joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458910
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, 0x10
jb 0x4589e5
lea ebx, [esp - 0x38]
mov ebp, dword [esp + 0x24]
and ebx, 0xfffffff0
mov ecx, dword [esp + 0x28]
xchg esp, ebx
movdqu xmm1, xmmword [ebp]
sub edi, esi
mov dword [esp + 0x30], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov edi, eax
lea ebp, [0xfffff4cf]
call fcn.00458180
cmp ecx, 0
je 0x4589a0
jmp 0x458970
movdqu xmm0, xmmword [esi]
pxor xmm0, xmm1
call fcn.00458190
mov ebx, dword [esp]
mov edx, dword [esp + 4]
movdqa xmm1, xmm0
movdqu xmmword [ebx + esi], xmm0
lea esi, [esi + 0x10]
sub edi, 0x10
jae 0x458970
jmp 0x4589d9
movdqu xmm0, xmmword [esi]
movdqa xmmword [esp + 0x10], xmm1
movdqa xmmword [esp + 0x20], xmm0
call fcn.004582d0
mov ebx, dword [esp]
mov edx, dword [esp + 4]
pxor xmm0, xmmword [esp + 0x10]
movdqa xmm1, xmmword [esp + 0x20]
movdqu xmmword [ebx + esi], xmm0
lea esi, [esi + 0x10]
sub edi, 0x10
jae 0x4589a0
mov ebx, dword [esp + 8]
mov esp, dword [esp + 0x30]
movdqu xmmword [ebx], xmm1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x458b00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x458b1e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x458be0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x458c02
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x458cf0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x458d1a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret
Function at 0x458e60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x458ebf
Function at 0x45baa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0045b540
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x45bb11
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x45bad6
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x45cfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x45d0a4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x45d03f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0045cb60
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x45d00d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x45d15d
call 0x45d051
pop edx
lea ecx, [edx + 0x12f]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x45d0fc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0045cc90
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x45d0b5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x45d15d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0045cc90
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x45d158
jmp 0x45d15d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45e200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x45e2ea
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x45e27d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0045d9c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x45e243
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x45e3b3
call 0x45e28f
pop edx
lea ecx, [edx + 0x171]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x45e34a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0045dde0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x45e2fb
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x45e3b3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0045dde0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x45e3ae
jmp 0x45e3b3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46c6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x46c6f5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x46c70d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x46c73c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x46c77e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x46c852
sub edx, 0x10000
js 0x46c852
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x46c764
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x46c764
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x46c7d5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x46c7d2
add edx, 8
jne 0x46c7b9
jmp 0x46c843
add edx, 4
test eax, 0xffff
jne 0x46c7e2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x46c843
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x46c816
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x46c764
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x46c852
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x46c764
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x46c863
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x46c8b9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ca510]
jne 0x46c8c3
repz ret
jmp fcn.004725b1
Function at 0x479f5f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ca510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00475050
and dword [ebp - 0x14], 0
cmp dword [0x4da460], 0
mov dword [ebp - 0x18], eax
jne 0x47a012
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x47a0ba
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4814d0
push ebx
call edi
test eax, eax
je 0x47a0ba
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4da460], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4da464], eax
call edi
push eax
call esi
push 0x481490
push ebx
mov dword [0x4da468], eax
call edi
push eax
call esi
mov dword [0x4da470], eax
test eax, eax
je 0x47a012
push 0x481478
push ebx
call edi
push eax
call esi
mov dword [0x4da46c], eax
mov eax, dword [0x4da46c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x47a06b
cmp dword [0x4da470], ecx
je 0x47a06b
push eax
call esi
push dword [0x4da470]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x47a06b
test ebx, ebx
je 0x47a06b
call edi
test eax, eax
je 0x47a062
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x47a062
test byte [ebp - 8], 1
jne 0x47a06b
or dword [ebp + 0x10], 0x200000
jmp 0x47a09e
mov eax, dword [0x4da464]
cmp eax, dword [ebp - 0x18]
je 0x47a09e
push eax
call esi
test eax, eax
je 0x47a09e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x47a09e
mov eax, dword [0x4da468]
cmp eax, dword [ebp - 0x18]
je 0x47a09e
push eax
call esi
test eax, eax
je 0x47a09e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4da460]
call esi
test eax, eax
je 0x47a0ba
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x47a0bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c8b9
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401020
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x1c
mov ebx, dword [ecx]
mov eax, dword [0x417008]
mov ecx, dword [0x41700c]
mov edx, dword [0x417004]
cmp ecx, eax
jb 0x401092
lea esi, [eax + eax]
mov dword [esp + 8], edx
add eax, esi
mov dword [esp + 4], 0
shl eax, 3
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapReAlloc]
sub esp, 0x10
mov edx, eax
test eax, eax
je 0x4010d0
mov dword [0x417004], eax
mov ecx, dword [0x41700c]
mov dword [0x417008], esi
lea eax, [ecx + ecx*2]
lea esi, [edx + eax*4]
lea eax, [esi + 4]
mov dword [esi], ebx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [0x4185f0]
add dword [0x41700c], 1
mov dword [esi + 8], eax
sub esp, 8
mov eax, 1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
xor eax, eax
jmp 0x4010bc
Function at 0x4016d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [eax + 4]
cmp eax, dword [section..bss]
je 0x401781
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernelbase.dll_OpenProcess]
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], 0
mov dword [esp], 0x100000
mov dword [ebp - 0x20], eax
call eax
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x401781
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x1c]
mov ecx, eax
mov eax, ebx
mov dword [esp], 0x11
call sym._send_messages_with_timeout_dialog.constprop.0
mov edx, dword [ebp - 0x1c]
cmp eax, 0xffffffff
mov esi, eax
je 0x401790
mov dword [esp + 4], eax
mov ecx, edi
mov eax, ebx
mov dword [esp], 0x16
call sym._send_messages_with_timeout_dialog.constprop.0
test esi, esi
je 0x4017b0
cmp eax, 0xffffffff
je 0x401790
mov dword [esp], edi
mov dword [esp + 4], 0
call dword [sym.imp.kernelbase.dll_WaitForSingleObject]
sub esp, 8
mov esi, eax
mov dword [esp], edi
mov edi, dword [sym.imp.kernelbase.dll_CloseHandle]
call edi
sub esp, 4
cmp esi, 0x102
je 0x4017c0
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
xor eax, eax
sub esp, 4
jmp 0x401786
mov eax, dword [ebx + 4]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
call eax
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x401781
test byte [global___dbch.0], 8
jne 0x401810
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], esi
call edi
sub esp, 4
jmp 0x401781
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], str.terminating_process__04lx_n
mov dword [esp + 8], str.send_end_session_messages
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch.0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x4017ed
Function at 0x401840
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
test byte [global___dbch.0], 8
je 0x4018b2
mov eax, str.WM_QUERYENDSESSION
cmp edx, 0x11
je 0x401882
cmp edx, 0x16
mov eax, str.WM_ENDSESSION
mov edx, str.Unknown
cmovne eax, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.received_response__s_hwnd__p_lresult__Id_n
mov dword [esp + 8], global___func__.2
mov dword [esp + 4], global___dbch.0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test esi, esi
je 0x4018e8
mov edx, dword [ebx + 8]
xor eax, eax
test edx, edx
setne al
mov esi, eax
mov eax, dword [ebx]
mov dword [ebx + 8], esi
lea edx, [eax - 1]
mov dword [ebx], edx
test eax, eax
jne 0x4018d7
mov eax, dword [ebx + 4]
test eax, eax
jne 0x401938
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], edi
call dword [0x4185f8]
sub esp, 4
test eax, eax
jne 0x4018c2
test byte [global___dbch.0], 8
je 0x4018b6
mov dword [esp + 0xc], str.window_was_destroyed__ignoring_FALSE_lresult_n
mov dword [esp + 8], global___func__.2
mov dword [esp + 4], global___dbch.0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov ecx, dword [ebx + 8]
xor eax, eax
test ecx, ecx
setne al
mov esi, eax
jmp 0x4018c2
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
Function at 0x401970
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov esi, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
cmp eax, 0x110
je 0x4019d0
cmp eax, 0x111
jne 0x4019bc
mov dword [esp], ebx
mov dword [esp + 4], 8
call dword [0x4185ec]
sub esp, 8
mov ebx, eax
cmp esi, 1
je 0x401a30
cmp esi, 2
je 0x401a10
xor eax, eax
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 8
call dword [0x418618]
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], 1
call dword [0x41861c]
mov eax, 1
sub esp, 8
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [eax + 4], 1
lea esp, [ebp - 0xc]
mov eax, 1
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
call dword [sym.imp.kernelbase.dll_OpenProcess]
mov esi, eax
sub esp, 0xc
mov eax, 1
test esi, esi
je 0x4019be
test byte [global___dbch.0], 8
jne 0x401aa0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_CloseHandle]
mov dword [ebx + 8], 1
mov eax, 1
sub esp, 4
jmp 0x4019be
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], str.terminating_process__04lx_n
mov dword [esp + 8], str.endtask_dlg_proc
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch.0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401a69