joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b3f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x45b403
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.0045ec20
add esp, 4
test eax, eax
jne 0x45b415
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x45b48c
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x45b4be
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x45b478
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x45b448
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x45b4be
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x45b4be
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x45b4a7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x45b4d0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x45b4fa
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x45b4fa
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret

Function at 0x45c620
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0046bcbb
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x45c68a
push esi
lea edi, [eax + 0x400]
call fcn.0046bce4
push edi
call fcn.0046bcbb
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x45c65a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45c6a6
push ecx
push esi
call fcn.0045e390
add esp, 8
mov ebx, eax
push esi
call fcn.0046bce4
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x45dee0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x45df72
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x45df64
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x45df5c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x45df25
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x46e689
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46e6cb
call fcn.004719d6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46e6cb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46e6c2
xor eax, eax
jmp 0x46e6d3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046e6d9
pop edi
pop esi
pop ebx
ret 4
Function at 0x46f667
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x473288
call fcn.004614b0
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004719d6
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x46f6a6
call fcn.004719d6
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x46f6b4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46f6c2
or eax, 0xffffffff
jmp 0x46f7aa
mov ecx, esi
call fcn.0046f5dd
mov dword [ebp - 0x14], eax
call fcn.0046ccd0
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x46f6f9
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x46f6f9
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0046cc84
push dword [ebp - 0x14]
call fcn.0046c7b6
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0046f375
cmp eax, edi
je 0x46f76c
test byte [esi + 0x24], 0x10
je 0x46f73a
push 4
mov ecx, esi
pop ebx
call fcn.0046c1b6
test ah, 1
je 0x46f732
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0046e7db
cmp dword [esi + 0x1c], edi
je 0x46f76c
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0046c1ea
jmp 0x46f76c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x46f780
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x46f799
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x46f799
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0046f617
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x47154d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47157b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471599
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004714b3
jmp 0x471599
mov eax, dword [esi + 0x14]
test eax, eax
je 0x471599
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004714b3
test edi, edi
mov eax, edi
jne 0x471583
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405a12
pop dword [ebp - 0x2c]
mov eax, 0xd2c02c70
add eax, 0x2d802da2
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xc85baec1
sub dword [ebp - 0x3c], 0x7a096976
mov dword [ebp - 0x38], 0xe797f297
sub dword [ebp - 0x38], 0xb564a652
mov dword [ebp - 0x34], 0x10948a34
sub dword [ebp - 0x34], 0xc4484606
mov dword [ebp - 0x30], 0x71ac1e9f
add dword [ebp - 0x30], 0x8e53e161
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x97997386
add eax, 0x68a70d7e
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x472cd244
add dword [ebp - 0x3c], 0x2d459712
mov dword [ebp - 0x38], 0x5f2a3a74
add dword [ebp - 0x38], 0xe2422701
mov dword [ebp - 0x34], 0x621ffb5d
sub dword [ebp - 0x34], 0xfeb08ef1
mov dword [ebp - 0x30], 0xbc3051e8
add dword [ebp - 0x30], 0x43cfae18
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x19b61dd
sub eax, 0x15ae0dd
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x35220
push 0
call eax
mov ecx, 0x409c
mov ebx, eax
mov esi, 0x6839f91e
sub esi, 0x67f3151e
add esi, dword [ebp - 0x2c]
mov edi, 0x24c42875
sub edi, 0xe2c704ee
add dword [ebp - 0x28], 0xe8d1d6ad
mov edx, dword [esi]
xor dword [ebp - 0x18], eax
add edx, edi
add dword [ebp - 0x24], 0xf919125b
mov dword [ebx], edx
sub dword [ebp - 0x28], ebx
add ebx, 0x294d3ca5
sub ebx, 0x294d3ca1
add esi, 0xe4ac448a
add esi, 0x1b53bb7a
loop 0x405b2e
add eax, 0xf543
xor ebx, ebx
add ebx, eax
add eax, 0x597a59b6
sub eax, 0x597a59b1
mov ecx, 0xd6ddaf12
add ecx, 0x296250ee
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x401060
Capabilities:
Write file on windows

Disassembly:
cmp word [eax], 0
je 0x4011a8
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
add edx, 2
cmp word [edx], 0
jne 0x401075
mov esi, edx
sub esi, eax
sar esi, 1
cmp eax, edx
je 0x4010c3
mov ebx, eax
mov dword [esp], 0xfffffff5
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
call edi
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4010cb
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x20], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4010c3
mov edx, dword [ebp - 0x20]
call edx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
lea ebx, [ebp - 0x10]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call edi
mov edi, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4010c3
ret
Function at 0x401200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1020
call fcn.00403a48
sub esp, eax
mov edi, edx
lea ebx, [ebp - 0x100c]
mov eax, dword [esp + eax]
mov dword [esp], 0
mov esi, eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x67
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x401261
test byte [0x404000], 2
jne 0x40131f
mov eax, ebx
call dbg.output
mov eax, 0x40601e
call dbg.output
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], edi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1010]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x3100
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
test eax, eax
jne 0x4012f8
test byte [0x404000], 2
jne 0x4012d2
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.FormatMessage_failed_n
mov dword [esp + 8], str.fatal_error
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.4
jmp 0x4012c5
mov eax, dword [ebp - 0x1010]
call dbg.output
mov eax, dword [ebp - 0x1010]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
push eax
mov eax, 0x40603a
call dbg.output
jmp 0x4012c5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.LoadString_failed__error__ld_n
mov dword [esp + 8], str.fatal_string_error
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.4
jmp 0x401261

Function at 0x401360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push eax
mov eax, 0x1010
call fcn.00403a48
sub esp, eax
lea ebx, [ebp - 0x1008]
mov eax, dword [esp + eax]
mov dword [esp], 0
mov esi, eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x4013b6
test byte [0x404000], 2
jne 0x4013ca
mov eax, ebx
call dbg.output
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.LoadString_failed__error__ld_n
mov dword [esp + 8], str.fatal_string
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.4
jmp 0x4013b6
Function at 0x403100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x403158
cmp byte [ebx + esi - 1], 0xa
je 0x40312c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4070e4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x403770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x403934
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x4070e4]
cmp dword [edx + 0x24], edi
je 0x403857
test byte [0x404018], 8
jne 0x4038e0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x404028], 8
jne 0x4038a3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4037f9
cmp esi, 3
jbe 0x403862
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x40380a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x406428]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x4037f9
mov dword [esp], 0x404028
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x4037d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x4037d0
mov dword [esp], 0x404018
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x4037bb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x4037c3
mov eax, 0xffffffff
jmp 0x403857

Function at 0x4039a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x40a3d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41d5b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41d5b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40a425
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40a41e
test esi, esi
je 0x40a41e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40a400
mov dword [esp], 0x41d5b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40a680
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40a6b8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40a6ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40a6ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40a6a0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x6e0328], 1
mov dword [0x6e032c], 1
mov dword [0x6e0330], 1
mov dword [0x6e031c], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401415
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401438
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40145a
cmp eax, 0x20b
je 0x40147f
jmp 0x4014aa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146c
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401497
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, 0
leave
ret

Function at 0x4053b0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x14
test edx, edx
je 0x4053c7
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fflush
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40c410
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov eax, dword [0x6e009c]
test eax, eax
je 0x40c490
test ecx, ecx
je 0x40c470
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
mov ecx, ebx
mov edx, eax
call fcn.0040c1e0
mov dword [esp], eax
mov ebx, edx
mov dword [esp + 4], edx
call dword [0x6e009c]
sub esp, 8
test ebx, ebx
je 0x40c454
test dword [ebx], 0x40000000
je 0x40c4d0
mov dword [esp], 0x4481cc
call fcn.00438340
cmp byte [eax], 0
jne 0x40c4f0
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0
mov dword [esp + 4], 0
call eax
sub esp, 8
jmp 0x40c454
mov esi, edx
mov dword [esp], 2
call dword [0x448690]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov edi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
mov dword [esp], edi
call sub.msvcrt.dll_fflush
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x4481dc
call fcn.00438340
mov edx, ebx
mov ecx, eax
call fcn.00407130
jmp 0x40c454
mov byte [eax], 0
mov dword [esp], 0x44814c
call fcn.00438340
mov ecx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov dword [esp], 0
call fcn.00409840
sub esp, 4
jmp 0x40c469
Function at 0x40f680
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [esp + 0x1c], edx
mov dword [esp], 0x6e0080
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
test edi, edi
jle 0x40f700
mov dword [esp], 0x4481cc
xor esi, esi
call fcn.00438340
mov ebp, dword [fcn.0043dd3c]
mov edi, eax
jmp 0x40f6cc
add esi, 1
add ebx, 8
cmp dword [esp + 0x1c], esi
je 0x40f706
mov dword [esp], 1
call ebp
mov dword [esp + 8], 0
mov edx, dword [ebx + 4]
mov ecx, eax
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040f570
sub esp, 0xc
cmp byte [edi], 0
je 0x40f6c0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [fcn.0043dd3c]
mov dword [esp], 1
call ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x44931d
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call ebp
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x6e0080
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret