + 0x1dc]
lea ecx, [ebp - 0x20]
push ecx
call dword [0x452158]
test eax, eax
je 0x4365d4
lea edx, [ebp - 0x28]
push edx
call dword [0x45215c]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
adc ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea edx, [ebp - 8]
push edx
call dword [0x45215c]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x24]
jb 0x43653d
ja 0x436559
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x28]
jb 0x43653d
rdtsc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
and dword [ebp - 0x2c], 0x7fffffff
fild qword [ebp - 0x30]
and dword [ebp - 0x34], 0x80000000
mov dword [ebp - 0x38], 0
fild qword [ebp - 0x38]
fchs
faddp st(1)
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
and dword [ebp - 0x3c], 0x7fffffff
fild qword [ebp - 0x40]
and dword [ebp - 0x44], 0x80000000
mov dword [ebp - 0x48], 0
fild qword [ebp - 0x48]
fchs
faddp st(1)
fsubp st(1)
fdiv qword [0x456030]
mov edx, dword [ebp + 8]
fstp dword [edx + 0x1dc]
mov esp, ebp
pop ebp
ret

Function at 0x43a6c0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4576e8
push 0x409c40
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x45c2c4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, 1
invalid

Function at 0x43a750
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x457708
push 0x409c40
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x45c2c4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x43a7d0
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a9d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x43aa10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [0x45e92c], ecx
mov edx, dword [0x45e92c]
cmp dword [edx], 0x4550
je 0x43aa09
xor eax, eax
jmp 0x43aa12
mov eax, dword [0x45e92c]
jmp 0x43aa12
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43abe0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x457da0
push 0x409c40
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x45c2c4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x448ea0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [fcn.004522d0]
push eax
call dword [0x45202c]
test eax, eax
jne 0x448ec1
xor al, al
jmp 0x448f20
lea ecx, [ebp - 0x1c]
push ecx
push 0x454154
push 0
call dword [fcn.00452000]
test eax, eax
jne 0x448ee4
mov edx, dword [ebp - 4]
push edx
call dword [fcn.004522d4]
xor al, al
jmp 0x448f20
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [fcn.00452004]
mov ecx, dword [ebp - 4]
push ecx
call dword [fcn.004522d4]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b38ae
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004b392d
jae 0x4b38ba
xor ecx, ecx
call fcn.004b392d
jae 0x4b38e4
xor eax, eax
call fcn.004b392d
jae 0x4b38f5
mov al, 0x10
call fcn.004b392d
adc al, al
jae 0x4b38d6
jne 0x4b3922
stosb byte es:[edi], al
jmp 0x4b38bb
call fcn.004b3939
dec ecx
loop 0x4b3901
mov eax, ebp
call fcn.004b3937
jmp 0x4b3923
lodsb al, byte [esi]
shr eax, 1
je 0x4b3949
adc ecx, 2
mov ebp, eax
jmp 0x4b3923
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004b3937
cmp eax, 0x7d00
jae 0x4b3921
cmp eax, 0x500
jae 0x4b3922
cmp eax, 0x7f
ja 0x4b3923
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4b38bb
pop ebp
ret 8
Function at 0x10002750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov dword [esp], 0x10005ce0
mov dword [ebp - 0x10], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x10009004]
sub esp, 4
lea edx, [ebx + 0x1c0]
test ebx, ebx
jne 0x1000278f
jmp 0x10002828
add ebx, 0xe
cmp ebx, edx
jae 0x100027e8
mov eax, dword [ebx + 2]
test eax, eax
jne 0x10002788
mov eax, dword [ebp + 0x14]
mov dword [ebx + 2], eax
movzx eax, word [ebp - 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ICOpenFunction_16
sub esp, 0x10
test eax, eax
je 0x10002818
mov word [ebx + 0xc], ax
mov esi, eax
mov dword [esp], 0x10005ce0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test byte [0x10005cf8], 1
jne 0x100028a0
mov dword [esp], 0x10005ce0
xor esi, esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [ebx + 2], 0
xor esi, esi
jmp 0x100027c7
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x1c0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [0x10009004], eax
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x100027f5
lea edx, [eax + 0x1c0]
lea edi, [ebx + 0x1cc]
mov esi, dbg.IC_Callback3216
lea eax, [eax + 0xc]
nop
mov ecx, esi
mov byte [eax - 0xc], 0x58
sub ecx, eax
mov byte [eax - 0xb], 0x68
add eax, 0xe
mov dword [eax - 0x12], ecx
xor ecx, ecx
mov dword [eax - 0x18], 0
mov byte [eax - 0x14], 0x50
mov byte [eax - 0x13], 0xe9
mov word [eax - 0xe], cx
cmp eax, edi
jne 0x10002870
jmp 0x1000278f
mov dword [esp + 0xc], str.Out_of_msvideo_thunks._Bump_MAX_THUNKS_n
mov dword [esp + 8], str.MSVIDEO_AddThunk
mov dword [esp + 4], 0x10005cf8
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x100027f5
Function at 0x100029b0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov esi, dword [ebp + 0xc]
movzx edi, dx
mov dword [ebp - 0x10], eax
mov dword [esp + 8], edi
movzx esi, si
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x14]
mov ebx, eax
movzx eax, word [ebp - 0x10]
sub esp, 0xc
test byte [0x10005cf8], 8
mov dword [ebp - 0x10], eax
jne 0x10002a90
shr dx, 1
je 0x10002a28
mov eax, dword [ebp + 0x14]
movzx edx, dx
mov dword [esp], ebx
add edx, edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sym._memcpy
mov dword [esp], ebx
call sym._MapLS_4
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dbg.ICSendMessage16@16
mov edx, dword [ebp - 0x14]
sub esp, 0x10
mov esi, eax
mov dword [esp], edx
call sym._UnMapLS_4
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.0x_08lx___u___u__...__n
mov dword [esp + 8], str.ICMessage16
mov dword [esp + 4], 0x10005cf8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x14]
jmp 0x10002a0b
Function at 0x10003990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100039e8
cmp byte [esi + ebx - 1], 0xa
je 0x100039bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret