joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, eax
and edx, 8
cmp byte [ecx + 9], 0
mov dword [ebp - 0x14], edx
je 0x10029591
test al, 2
jne 0x10029610
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test ax, ax
je 0x10029630
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
xor ebx, ebx
nop
lea esi, [esi]
mov dword [esp], eax
rol ebx, 4
add edi, 2
call esi
movzx eax, ax
xor ebx, eax
movzx eax, word [edi]
test ax, ax
jne 0x100295b0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name_prot
test eax, eax
js 0x10029606
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10029634
cmp dword [eax + 8], 4
je 0x10029634
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
sub eax, dword [ecx + 0x14]
sar eax, 5
add eax, 1
mov dword [edx], eax
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [esp], edx
mov edx, dword [ebp + 0xc]
mov ecx, 0x1c00
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._ensure_prop_name
jmp 0x100295e2
xor ebx, ebx
jmp 0x100295c8
test byte [0x1008a0fc], 8
jne 0x1002964d
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffff
mov eax, 0x80020006
jmp 0x10029606
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.not_found__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.jsdisp_get_id
mov dword [esp + 4], 0x1008a0fc
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x1002963d
Function at 0x10029c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, 0x70
mov ebp, esp
push edi
mov edi, 0x1008f2f8
push esi
push ebx
xor ebx, ebx
sub esp, 0x1c
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
nop
lea esi, [esi]
mov dword [esp], eax
rol ebx, 4
add edi, 2
call esi
movzx eax, ax
xor ebx, eax
movzx eax, word [edi]
test ax, ax
jne 0x10029c40
lea eax, [ebp - 0x18]
mov dword [esp], 0
mov ecx, 0x1008f2f8
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
call sym._find_prop_name_prot
test eax, eax
js 0x10029c86
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10029c86
cmp dword [ecx + 8], 4
jne 0x10029cb8
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._init_dispex
mov esi, eax
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 0x14]
mov dword [esp], eax
mov eax, edx
call sym._prop_get
mov esi, eax
test eax, eax
js 0x10029d31
cmp dword [ebp - 0x10], 0x7ff90003
je 0x10029d67
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x104]
add dword [ebx + 4], 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._jsval_release
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._init_dispex
sub dword [ebx + 4], 1
mov esi, eax
jne 0x10029ca9
mov dword [esp], ebx
call sym._jsdisp_free
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x1008a0fc], 2
je 0x10029ca9
mov dword [esp + 0xc], str.Could_not_get_prototype_n
mov dword [esp + 8], str.init_dispex_from_constr
mov dword [esp + 4], 0x1008a0fc
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_5
jmp 0x10029ca9
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 0x1008a0c0
je 0x10029ce4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._jsval_release
jmp 0x10029c86
Function at 0x1002b4a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test ax, ax
je 0x1002b550
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
xor ebx, ebx
lea esi, [esi]
mov dword [esp], eax
rol ebx, 4
add edi, 2
call esi
movzx eax, ax
xor ebx, eax
movzx eax, word [edi]
test ax, ax
jne 0x1002b4d0
lea eax, [ebp - 0x10]
mov dword [esp], 0
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name_prot
test eax, eax
js 0x1002b547
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1002b554
cmp dword [ecx + 8], 4
je 0x1002b554
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
movzx eax, word [ebp - 0x14]
mov dword [esp], eax
mov eax, edx
call sym._invoke_prop_func
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0x1002b4e8
mov eax, 0x800a01b6
jmp 0x1002b547

Function at 0x1002b6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
cmp byte [eax + 9], 0
jne 0x1002b760
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
movzx eax, word [eax]
test ax, ax
je 0x1002b708
lea esi, [esi]
mov dword [esp], eax
add edi, 2
rol ebx, 4
call esi
movzx edx, ax
movzx eax, word [edi]
xor ebx, edx
test ax, ax
jne 0x1002b6f0
lea eax, [ebp - 0x10]
mov dword [esp], 0
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name
test eax, eax
js 0x1002b752
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1002b780
cmp dword [edx + 8], 4
jne 0x1002b73d
mov eax, dword [ebp + 8]
cmp byte [eax + 9], 0
je 0x1002b780
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp], ecx
mov dword [esp + 4], ebx
call sym._prop_put
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._ensure_prop_name
jmp 0x1002b723
cmp dword [ebp + 0x14], 1
sbb eax, eax
add esp, 0xc
not eax
pop ebx
pop esi
and eax, 0x800a01bd
pop edi
pop ebp
ret
Function at 0x1002bbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test ax, ax
je 0x1002bc80
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
xor ebx, ebx
nop
lea esi, [esi]
mov dword [esp], eax
add edi, 2
rol ebx, 4
call esi
movzx edx, ax
movzx eax, word [edi]
xor ebx, edx
test ax, ax
jne 0x1002bc08
lea eax, [ebp - 0x10]
mov dword [esp], 0
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name_prot
test eax, eax
js 0x1002bc5c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
test ecx, ecx
je 0x1002bc68
cmp dword [ecx + 8], 4
je 0x1002bc68
mov dword [esp], eax
mov edx, dword [ebp + 8]
mov eax, edx
call sym._prop_get
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [eax + 4], 0x7ff90001
add esp, 0xc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0x1002bc20

Function at 0x1002bc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0x1008f47a
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x24]
mov dword [esp + 4], 0xc
mov dword [esp], eax
call sym._swprintf_1
movzx eax, word [ebp - 0x24]
test ax, ax
je 0x1002bd30
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
lea edi, [ebp - 0x24]
xor ebx, ebx
nop
mov dword [esp], eax
add edi, 2
rol ebx, 4
call esi
movzx edx, ax
movzx eax, word [edi]
xor ebx, edx
test ax, ax
jne 0x1002bcd0
lea eax, [ebp - 0x28]
mov dword [esp], 0
lea ecx, [ebp - 0x24]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name_prot
test eax, eax
js 0x1002bd24
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 0x10]
test ecx, ecx
je 0x1002bd34
cmp dword [ecx + 8], 4
je 0x1002bd34
mov dword [esp], eax
mov edx, dword [ebp + 8]
mov eax, edx
call sym._prop_get
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0x1002bce8
mov dword [eax + 4], 0x7ff90001
mov eax, 0x80020006
jmp 0x1002bd24
Function at 0x1002bed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0x1008f47a
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x24]
mov dword [esp + 4], 0xc
mov dword [esp], eax
call sym._swprintf_1
movzx eax, word [ebp - 0x24]
test ax, ax
je 0x1002bf90
mov ebx, dword [sym.imp.ucrtbase.dll_towlower]
lea esi, [ebp - 0x24]
xor edi, edi
nop
lea esi, [esi]
mov dword [esp], eax
add esi, 2
rol edi, 4
call ebx
movzx edx, ax
movzx eax, word [esi]
xor edi, edx
test ax, ax
jne 0x1002bf18
lea eax, [ebp - 0x2c]
mov dword [esp], 0
lea ecx, [ebp - 0x24]
mov edx, edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name
test eax, eax
js 0x1002bf75
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1002bf75
cmp dword [ecx + 8], 2
je 0x1002bf73
test byte [ecx + 0xd], 0x10
je 0x1002bf80
mov eax, ecx
lea edx, [ebp - 0x28]
call sym._delete_prop.part.0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1002bf80
xor eax, eax
add esp, 0x30
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x30
mov eax, 0x800a01bd
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
jmp 0x1002bf30
Function at 0x1002e200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test ax, ax
je 0x1002e370
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.ucrtbase.dll_towlower]
xor ebx, ebx
nop
lea esi, [esi]
mov dword [esp], eax
add esi, 2
rol ebx, 4
call edi
movzx edx, ax
movzx eax, word [esi]
xor ebx, edx
test ax, ax
jne 0x1002e228
lea eax, [ebp - 0x10]
mov dword [esp], 0
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name
test eax, eax
js 0x1002e2a8
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1002e377
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x24], 0
mov eax, dword [ebp + 0x14]
lea edi, [eax + 4]
mov ecx, eax
xor eax, eax
and edi, 0xfffffffc
sub ecx, edi
add ecx, 0x28
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 8]
cmp ecx, 3
je 0x1002e2f0
mov eax, 0x80020006
jbe 0x1002e2b0
cmp ecx, 5
je 0x1002e2b5
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ecx, 2
je 0x1002e2a8
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov ecx, 0x1c00
mov dword [eax + 4], 0x800
mov dword [eax + 8], 1
test ebx, ebx
je 0x1002e33c
mov eax, dword [edx + 0xc]
mov edi, dword [ebp + 0x14]
and eax, 0x1c00
mov dword [edi + 4], ecx
mov dword [edi], eax
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, 0x1400
mov dword [eax + 0x20], 1
mov dword [eax + 0x18], 1
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1002e2d2
mov eax, dword [edx + 0x10]
test eax, eax
je 0x1002e318
add dword [eax + 4], 1
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 0x14]
test eax, eax
je 0x1002e329
add dword [eax + 4], 1
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x24], eax
mov eax, dword [ecx + 4]
mov ecx, eax
mov dword [ebp - 0x14], eax
or ch, 0x14
jmp 0x1002e2d2
add eax, 0x10
mov ecx, edx
mov edx, dword [ebp + 8]
mov dword [esp], eax
mov eax, edx
call sym._prop_get
test eax, eax
js 0x1002e2a8
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov ecx, eax
mov dword [ebp - 0x14], eax
or ch, 0x14
jmp 0x1002e2d2
xor ebx, ebx
jmp 0x1002e240
mov eax, 0x80020006
jmp 0x1002e2a8
Function at 0x1004af80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov eax, dword [0x100ab008]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x1004afb0
add dword [ebx], 1
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 4], 0x20
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
test eax, eax
je 0x1004afa1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [ebx + 0x18], sym._weak_refs_compare
mov dword [ebx + 0x1c], 0
mov dword [ebx + 4], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], eax
mov eax, dword [0x100ab008]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
jmp 0x1004af9e
Function at 0x10061b70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx + 0x18]
test byte [0x1008a280], 8
jne 0x10061c20
lea eax, [ebp - 0xc]
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
sub esp, 8
test al, al
je 0x10061c60
xor eax, eax
test ebx, ebx
je 0x10061bf9
mov eax, dword [ebp - 0xc]
pxor xmm0, xmm0
add eax, 0x80000000
cvtsi2sd xmm0, eax
addsd xmm0, qword [0x10097af0]
divsd xmm0, qword [0x10097af8]
movsd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, eax
and ecx, 0x7ff00000
cmp ecx, 0x7ff00000
je 0x10061c08
mov dword [ebx], edx
mov dword [ebx + 4], eax
xor eax, eax
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
test eax, 0xfffff
je 0x10061c50
mov eax, 0x7ff80000
mov edx, 0xffffffff
jmp 0x10061bf2
mov dword [esp + 0xc], 0x10097792
mov dword [esp + 8], str.Math_random
mov dword [esp + 4], 0x1008a280
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_17
jmp 0x10061b92
test edx, edx
mov ecx, 0x7ff80000
cmovne eax, ecx
jmp 0x10061bf2
mov eax, 0x8000ffff
jmp 0x10061bf9
Function at 0x10069dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x10
mov edi, dword [eax + 0xc]
lea eax, [edi + 2]
mov dword [esi + 0xc], eax
movzx eax, word [edi + 2]
lea edx, [eax - 0x30]
cmp edx, 9
ja 0x10069f18
lea edx, [edi + 4]
mov dword [esp], esi
xor ecx, ecx
xor ebx, 1
mov dword [esi + 0xc], edx
mov edx, 0xffff
call sym._GetDecimalValue
mov ecx, ebx
and ecx, 1
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], cl
cmp eax, 0xffffffff
jne 0x10069e17
mov eax, 0x2f
test cl, cl
jne 0x10069e96
mov edx, dword [esi + 0xc]
mov ebx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp ax, 0x2c
je 0x10069ea0
cmp ax, 0x7d
jne 0x10069f18
mov edx, dword [esi + 0x5c]
mov ecx, 0x18
mov eax, esi
call sym._NewRENode.isra.0
mov dword [esi + 0x20], eax
test eax, eax
je 0x10069f08
mov edi, dword [ebp - 0x10]
mov edx, 1
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x20]
mov dword [eax + 0x10], ebx
mov eax, edi
shr eax, 7
je 0x10069e70
lea esi, [esi]
add edx, 1
shr eax, 7
jne 0x10069e68
add ebx, 1
mov eax, 1
shr ebx, 7
je 0x10069e88
lea esi, [esi]
add eax, 1
shr ebx, 7
jne 0x10069e80
mov ecx, dword [esi + 0x1c]
lea edx, [edx + ecx + 4]
add eax, edx
mov dword [esi + 0x1c], eax
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx + 2]
mov ebx, 0xffffffff
mov dword [esi + 0xc], eax
movzx ecx, word [edx + 2]
mov dword [ebp - 0x18], ecx
mov eax, ecx
sub ecx, 0x30
cmp ecx, 9
ja 0x10069e26
add edx, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [esi + 0xc], edx
mov edx, 0xffff
call sym._GetDecimalValue
mov ebx, eax
cmp eax, 0xffffffff
jne 0x10069eea
cmp byte [ebp - 0x11], 0
mov eax, 0x30
jne 0x10069e96
cmp dword [ebp - 0x10], ebx
jbe 0x10069efa
cmp byte [ebp - 0x11], 0
mov eax, 0x31
jne 0x10069e96
mov eax, dword [esi + 0xc]
movzx eax, word [eax]
jmp 0x10069e26
add esp, 0x10
mov eax, 0x89
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esi + 0xc], edi
mov eax, 0xffffffff
jmp 0x10069e96
Function at 0x10088000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10088058
cmp byte [esi + ebx - 1], 0xa
je 0x1008802c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100ab0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10088680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10088858
mov edi, dword [0x100ab0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10088767
test byte [0x1008a328], 8
jne 0x10088800
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1008a338], 8
jne 0x100887c0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10088709
cmp esi, 3
jbe 0x10088778
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1008871a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1009d808]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10088709
mov dword [esp], 0x1008a338
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100886e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100886e0
mov dword [esp], 0x1008a328
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100886cb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100886d3
mov eax, 0xffffffff
jmp 0x10088767
Function at 0x100888e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100ab0c0]
test eax, eax
je 0x10088998
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10088920
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1008890c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x100889cd
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100ab0c0], eax
sub esp, 8
test eax, eax
jne 0x100888fd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1008890e
Function at 0x100889e0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10088b70
mov eax, dword [esi]
test eax, eax
je 0x10088b58
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x10088b7c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10088b48
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x10088b0c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10088a46
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10088b72