joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445f60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x461130]
cmp byte [eax + 0xc], 0
je 0x4460cd
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4460c6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x462be4], 0
jne 0x445fb4
push 0x4460d4
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4460dc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462be4], eax
cmp dword [0x460b50], 0
jne 0x4460af
push 0x4460ec
call sub.kernel32.dll_LoadLibraryA
mov dword [0x460b50], eax
cmp dword [0x460b50], 0
je 0x4460af
push 0x4460f8
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462be8], eax
push 0x446108
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462bec], eax
push 0x44611c
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462bf0], eax
push 0x446134
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462bf4], eax
push 0x44614c
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462bf8], eax
push 0x446160
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462bfc], eax
push 0x446178
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462c00], eax
push 0x446190
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462c04], eax
push 0x4461ac
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462c08], eax
push 0x4461b8
mov eax, dword [0x460b50]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x462c0c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4460cd
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x449cfc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004045c4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x449d4b
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040482c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451bcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x451c1c]
test si, 4
je 0x451be0
or bl, 1
test si, 8
je 0x451bea
or bl, 4
test si, 1
je 0x451bf4
or bl, 8
test si, 2
je 0x451bfe
or bl, 0x10
test si, 0x10
je 0x451c08
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451c17
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x451c20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x451c58]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451c39
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451c48
or bl, 4
test esi, 0x20000000
je 0x451c53
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45825c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45826e
add esp, 0xfffffff0
call fcn.00403bbc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041bd20
mov eax, dword [0x460e4c]
mov dword [eax + 4], ebx
mov dword [eax], 0x458600
mov eax, dword [0x460e58]
mov dword [eax + 4], ebx
mov dword [eax], 0x45860c
mov eax, ebx
call fcn.00458618
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x454ae0
push eax
push 0
push 0
mov eax, dword [0x460f74]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41d710]
call fcn.0041ede4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41d710]
call fcn.0041ede4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41d710]
call fcn.0041ede4
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00458a38
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458914
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458914
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458914
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4583ab
call fcn.00403c14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4586f8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4588a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x458884
mov dl, 1
mov eax, dword [0x412140]
call fcn.00403828
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004045c4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x458873
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004462c0
test al, al
je 0x458866
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4588b4
lea eax, [ebp - 0x254]
call fcn.004094cc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x458866
xor eax, eax
push ebp
push 0x45885f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4588ec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458848
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040482c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458848
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040482c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458866
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x458769
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004163b8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4588aa
lea eax, [ebp - 0x260]
call fcn.004045c4
ret

Function at 0x4591d8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x462c28]
cmp byte [eax + 0xa5], 0
jne 0x459249
cmp dword [0x462c40], 0
jne 0x45920a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459194
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x462c40], eax
cmp dword [0x462c3c], 0
jne 0x459225
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x462c3c], eax
cmp dword [0x462c44], 0
jne 0x459249
push esp
push 0
push 0
push 0x459138
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x462c44], eax
pop edx
ret
Function at 0x459340
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x459357
add esp, 0xfffffff0
call fcn.00403bbc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041bd20
mov eax, dword [0x460f64]
cmp word [eax + 2], 0
jne 0x45937f
mov eax, dword [0x460f64]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a974
mov eax, dword [0x460fec]
cmp word [eax + 2], 0
jne 0x459399
mov eax, dword [0x460fec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ab6c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411c50]
call fcn.00403828
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41e190]
call fcn.00425818
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x459520
mov eax, dword [0x460ea8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425be8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45b0dc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x460ea8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ae5c
test eax, eax
je 0x45948e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408e14
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ae84
test eax, eax
je 0x4594a2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040482c
mov eax, dword [0x460db8]
cmp byte [eax], 0
jne 0x4594d6
mov eax, ebx
call fcn.00459648
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045b2b8
mov eax, ebx
call fcn.0045bbf8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459516
call fcn.00403c14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4598bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x462c28]
cmp dword [eax + 0x30], 0
je 0x459966
cmp dword [ebx + 0x94], 0
jne 0x459960
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45984c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x459960
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x459926
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x459960
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004142f0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x459935
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a444
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45a479
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046b4
jmp 0x45a486
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404618
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45b494
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b4d5
mov eax, esi
call fcn.00441a3c
test al, al
je 0x45b4d5
mov eax, dword [ebx + 0x84]
call fcn.00441738
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b4d5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441738
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x2fd4080
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2fd2000
push 0x2fd4362
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x2fd6334], 0xffffffff
mov eax, dword [0x2fd6334]
mov dword [0x2fd6338], eax
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x2fd6258]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x2fd6254]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x2fd6330], eax
call fcn.02fd4360
cmp dword [0x2fd6250], 0
jne 0x2fd4110
push 0x2fd4350
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.02fd4330
push 0x2fd6014
push 0x2fd6010
call sub.MSVCRT.dll__initterm
add esp, 8
mov eax, dword [0x2fd624c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x2fd6248]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x2fd600c
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x2fd4184
mov al, byte [ebp - 0x40]
inc esi
mov al, byte [esi]
test al, al
je 0x2fd417c
cmp al, 0x22
jne 0x2fd4171
cmp byte [esi], 0x22
jne 0x2fd418e
inc esi
jmp 0x2fd418e
cmp al, 0x20
jbe 0x2fd418e
inc esi
cmp byte [esi], 0x20
ja 0x2fd4188
cmp byte [esi], 0
je 0x2fd419e
cmp byte [esi], 0x20
ja 0x2fd419e
inc esi
cmp byte [esi], 0
jne 0x2fd4193
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x5c], 1
mov eax, 0xa
je 0x2fd41c5
mov eax, dword [ebp - 0x58]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x2fd4208
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x68b410
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
push ecx
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, 0xa46de6
xor esi, eax
sub esi, eax
and esi, 0xffff
call 0x68b431
pop eax
sub eax, 0x135
add esi, eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esi]
inc esi
push edi
mov ah, byte [esi]
xor ah, al
mov byte [edi], ah
inc esi
ror al, 1
inc edi
dec ecx
jne 0x68b441
pop eax
pop ecx
pop edi
pop esi
ret

Function at 0x68b5fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0068b5c0
test eax, eax
jne 0x68b669
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x68b686
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0068b5c0
test eax, eax
je 0x68b680
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x68b68b
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x68b646
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6ad855e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov eax, esi
mov ecx, esi
sub esp, 0x2c
cpuid
mov ebp, eax
test eax, eax
je 0x6ad8568c
mov edi, eax
mov ecx, esi
mov eax, 1
cpuid
mov eax, ecx
mov ebp, ecx
shr eax, 9
and eax, 1
mov ebx, eax
or ebx, 2
test ecx, 0x80000
cmove ebx, eax
mov eax, ebx
or eax, 4
test ecx, 0x100000
cmovne ebx, eax
test ecx, 0x8000000
je 0x6ad85663
mov ecx, esi
xgetbv
and ebp, 0x10000000
je 0x6ad85663
and eax, 6
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
or ecx, 8
xor eax, 6
or eax, edx
cmove ebx, ecx
mov ebp, ebx
cmp edi, 6
jbe 0x6ad8568c
mov eax, 7
xor ecx, ecx
cpuid
mov eax, ebp
or eax, 0x10
test bh, 1
cmovne ebp, eax
mov eax, ebp
or eax, 0x20
and ebx, 0x20000000
cmovne ebp, eax
mov dword [esp], str.WIMLIB_DISABLE_CPU_FEATURES
mov dword [0x6adff03c], ebp
call sub.msvcrt.dll_getenv
mov esi, dword [0x6adff03c]
mov ebx, eax
test eax, eax
jne 0x6ad856d0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, edi
mov eax, ebx
sub edx, ebx
lea ebx, [edi + 1]
call fcn.6ad85570
not eax
and esi, eax
mov dword [0x6adff03c], esi
mov dword [esp + 4], 0x2c
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov edi, eax
test eax, eax
jne 0x6ad856b8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, ebx
call fcn.6ad85570
not eax
and eax, esi
mov dword [0x6adff03c], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6ad8e300
Capabilities:
Create directory

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x6ad8e320
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
cmp dword [eax], 0x11
je 0x6ad8e314
call esi
cmp dword [eax], 0xd
jne 0x6add56e4
jmp 0x6ad8e314
mov dword [esp + 4], ebx
mov dword [esp], str.Failed_to_create_directory___ls_
call fcn.6add55e2
mov eax, 0x25
jmp 0x6ad8e316
Function at 0x6ad91be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x3c]
mov eax, dword [edi + 0x20]
cmp eax, 0xfffe
ja 0x6ad91d22
mov edx, dword [edi]
lea ebx, [edi + 4]
cmp edx, ebx
je 0x6ad91cc8
add eax, 1
mov dword [esp], edx
imul eax, eax, 0x1c
mov dword [esp + 4], eax
call fcn.6adaef00
mov ebx, eax
test eax, eax
je 0x6ad91d1e
mov dword [edi], eax
mov eax, dword [edi + 0x20]
imul eax, eax, 0x1c
xor ecx, ecx
xor ebp, ebp
add ebx, eax
lea edx, [ebx + 4]
mov eax, ebx
mov dword [ebx], 0
and edx, 0xfffffffc
mov dword [ebx + 0x18], 0
sub eax, edx
add eax, 0x1c
and eax, 0xfffffffc
mov dword [edx + ebp], ecx
add ebp, 4
cmp ebp, eax
jb 0x6ad91c51
movzx edx, byte [esp + 0x34]
movzx eax, byte [ebx + 0x1b]
shl edx, 5
and eax, 0x1f
or eax, edx
mov byte [ebx + 0x1b], al
mov eax, dword [esp + 0x38]
cmp word [eax], 0
jne 0x6ad91d08
mov dword [ebx], 0x6ade07e2
mov eax, dword [edi + 0x78]
lea edx, [eax + 1]
add eax, eax
mov dword [edi + 0x78], edx
mov edx, dword [ebx + 0x18]
and eax, 0x1ffffffe
or eax, 1
mov dword [ebx + 4], esi
and edx, 0xe0000000
or eax, edx
mov dword [ebx + 0x18], eax
test esi, esi
je 0x6ad91cb6
mov eax, dword [edi + 0x38]
and eax, 0x3fffffff
add dword [esi + 0x24], eax
add dword [edi + 0x20], 1
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x6ad91c2b
add eax, 1
imul eax, eax, 0x1c
mov dword [esp], eax
call fcn.6adaeec0
mov ebx, eax
test eax, eax
je 0x6ad91d1e
imul edx, dword [edi + 0x20], 0x1c
mov eax, dword [edi]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_memcpy
mov dword [edi], ebx
mov eax, dword [edi + 0x20]
jmp 0x6ad91c2b
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.6ad8d840
mov dword [ebx], eax
test eax, eax
jne 0x6ad91c83
xor ebx, ebx
jmp 0x6ad91cba
mov eax, dword [edi + 0x2c]
xor ebx, ebx
sub eax, 0x14
mov dword [esp], eax
call fcn.6ad86960
mov dword [esp], str.Inode_has_too_many_streams__Path__ls_
mov dword [esp + 4], eax
call fcn.6add55ba
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x1b
jmp 0x6ad91cba
Function at 0x6ada29a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.6adafbc0
test eax, eax
jne 0x6ada2ae5
lea eax, [esi + 0x3fffffff]
mov ecx, eax
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x130]
mov esi, dword [eax + ecx*4]
mov ecx, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x44], ecx
test ecx, ecx
je 0x6ada2b18
mov eax, dword [ebp + 4]
lea edx, [eax*8 + 8]
test eax, eax
je 0x6ada2a09
mov eax, dword [ebp + 8]
lea edi, [edx + eax - 8]
nop
add edx, dword [eax]
add eax, 8
cmp eax, edi
jne 0x6ada2a00
lea edi, [edx + 7]
and edi, 0xfffffff8
mov dword [ebp], edi
mov dword [esp], ecx
call fcn.6ad866c0
mov dword [esp + 0x4c], 0
lea eax, [edi + eax + 8]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.6ad86980
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
test eax, eax
jne 0x6add5e3b
mov dword [esp], edi
call fcn.6adaeec0
mov esi, eax
test eax, eax
je 0x6add5e3b
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.6ada73a0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.6ad87cc0
sub eax, esi
cmp eax, edi
jne 0x6ada2af0
mov eax, dword [ebx + 0x130]
mov edx, dword [esp + 0x3c]
add ebx, 0x158
mov ecx, dword [esp + 0x78]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x20], ecx
lea ecx, [eax + 0x10]
add eax, 0x68
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x30]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 0x2a]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6adb40c0
mov dword [esp], esi
mov dword [esp + 0x3c], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x3c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xdf
mov dword [esp + 4], str.src_metadata_resource.c
mov dword [esp], str.p___buf__len
call dword [0x6add9074]
jmp 0x6ada2a82
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.6ad87280
test eax, eax
jne 0x6ada2ae5
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], ecx
jmp 0x6ada29ea
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp], str.Failed_to_allocate__llu_bytes_for_metadata_resource
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.6add55ba
mov eax, 0x27
jmp 0x6ada2ae5