joyce8/EMBER2024-capa huggingface dataset:
Function at 0x692c1550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, 3
mov edi, dword fs:[0x18]
sub esp, 0x6c
mov eax, dword [esi + 8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
jne 0x692c1638
cmp dword [edi + 0x34], 0x20
jne 0x692c15d0
sub ebx, 1
je 0x692c15d0
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
jmp 0x692c1567
test byte [0x692d10ac], 8
jne 0x692c15e8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, dword [esi + 8]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_update__s__error__lu_n
mov dword [esp + 8], str.update_job_status
mov dword [esp + 4], 0x692d10ac
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], eax
mov dword [ebp - 0x4c], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov edx, dword [ebp - 0x4c]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x692c1680
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x692c15d9
mov eax, dword [esi + 0x50]
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [ebp - 0x36], eax
mov eax, dword [esi + 0x54]
mov dword [esp + 8], 0x1e
mov dword [ebp - 0x32], eax
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x2e], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x2a], eax
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x26], eax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x22], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x1e], eax
movzx eax, word [esi + 0x6c]
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x36]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x4c]
sub esp, 0x14
jmp 0x692c1667
Function at 0x692c5680
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
test byte [0x692d10ac], 8
jne 0x692c57bb
mov dword [esp], 0x692d1080
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
cmp esi, dword [ebp + 0x10]
ja 0x692c57b1
nop
lea esi, [esi]
mov ebx, dword [0x692d10a0]
cmp ebx, 0x692d10a0
jne 0x692c56e6
jmp 0x692c5780
mov ebx, dword [ebx]
cmp ebx, 0x692d10a0
je 0x692c5780
cmp dword [ebx + 0x14], esi
jne 0x692c56d8
mov eax, dword [ebx + 8]
test byte [0x692d10ac], 8
jne 0x692c5730
mov dword [esp], eax
call edi
sub esp, 4
test eax, eax
je 0x692c5771
add esi, 1
cmp dword [ebp + 0x10], esi
jae 0x692c56c0
xor ebx, ebx
mov dword [esp], 0x692d1080
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.deleting_job__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.NetrJobDel
mov dword [esp + 4], 0x692d10ac
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov eax, dword [ebx + 8]
mov dword [esp], eax
call edi
sub esp, 4
test eax, eax
jne 0x692c5703
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
jmp 0x692c570d
test byte [0x692d10ac], 8
je 0x692c57b1
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.job__lu_not_found_n
mov dword [esp + 8], str.NetrJobDel
mov dword [esp + 4], 0x692d10ac
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov ebx, 0xede
jmp 0x692c570d
mov eax, dword [ebp + 8]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], str._s__lu__lu_n
mov dword [esp + 8], str.NetrJobDel
mov dword [esp + 4], 0x692d10ac
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x692c5699
Function at 0x692c5c00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
cmp word [eax], 0
je 0x692c5d20
mov ebx, eax
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x692c5c18
sub eax, ebx
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x692c5d3d
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [ebx + eax]
mov word [edi + eax], cx
add eax, 2
test cx, cx
jne 0x692c5c40
cmp word [edi], 0
je 0x692c5c8c
mov ecx, edi
nop
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x692c5c60
mov eax, ecx
sub eax, edi
sar eax, 1
cmp edi, ecx
jne 0x692c5c84
jmp 0x692c5c8c
xor ebx, ebx
mov word [edi + eax*2 - 2], bx
sub eax, 1
je 0x692c5c8c
cmp word [edi + eax*2 - 2], 0x5c
je 0x692c5c78
mov esi, dword fs:[0x18]
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x692c5d10
mov ecx, dword [esi + 0x34]
cmp ecx, 3
jne 0x692c5ce8
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov ebx, eax
test eax, eax
je 0x692c5d18
xor ecx, ecx
mov word [eax], cx
mov eax, edi
call sym._create_directory
test eax, eax
jne 0x692c5cf5
mov edx, 0x5c
mov word [ebx], dx
jmp 0x692c5c93
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x692c5cf5
mov eax, 0x80070003
jmp 0x692c5cf5
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x692c5d3d
xor eax, eax
mov word [edi], ax
jmp 0x692c5c8c
mov eax, 0x8007000e
jmp 0x692c5d04
Function at 0x692c5d50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
mov edi, dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov ecx, eax
sub esp, 8
mov eax, str._tasks_
nop
add eax, 2
cmp word [eax], 0
jne 0x692c5d80
sub eax, str._tasks_
sar eax, 1
cmp word [ebx], 0
mov edx, eax
je 0x692c5daf
mov edx, ebx
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x692c5da0
sub edx, ebx
sar edx, 1
add edx, eax
add ecx, edx
lea eax, [ecx + ecx]
mov dword [ebp - 0x1c], ecx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, eax
test eax, eax
je 0x692c5e70
mov ecx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], ecx
call edi
mov edx, dword [ebp - 0x1c]
sub esp, 8
cmp word [edx], 0
mov ecx, edx
je 0x692c5df9
mov esi, esi
lea edi, [edi]
add ecx, 2
cmp word [ecx], 0
jne 0x692c5df0
xor eax, eax
nop
lea esi, [esi]
movzx edi, word [eax + str._tasks_]
mov word [ecx + eax], di
add eax, 2
test di, di
jne 0x692c5e00
movzx ecx, word [edx]
test esi, esi
je 0x692c5e43
test cx, cx
je 0x692c5e7a
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x692c5e28
sub eax, edx
sub eax, 2
add eax, edx
mov dword [esi], eax
cmp word [ebx], 0x5c
jne 0x692c5e49
add ebx, 2
cmp word [ebx], 0x5c
je 0x692c5e40
test cx, cx
mov ecx, edx
je 0x692c5e59
add ecx, 2
cmp word [ecx], 0
jne 0x692c5e50
xor eax, eax
nop
lea esi, [esi]
movzx esi, word [ebx + eax]
mov word [ecx + eax], si
add eax, 2
test si, si
jne 0x692c5e60
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xfffffffe
jmp 0x692c5e36
Function at 0x692c8560
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x692d10c0], 8
jne 0x692c8638
test esi, esi
jne 0x692c867a
movzx eax, word [ebx]
cmp ax, 0x2f
je 0x692c8598
cmp ax, 0x5c
jne 0x692c85ab
nop
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 0x5c
je 0x692c8598
cmp ax, 0x2f
je 0x692c8598
test ax, ax
je 0x692c8670
mov eax, ebx
xor edx, edx
call sym._get_full_name
mov ebx, eax
test eax, eax
je 0x692c8684
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
je 0x692c85f0
xor esi, esi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword fs:[0x18]
mov esi, dword [edi + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
cmp esi, 0x8007010b
jne 0x692c85d9
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x692c85d7
mov esi, dword [edi + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
jmp 0x692c85d9
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s__lx_n
mov dword [esp + 8], str.SchRpcDelete
mov dword [esp + 4], 0x692d10c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x692c857c
mov esi, 0x80070005
jmp 0x692c85e2
mov esi, 0x80070057
jmp 0x692c85e2
mov esi, 0x8007000e
jmp 0x692c85e2
Function at 0x692cb610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.rpcrt4.dll_NdrPointerFree]
mov dword [esp + 8], 0x692d5552
mov eax, dword [ebx + 0x138]
lea edi, [ebx + 0x58]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d5546
mov eax, dword [ebx + 0x13c]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d554e
mov eax, dword [ebx + 0x14c]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x692cbdf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xf0]
lea ebx, [ebp - 0x148]
sub esp, 0x154
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str._V_ip
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_NdrServerInitializeNew]
xor eax, eax
mov dword [ebp - 0x144], sym.___widl_exception_handler_1
mov dword [ebp - 0x140], sym.___server_filter_1
sub esp, 0xc
mov dword [ebp - 0x13c], sym.___finally_ITaskSchedulerService_SchRpcHighestVersion
mov word [ebp - 0xf4], ax
mov byte [ebp - 0xf2], 0
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0]
mov dword [ebx], eax
mov dword fs:[0], ebx
movzx eax, byte [ebp - 0xf3]
mov dword [esp + 4], ebx
add eax, 1
mov byte [ebp - 0xf2], al
lea eax, [ebp - 0x138]
mov dword [esp], eax
call sym.___wine_setjmpex
test eax, eax
jne 0x692cc021
movzx eax, byte [ebp - 0xf2]
test al, al
je 0x692cbfe8
add eax, 1
mov byte [ebp - 0xf3], al
mov eax, dword [ebp + 8]
cmp word [eax + 4], 0x10
je 0x692cbecb
lea eax, [ebp - 0xf0]
mov dword [esp + 4], 0x692d56e2
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_NdrConvert]
sub esp, 8
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xec], eax
ja 0x692cc021
cmp byte [ebp - 0xf2], 0
je 0x692cc010
lea eax, [ebp - 0x10]
mov byte [ebp - 0xf3], 0
mov dword [esp], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
call sym._SchRpcHighestVersion
mov dword [ebp - 0xdc], 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_I_RpcGetBuffer]
sub esp, 4
test eax, eax
jne 0x692cc02e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, ecx
mov dword [ebp - 0xec], ecx
neg eax
and eax, 3
je 0x692cbf53
xor edx, edx
mov byte [ecx + edx], 0
add edx, 1
cmp edx, eax
jb 0x692cbf48
mov eax, dword [ebp - 0xec]
mov edx, dword [ebp - 0xc]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0xec], eax
mov edx, dword [edx]
mov dword [eax], edx
mov eax, dword [ebp - 0xec]
lea edx, [eax + 4]
mov eax, edx
mov dword [ebp - 0xec], edx
neg eax
and eax, 3
mov ecx, eax
je 0x692cbf93
xor eax, eax
mov byte [edx + eax], 0
add eax, 1
cmp eax, ecx
jb 0x692cbf88
mov eax, dword [ebp - 0xec]
mov edx, dword [ebp - 0x14]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0xec], eax
mov dword [eax], edx
mov eax, dword [ebp - 0xec]
add eax, 4
cmp byte [ebp - 0xf3], 0
mov dword [ebp - 0xec], eax
jne 0x692cbfd4
mov eax, dword [ebp - 0x148]
mov dword fs:[0], eax
mov eax, dword [ebp - 0xec]
mov ebx, dword [ebp + 8]
sub eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov ebx, dword [ebp - 4]
leave
ret 4
lea eax, [ebp - 0x148]
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
movzx eax, byte [ebp - 0xf2]
jmp 0x692cbe9e
mov eax, dword [ebp - 0x148]
mov dword fs:[0], eax
jmp 0x692cbeea
mov dword [esp], 0x6f7
call dword [sym.imp.rpcrt4.dll_RpcRaiseException]
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcRaiseException]
mov esi, esi
lea edi, [edi]
Function at 0x692cc080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.rpcrt4.dll_NdrPointerFree]
mov dword [esp + 8], 0x692d5848
mov eax, dword [ebx + 0x138]
lea edi, [ebx + 0x58]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d584c
mov eax, dword [ebx + 0x13c]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d5850
mov eax, dword [ebx + 0x144]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov eax, dword [ebx + 0x14c]
sub esp, 0xc
mov dword [ebx + 0x94], eax
mov dword [esp + 8], 0x692d58a4
mov eax, dword [ebx + 0x150]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d58a8
mov eax, dword [ebx + 0x158]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d58dc
mov eax, dword [ebx + 0x160]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x692ce6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.rpcrt4.dll_NdrPointerFree]
mov dword [esp + 8], 0x692d5a22
mov eax, dword [ebx + 0x138]
lea edi, [ebx + 0x58]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d5a34
mov eax, dword [ebx + 0x13c]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0x692d5a38
mov eax, dword [ebx + 0x140]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
mov eax, dword [ebx + 0x150]
sub esp, 0xc
mov eax, dword [eax]
mov dword [ebx + 0x94], eax
mov dword [esp + 8], 0x692d5a52
mov eax, dword [ebx + 0x158]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x692d0250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x692d02a8
cmp byte [esi + ebx - 1], 0xa
je 0x692d027c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x692d80a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x692d0900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x692d0ad8
mov edi, dword [0x692d80a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x692d09e7
test byte [0x692d11e8], 8
jne 0x692d0a80
lea ebx, [ebp - 0xe0]
mov edi, ebx
test byte [0x692d11f8], 8
jne 0x692d0a40
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x692d0989
cmp esi, 3
jbe 0x692d09f8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x692d099a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x692d5b28]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x692d0989
mov dword [esp], 0x692d11f8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x692d0960
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x692d0960
mov dword [esp], 0x692d11e8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x692d094b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xe0]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x692d0953
mov eax, 0xffffffff
jmp 0x692d09e7
Function at 0x1001d261
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001d442
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001d3ef
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x14
jmp 0x1001d2c7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffffc
jg 0x1001d3ed
mov dword [ebp - 0x4c], 0xfd4914d2
mov dword [ebp - 8], 0
jmp 0x1001d2ea
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1001d2fd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0xffffffff
jmp 0x1001d2e3
push 0
push 0
push 0x5330
push dword [ebp - 0x38]
call fcn.10020531
add esp, 0x10
mov dword [ebp - 0x20], 0x3216
mov dword [ebp - 0x40], 0x10008864
cmp dword [ebp - 0x20], 0x3238
jle 0x1001d3d6
and dword [ebp - 0xc], 0
jmp 0x1001d339
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x775d
jge 0x1001d3d0
and dword [ebp - 0x10], 0
jmp 0x1001d353
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x750f
jge 0x1001d3cb
and dword [ebp - 0x14], 0
jmp 0x1001d369
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7c7e
jge 0x1001d3c9
and dword [ebp - 0x18], 0
jmp 0x1001d37f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6f8d
jge 0x1001d3c7
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x70]
call fcn.1002281d
jmp 0x1001d378
jmp 0x1001d362
jmp 0x1001d34c
jmp 0x1001d332
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [ebp - 0x20], 0x30a3
jge 0x1001d3e8
push dword [ebp - 0x40]
call fcn.10077843
pop ecx
jmp 0x1001d2bc
jmp 0x1001d440
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x1001d411
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jg 0x1001d440
push 0
push 0x3730
push 0x465a
push 0x7b07
push 0x6cb8
push 0x6e40
push 0
call fcn.100217dd
add esp, 0x1c
jmp 0x1001d406
jmp 0x1001d450
push 0x10d9
push 0
call fcn.1001c90b
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10020ce0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10020d17
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push 0x114c
push 0x37f0
push 0x3239
push 0x1ba8
call fcn.10020d49
add esp, 0x18
jmp 0x10020d45
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10020d31
push 0
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x10020d45
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10020d45
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret

Function at 0x10027bb9
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10027c22
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10027be7
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x10027c1d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10027c1d
push 0x3f2
push 1
push 0x5447
push 0xfa6
push 0
push 0x55d9
call fcn.10026c72
add esp, 0x18
jmp 0x10027d0d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0x2188
mov dword [ebp - 0x34], 0x100091a8
cmp dword [ebp - 0x10], 0x21d6
jle 0x10027cd9
and dword [ebp - 0xc], 0
jmp 0x10027c5c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x5c30
jge 0x10027cd9
and dword [ebp - 4], 0
jmp 0x10027c72
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x5a86
jge 0x10027cd4
and dword [ebp - 8], 0
jmp 0x10027c88
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3b76
jge 0x10027cd2
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.100118ee
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10022827
push eax
call fcn.10077843
pop ecx
lea ecx, [ebp - 0x54]
call fcn.1002281d
jmp 0x10027c81
jmp 0x10027c6b
jmp 0x10027c55
push 0
push 0x535e
push dword [ebp - 0x28]
push 0xe04
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x669f
call fcn.10048f21
add esp, 0x1c
cmp dword [ebp - 0x10], 0x1e94
jge 0x10027d0d
push dword [ebp - 0x34]
call fcn.10077843
pop ecx
mov esp, ebp
pop ebp
ret