joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c79
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call sym.___pthread_self_lite
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.__pthread_cleanup_dest
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x413cd4
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x42b078]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x413dfe
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x413d66
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x413d23
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x42b078]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x413dfe
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x413d96
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x413dfe
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x42b078]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x415728
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x42b088
call sym._pthread_spin_lock
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x415754
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x415796
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x42b088
call sym._pthread_spin_unlock
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x41ce10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
call dword [esp + 0x20]
jmp method.__cxxabiv1.__terminate_void________clone_.cold_

Function at 0x41d420
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x42b108], 0
jne 0x41d546
mov byte [0x42b108], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41d514
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41d504
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x42c1e5
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x429860
jmp 0x429858
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x41d4ca
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x429853
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x424710
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
mov dword [ebp - 0xc], 1
jmp 0x42477b
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shr eax, 0x1e
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x6c078965
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__624u__1u__0u__unsigned_int_
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x26f
jbe 0x424732
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x9c0], 0x270
nop
leave
ret 4

Function at 0x4247dc
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x9c0]
cmp eax, 0x26f
jbe 0x4247ff
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.004245b0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x9c0]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x9c0], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shr eax, 0xb
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 7
and eax, 0x9d2c5680
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 0xf
and eax, 0xefc60000
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shr eax, 0x12
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x429cb0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0x42b0e8
call sym._pthread_mutex_init
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x42b0ec], 0
mov dword [0x42b0f0], 0
mov dword [0x42b0f4], 0
call sym._getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x429d46
jmp 0x429e07
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
je 0x429dc0
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x429d30
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x429d30
cmp byte [ebx + 0xf], 0x2e
jne 0x429d30
add ebx, 0x10
lea esi, [esp + 0x18]
lea ebp, [esp + 0x30]
mov edi, dword [esi]
mov eax, dword [esi + 4]
test edi, edi
je 0x429da7
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x429db1
cmp byte [ebx + edi], 0x3d
je 0x429e35
add esi, 0xc
cmp esi, ebp
jne 0x429d8a
jmp 0x429d30
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x42b0f4], ebx
test ebx, ebx
jne 0x429e16
mov dword [esp], sym.___tcf_0
call sym._atexit
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x42b0f4], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x42b0f0], eax
test eax, eax
je 0x429e73
xor edx, edx
mov dword [0x42b0ec], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x429df3
lea eax, [esp + 0x14]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x429e63
test dl, dl
jne 0x429d30
test eax, eax
js 0x429d30
mov dword [esi + 8], eax
jmp 0x429d30
xor ecx, ecx
mov dword [0x42b0f4], ecx
jmp 0x429df3
Function at 0x4681ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468063

Function at 0x40217c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40218b
pop dword [ebp - 0x10]
mov eax, 0x30883b35
sub eax, 0x304819aa
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x43ff9f7e
add dword [ebp - 0x20], 0xa52a5cd
mov dword [ebp - 0x1c], 0x90c1c4b0
sub dword [ebp - 0x1c], 0x5e8e786b
mov dword [ebp - 0x18], 0x65691ace
sub dword [ebp - 0x18], 0x191cd6a0
mov dword [ebp - 0x14], 0x620307c0
sub dword [ebp - 0x14], 0x620307c0
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9e8b68ff
add eax, 0x61b6c775
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xc3e32be3
sub dword [ebp - 0x20], 0x4f70c28d
mov dword [ebp - 0x1c], 0x2a833736
add dword [ebp - 0x1c], 0x16e92a3f
mov dword [ebp - 0x18], 0x49358d08
add dword [ebp - 0x18], 0x1a39df64
mov dword [ebp - 0x14], 0x72fe7518
add dword [ebp - 0x14], 0x8d018ae8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xea03233c
add eax, 0x163f0de8
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ec30
push 0
call eax
mov ecx, 0x3356082b
sub ecx, 0x3355bbe8
mov edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x10]
mov edi, 0xeece4872
xor dword [ebp - 8], ecx
mov esi, dword [ebx]
sub dword [ebp - 4], 0xe05da40e
xor esi, edi
sub dword [ebp - 8], esi
mov dword [edx], esi
mov dword [ebp - 0xc], 0xc7e41bef
add edx, 0xaa80f2f6
add edx, 0x557f0d0e
add ebx, 0x2e4f3f87
add ebx, 0xd1b0c07d
loop 0x4022a1
add eax, 0x3f267882
sub eax, 0x3f2554a3
xor ebx, ebx
add ebx, eax
add eax, 0x135ca49f
sub eax, 0x135ca49a
mov ecx, 0xd433cd56
sub ecx, 0xd3f3cd56
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x1002ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
and esi, 0xfffffffc
je 0x1002edcb
lea eax, [esi - 1]
mov edi, eax
shr edi, 2
add edi, 1
mov ecx, edi
and ecx, 3
cmp eax, 0xc
jae 0x1002ed40
xor eax, eax
xor ebx, ebx
jmp 0x1002ed8b
and edi, 0xfffffffc
neg edi
xor eax, eax
xor ebx, ebx
nop dword [eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 4
jne 0x1002ed50
test ecx, ecx
je 0x1002eda9
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1002ed96
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1002edc6
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
add esi, 1
cmp edi, esi
jne 0x1002edb0
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1002eda9

Function at 0x1002ff22
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1002ff31
pop dword [ebp - 0x38]
mov eax, 0x308a8e89
sub eax, 0x20878f58
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x39f20
push 0
mov eax, 0x1f7d45ed
sub eax, 0xf759745
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x9d1ec80b
sub ecx, 0x9d1e7561
xor esi, esi
add esi, eax
mov edx, 0x10085e00
add edx, dword [ebp - 0x38]
mov ebx, 0x5bc91469
sub ebx, 0x58031b1e
xor dword [ebp - 4], ecx
mov edi, dword [edx]
xor dword [ebp - 8], ecx
xor edi, ebx
sub dword [ebp - 0x28], ecx
mov dword [esi], edi
mov dword [ebp - 0x2c], 0xf2e2dcd3
add esi, 4
add edx, 4
loop 0x1002ff8c
add eax, 0xf2681f89
sub eax, 0xf266e20e
mov ebx, eax
add eax, 0x2882fc2
add eax, 0xfd77d043
mov ecx, 0xeaa12c45
add ecx, 0x255ed3bb
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x548208
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54831e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405934
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x5482fd
mov eax, pe_nt_image_headers32
call fcn.00402d98
mov dword [ebp - 0xc], eax
push pe_nt_image_headers32
mov esi, dword [ebp - 0xc]
push esi
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x5482eb
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, pe_nt_image_headers32
call fcn.00405ba4
push esi
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx esi, word [eax + 0xa]
dec esi
test esi, esi
jl 0x5482ca
inc esi
xor edi, edi
push dword [ebx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + edi]
lea edx, [ebp - 0x1a0]
call fcn.0040a8f4
push dword [ebp - 0x1a0]
push 0x548334
mov eax, ebx
mov edx, 3
call fcn.00405cb8
inc edi
dec esi
jne 0x548296
mov eax, dword [ebx]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x5482e1
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406080
mov edx, pe_nt_image_headers32
mov eax, dword [ebp - 0xc]
call fcn.00402db4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548325
lea eax, [ebp - 0x1a0]
call fcn.00405934
lea eax, [ebp - 4]
call fcn.00405934
ret
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001ba36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001ba45
pop dword [ebp - 0x40]
mov eax, 0xd5664abf
add eax, 0x3a9b6f86
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x363bc
push 0
mov eax, 0xb707e4a5
add eax, 0x58f9fcbf
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x16660f7b
add ecx, 0xe99a2ce0
mov edi, eax
mov ebx, 0x10043e00
add ebx, dword [ebp - 0x40]
mov edx, 0x55f58577
sub edx, 0x86e37c35
xor dword [ebp - 0x28], 0x72137639
mov esi, dword [ebx]
xor dword [ebp - 8], ebx
add esi, edx
mov dword [ebp - 8], 0xdd2b20ac
mov dword [edi], esi
xor dword [ebp - 0x3c], ecx
add edi, 4
add ebx, 4
loop 0x1001ba9e
add eax, 0x68f978f4
sub eax, 0x68f894b5
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x6fa835f0
Capabilities:
Delete file
Delete registry value
Get common file path

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x230
test byte [0x6fa99048], 8
jne 0x6fa836c0
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edx, ebx
sub esp, 8
cmp word [ebp - 0x210], 0
je 0x6fa83649
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x6fa83640
xor eax, eax
mov ecx, 0x5c
jmp 0x6fa8365f
movzx ecx, word [eax + str.winevulkan.json]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6fa83658
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteFileW]
lea eax, [ebp - 0x214]
sub esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareKhronosVulkanDrivers
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x6fa836f0
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x6fa9b278
mov dword [esp + 8], str.DllUnregisterServer
mov dword [esp + 4], 0x6fa99048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6fa83612
mov eax, dword [ebp - 0x214]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x214]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x6fa84250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6fa842ab
cmp byte [esi + ebx - 1], 0xa
je 0x6fa8427f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6fa99138], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6fa84650
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x1c
mov eax, dword [eax]
cmp eax, 0x10de
je 0x6fa84678
cmp eax, 0x1002
je 0x6fa846b0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WINE_HIDE_NVIDIA_GPU
call dword [sym.imp.ucrtbase.dll_getenv]
test eax, eax
je 0x6fa846a0
cmp byte [eax], 0x30
je 0x6fa846a0
mov dword [ebx], 0x1002
mov dword [esi], 0x73df
jmp 0x6fa8466d
mov eax, dword [ebx]
cmp eax, 0x1002
jne 0x6fa8466d
lea esi, [esi]
mov dword [esp], str.WINE_HIDE_AMD_GPU
mov edi, dword [sym.imp.ucrtbase.dll_getenv]
call edi
test eax, eax
je 0x6fa846e0
cmp byte [eax], 0x30
je 0x6fa846e0
mov dword [ebx], 0x10de
mov dword [esi], 0x2487
jmp 0x6fa8466d
cmp dword [ebx], 0x1002
jne 0x6fa8466d
cmp dword [esi], 0x163f
jne 0x6fa8466d
mov dword [esp], str.WINE_HIDE_VANGOGH_GPU
call edi
test eax, eax
je 0x6fa8466d
cmp byte [eax], 0x30
je 0x6fa8466d
mov dword [esi], 0x687f
jmp 0x6fa8466d
Function at 0x4030f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47f020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40318c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40316c
xor eax, eax
push ebp
push 0x403165
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40316c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47f020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47f020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e40
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48204c], 0
je 0x403ea1
cmp word [0x482220], 0xd7b2
jne 0x403e69
cmp dword [0x482228], 0
jbe 0x403e69
mov eax, 0x48221c
call dword [0x482238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47f06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ec8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47f030], 0
jne 0x403ebd
push 0
push 0x47f064
push 0x47f06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404014
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402778
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x48204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403fdc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc