joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ac20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1001b0c0]
test eax, eax
je 0x1000acd8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x1000ac60
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000ac4c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000ad0d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1001b0c0], eax
sub esp, 8
test eax, eax
jne 0x1000ac3d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000ac4e
Function at 0x1000ad20
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000aeb0
mov eax, dword [esi]
test eax, eax
je 0x1000ae98
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000aebc
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000ae88
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1000ae4c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x1000ad86
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000aeb2
Function at 0x412bdb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412a5a

Function at 0x416f3f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004168ad

Function at 0x416f4a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416ae8

Function at 0x10010dc
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x1002040
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x100110e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2713
call fcn.01001439
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x10010ac
jmp 0x1001121
cmp al, 0x73
jne 0x1001142
xor ebx, ebx
inc ebx
push esi
push edi
push dword [ebp + 8]
call fcn.01001475
cmp eax, 0xffffffff
jne 0x100111a
mov eax, dword [0x1002004]
cmp dword [edi + eax*4], 0
je 0x1001154
push 0x2714
jmp 0x1001147
push 0x2710
push 2
call fcn.010013ca
pop ecx
pop ecx
push 1
jmp 0x10011d0
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jge 0x100117d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2712
call fcn.01001439
jmp 0x1001150
test ebx, ebx
je 0x1001199
lea eax, [ebp - 0x400]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x1001199
and byte [eax], 0
lea eax, [ebp - 0x400]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011a2
sub eax, edx
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.msvcrt.dll_puts]
pop ecx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x447b16
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x447b25
pop dword [ebp - 0xc]
mov eax, 0x68a2224d
add eax, 0x97a258d8
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x56847
push 0
mov eax, 0xb0361968
sub eax, 0xaff166ac
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xcc27a440
sub ecx, 0xcc2741b8
mov esi, eax
mov edi, 0x487e00
add edi, dword [ebp - 0xc]
mov ebx, 0xf6416bc
mov edx, dword [edi]
xor dword [ebp - 4], eax
xor edx, ebx
sub dword [ebp - 4], 0xee78657e
mov dword [esi], edx
sub dword [ebp - 4], 0x247aecda
add esi, 4
add edi, 0x906cbbe6
sub edi, 0x906cbbe2
loop 0x447b78
add eax, 0x1e04effd
sub eax, 0x1e03730a
xor ebx, ebx
add ebx, eax
add eax, 0x6a1e0d45
sub eax, 0x6a1e0d40
mov ecx, 0xdb3f9882
add ecx, 0x2500677e
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x100034b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym._main_loop_func_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [section..bss], eax
sub esp, 0x18
test eax, eax
je 0x10003559
mov dword [esp + 4], 0xf
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
sub esp, 8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
test byte [0x10016090], 2
jne 0x10003575
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0x80004005
sub esp, 4
jmp 0x10003554
mov dword [esp + 0xc], str.Failed_to_create_main_loop_thread_n
mov dword [esp + 8], str.main_loop_start
mov dword [esp + 4], 0x10016090
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x10003562

Function at 0x10003c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [esp + 4], str.audio_client_main
mov dword [esp], 0xfffffffe
call dword [sym.imp.kernel32.dll_SetThreadDescription]
mov eax, dword [ebp + 8]
mov edx, dword [0x1002590c]
sub esp, 8
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov eax, dword [0x10025908]
mov dword [esp + 8], 2
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ntdll.dll___wine_unix_call]
sub esp, 0x10
test eax, eax
jne 0x10003ca8
leave
xor eax, eax
ret 4
mov dword [esp + 8], 0x45
mov dword [esp + 4], 0x100187a4
mov dword [esp], 0x100187e2
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]
lea edi, [edi]

Function at 0x100068ca
Capabilities:
Get file version info

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ecx
sub esp, 0x24
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov esi, dword [ecx]
mov edx, dword [0x1002590c]
mov dword [esp + 8], 5
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [0x10025908]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ntdll.dll___wine_unix_call]
sub esp, 0x10
test eax, eax
jne 0x10006920
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0xc]
pop ecx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 8], 0x45
mov dword [esp + 4], 0x100187a4
mov dword [esp], 0x100187e2
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]
Function at 0x10007e10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x18
mov esi, dword [ebp + 0xc]
test byte [0x10016114], 8
jne 0x10007e98
test esi, esi
je 0x10007f58
mov dword [esp], 0xc
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x10007f62
mov dword [eax], esi
mov dword [esp], 0x100160e0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [0x100160fc]
lea eax, [ebx + 4]
mov dword [ebx + 4], 0x100160f8
sub esp, 4
mov dword [ebx + 8], edx
mov dword [edx], eax
mov dword [0x100160fc], eax
mov eax, dword [0x10025004]
test eax, eax
je 0x10007ed0
mov dword [esp], 0x100160e0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0x100190e9
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MMDevEnum_RegisterEndpointNotificationCallback
mov dword [esp + 4], 0x10016114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x10007e24
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._notif_thread_proc_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x10025004], eax
sub esp, 0x18
test eax, eax
jne 0x10007e78
test byte [0x10016114], 2
je 0x10007e78
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.CreateThread_failed:__lu_n
mov dword [esp + 8], str.MMDevEnum_RegisterEndpointNotificationCallback
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10016114
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_3
jmp 0x10007e78
mov eax, 0x80004003
jmp 0x10007e8a
mov eax, 0x8007000e
jmp 0x10007e8a
Function at 0x1000c7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov ebx, dword [ebp + 8]
test byte [0x10016114], 8
jne 0x1000c8d8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000c90c
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x78]
mov edx, dword [eax + 0x24]
add eax, 0x2c
call sym._MMDevPropStore_OpenPropKey
test eax, eax
js 0x1000c898
mov eax, dword [ebp + 0xc]
xor ebx, ebx
lea edi, [ebp - 0x74]
lea esi, [ebp - 0x70]
mov dword [eax], 0
jmp 0x1000c833
add ebx, 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x32
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
je 0x1000c830
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x10016114], 8
jne 0x1000c8a8
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Returning__li_n
mov dword [esp + 8], str.MMDevPropStore_GetCount
mov dword [esp + 4], 0x10016114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000c891
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x100190e9
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.MMDevPropStore_GetCount
mov dword [esp + 4], 0x10016114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000c7fc
mov eax, 0x80004003
jmp 0x1000c898
Function at 0x1000c920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov dword [ebp - 0x78], 0x32
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
test byte [0x10016114], 8
jne 0x1000ca18
test esi, esi
je 0x1000ca8e
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x74]
mov edx, dword [eax + 0x24]
add eax, 0x2c
call sym._MMDevPropStore_OpenPropKey
mov ebx, eax
test eax, eax
js 0x1000ca05
lea eax, [ebp - 0x78]
lea edi, [ebp - 0x70]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x1000ca50
cmp dword [ebp - 0x78], 0x27
jbe 0x1000ca50
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
mov word [ebp - 0x24], ax
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [ebp - 0x22]
sub esp, 8
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcstol]
mov dword [esi + 0x10], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__p_____lu__p__n
mov dword [esp + 8], str.MMDevPropStore_GetAt
mov dword [esp + 4], 0x10016114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000c946
mov ebx, 0x80070057
test byte [0x10016114], 4
je 0x1000ca05
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.GetAt__lu_failed_n
mov dword [esp + 8], str.MMDevPropStore_GetAt
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10016114
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000ca05
mov ebx, 0x80004003
jmp 0x1000ca05
Function at 0x10014d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10014d98
cmp byte [esi + ebx - 1], 0xa
je 0x10014d6c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100258c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x100153c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10015598
mov edi, dword [0x100258c4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100154a7
test byte [0x100162a8], 8
jne 0x10015540
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100162b8], 8
jne 0x10015500
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10015449
cmp esi, 3
jbe 0x100154b8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1001545a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1001f4e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0_1
jmp 0x10015449
mov dword [esp], 0x100162b8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10015420
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10015420
mov dword [esp], 0x100162a8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1001540b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10015413
mov eax, 0xffffffff
jmp 0x100154a7
Function at 0x10015630
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100258e0]
test eax, eax
je 0x100156e8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10015670
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1001565c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1001571d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100258e0], eax
sub esp, 8
test eax, eax
jne 0x1001564d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1001565e
Function at 0x10015730
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x100158c0
mov eax, dword [esi]
test eax, eax
je 0x100158a8
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x100158cc
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10015898
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1001585c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10015796
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x100158c2