joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001fa0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
test byte [0x1003c018], 8
mov ecx, dword [ebp + 8]
je 0x10002004
sub esp, 0x28
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p_____p___lu__0x_lx__0x_lx___p__n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateInMemoryWaveBank
mov dword [esp], 3
call dbg.wine_dbg_log
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
add esp, 0x28
lea eax, [ebp - 0x10]
push eax
push edx
push edi
push ebx
push esi
push dword [ecx + 4]
mov edi, ecx
call dbg.FACTAudioEngine_CreateInMemoryWaveBank
add esp, 0x18
test eax, eax
je 0x1000205d
mov esi, 0x80004005
test byte [0x1003c018], 2
je 0x10002051
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_CreateWaveBank:__d_n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateInMemoryWaveBank
mov dword [esp], 1
call dbg.wine_dbg_log
add esp, 0x14
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
push 0xc
push 8
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x100020d5
mov ebx, eax
mov dword [ebp - 0x14], esi
mov ecx, edi
push eax
call dbg.wrapper_add_entry
add esp, 4
test eax, eax
js 0x10002117
mov dword [ebx], dbg._IXACT3WaveBankImpl_Destroy_4
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ebx
xor esi, esi
test byte [0x1003c018], 8
je 0x10002051
sub esp, 0x14
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Created_in_memory_WaveBank:__p_n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateInMemoryWaveBank
mov dword [esp], 3
jmp 0x10002049
push edx
call dbg.FACTWaveBank_Destroy
add esp, 4
mov esi, 0x8007000e
test byte [0x1003c018], 2
je 0x10002051
sub esp, 0x10
mov dword [esp + 0xc], str.Failed_to_allocate_XACT3WaveBankImpl__n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateInMemoryWaveBank
mov dword [esp], 1
call dbg.wine_dbg_log
add esp, 0x10
jmp 0x10002051
mov esi, eax
push dword [ebp - 0x10]
call dbg.FACTWaveBank_Destroy
add esp, 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x10002051
Function at 0x10002140
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test byte [0x1003c018], 8
je 0x10002183
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p_____p___p__n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateStreamingWaveBank
mov dword [esp], 3
call dbg.wine_dbg_log
mov dword [esp], 8
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
sub esp, 4
mov dword [eax], esi
mov ecx, dword [edi]
mov dword [eax + 4], ecx
mov dword [fakeParms.file], eax
movsd xmm0, qword [edi + 4]
movsd qword [fakeParms.offset], xmm0
movzx eax, word [edi + 0xc]
mov word [fakeParms.packetSize], ax
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x10]
mov dword [esp + 8], ecx
lea ecx, [fakeParms.file]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dbg.FACTAudioEngine_CreateStreamingWaveBank
test eax, eax
je 0x10002206
mov edi, 0x80004005
test byte [0x1003c018], 2
je 0x100021fa
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_CreateWaveBank:__d_n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateStreamingWaveBank
mov dword [esp], 1
call dbg.wine_dbg_log
mov eax, edi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 8
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x10002288
mov ebx, eax
mov dword [ebp - 0x14], edi
mov dword [esp], eax
mov ecx, esi
call dbg.wrapper_add_entry
test eax, eax
js 0x100022af
mov dword [ebx], dbg._IXACT3WaveBankImpl_Destroy_4
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor edi, edi
test byte [0x1003c018], 8
je 0x100021fa
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Created_streaming_WaveBank:__p_n
mov dword [esp + 8], str.IXACT3EngineImpl_CreateStreamingWaveBank
mov dword [esp], 3
jmp 0x100021f5
mov dword [esp], edx
call dbg.FACTWaveBank_Destroy
mov edi, 0x8007000e
test byte [0x1003c018], 2
je 0x100021fa
mov dword [esp + 0xc], str.Failed_to_allocate_XACT3WaveBankImpl__n
jmp 0x100021e6
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dbg.FACTWaveBank_Destroy
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x100021fa
Function at 0x100032d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test byte [0x1003c018], 8
movzx ebx, word [ebp + 0xc]
je 0x1000332b
sub esp, 0x24
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p_____u__0x_lx___lu___p__n
mov dword [esp + 8], str.IXACT3SoundBankImpl_Prepare
mov dword [esp], 3
call dbg.wine_dbg_log
mov ecx, dword [ebp + 8]
add esp, 0x24
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
push dword [ecx + 4]
mov ebx, ecx
call dbg.FACTSoundBank_Prepare
add esp, 0x14
test eax, eax
je 0x10003383
mov esi, 0x80004005
test byte [0x1003c018], 2
je 0x10003377
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_CreateCue:__d_n
mov dword [esp + 8], str.IXACT3SoundBankImpl_Prepare
mov dword [esp], 1
call dbg.wine_dbg_log
add esp, 0x14
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
push 0xc
push 8
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x100033ff
mov edi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x10]
push eax
call dbg.wrapper_add_entry
add esp, 4
test eax, eax
js 0x10003443
mov dword [edi], dbg._IXACT3CueImpl_Play_4
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
xor esi, esi
test byte [0x1003c018], 8
je 0x10003377
sub esp, 0x14
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Created_Cue:__p_n
mov dword [esp + 8], str.IXACT3SoundBankImpl_Prepare
mov dword [esp], 3
jmp 0x1000336f
push dword [ebp - 0x10]
call dbg.FACTCue_Destroy
add esp, 4
mov esi, 0x8007000e
test byte [0x1003c018], 2
je 0x10003377
sub esp, 0x10
mov dword [esp + 0xc], str.Failed_to_allocate_XACT3CueImpl__n
mov dword [esp + 8], str.IXACT3SoundBankImpl_Prepare
mov dword [esp], 1
call dbg.wine_dbg_log
add esp, 0x10
jmp 0x10003377
mov esi, eax
push dword [ebp - 0x10]
call dbg.FACTCue_Destroy
add esp, 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x10003377
Function at 0x10003470
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test byte [0x1003c018], 8
movzx ebx, word [ebp + 0xc]
je 0x100034cc
sub esp, 0x24
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____u__0x_lx___lu___p__n
mov dword [esp + 8], str.IXACT3SoundBankImpl_Play
mov dword [esp], 3
call dbg.wine_dbg_log
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
add esp, 0x24
mov eax, dword [eax + 4]
test ecx, ecx
je 0x10003539
lea ecx, [ebp - 0x10]
push ecx
push edi
push esi
push ebx
push eax
call dbg.FACTSoundBank_Play
add esp, 0x14
test eax, eax
js 0x100035a9
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
push 0xc
push 8
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10003549
mov esi, eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x10]
push eax
call dbg.wrapper_add_entry
add esp, 4
test eax, eax
js 0x1000358b
mov dword [esi], dbg._IXACT3CueImpl_Play_4
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
xor eax, eax
jmp 0x100035a9
push 0
push edi
push esi
push ebx
push eax
call dbg.FACTSoundBank_Play
add esp, 0x18
jmp 0x100035ac
push dword [ebp - 0x10]
call dbg.FACTCue_Destroy
add esp, 4
mov eax, 0x8007000e
test byte [0x1003c018], 2
je 0x100035a9
sub esp, 0x10
mov dword [esp + 0xc], str.Failed_to_allocate_XACT3CueImpl__n
mov dword [esp + 8], str.IXACT3SoundBankImpl_Play
mov dword [esp], 1
call dbg.wine_dbg_log
mov eax, 0x8007000e
add esp, 0x10
jmp 0x100035a9
push dword [ebp - 0x10]
mov ebx, eax
call dbg.FACTCue_Destroy
add esp, 4
mov eax, dword [edi + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x10003800
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
test byte [0x1003c018], 8
je 0x10003833
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.IXACT3CueImpl_Destroy
mov dword [esp], 3
call dbg.wine_dbg_log
mov eax, dword [esi + 4]
mov dword [esp], eax
call dbg.FACTCue_Destroy
test eax, eax
je 0x1000386b
test byte [0x1003c018], 4
je 0x1000386b
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.FACTCue_Destroy_returned__d_n
mov dword [esp + 8], str.IXACT3CueImpl_Destroy
mov dword [esp], 2
call dbg.wine_dbg_log
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
call dbg.wrapper_remove_entry
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
xor eax, eax
add esp, 0x14
pop esi
pop ebp
ret 4
Function at 0x100041f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test byte [0x1003c018], 8
movzx esi, byte [ebp + 0x18]
movzx ebx, word [ebp + 0xc]
je 0x10004256
sub esp, 0x28
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p____0x_x___lu__0x_lx___u___p__n
mov dword [esp + 8], str.IXACT3WaveBankImpl_Prepare
mov dword [esp], 3
call dbg.wine_dbg_log
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add esp, 0x28
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push edx
push ebx
push dword [ecx + 4]
mov ebx, ecx
call dbg.FACTWaveBank_Prepare
add esp, 0x18
test eax, eax
je 0x100042af
mov esi, 0x80004005
test byte [0x1003c018], 2
je 0x100042a3
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_CreateWave:__d_n
mov dword [esp + 8], str.IXACT3WaveBankImpl_Prepare
mov dword [esp], 1
call dbg.wine_dbg_log
add esp, 0x14
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
push 0xc
push 8
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000432b
mov edi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x10]
push eax
call dbg.wrapper_add_entry
add esp, 4
test eax, eax
js 0x1000436f
mov dword [edi], dbg._IXACT3WaveImpl_Destroy_4
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], edi
xor esi, esi
test byte [0x1003c018], 8
je 0x100042a3
sub esp, 0x14
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Created_Wave:__p_n
mov dword [esp + 8], str.IXACT3WaveBankImpl_Prepare
mov dword [esp], 3
jmp 0x1000429b
push dword [ebp - 0x10]
call dbg.FACTWave_Destroy
add esp, 4
mov esi, 0x8007000e
test byte [0x1003c018], 2
je 0x100042a3
sub esp, 0x10
mov dword [esp + 0xc], str.Failed_to_allocate_XACT3WaveImpl__n
mov dword [esp + 8], str.IXACT3WaveBankImpl_Prepare
mov dword [esp], 1
call dbg.wine_dbg_log
add esp, 0x10
jmp 0x100042a3
mov esi, eax
push dword [ebp - 0x10]
call dbg.FACTWave_Destroy
add esp, 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x100042a3
Function at 0x100043a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test byte [0x1003c018], 8
movzx esi, byte [ebp + 0x18]
movzx ebx, word [ebp + 0xc]
je 0x10004407
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p____0x_x___lu__0x_lx___u___p__n
mov dword [esp + 8], str.IXACT3WaveBankImpl_Play
mov dword [esp], 3
call dbg.wine_dbg_log
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
add esp, 0x28
mov eax, dword [eax + 4]
test ecx, ecx
je 0x10004475
lea ecx, [ebp - 0x10]
push ecx
push esi
push edi
push edx
push ebx
push eax
call dbg.FACTWaveBank_Play
add esp, 0x18
test eax, eax
js 0x100044e6
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
push 0xc
push 8
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10004486
mov esi, eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x10]
push eax
call dbg.wrapper_add_entry
add esp, 4
test eax, eax
js 0x100044c8
mov dword [esi], dbg._IXACT3WaveImpl_Destroy_4
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
xor eax, eax
jmp 0x100044e6
push 0
push esi
push edi
push edx
push ebx
push eax
call dbg.FACTWaveBank_Play
add esp, 0x1c
jmp 0x100044e9
push dword [ebp - 0x10]
call dbg.FACTWave_Destroy
add esp, 4
mov eax, 0x8007000e
test byte [0x1003c018], 2
je 0x100044e6
sub esp, 0x10
mov dword [esp + 0xc], str.Failed_to_allocate_XACT3WaveImpl__n
mov dword [esp + 8], str.IXACT3WaveBankImpl_Play
mov dword [esp], 1
call dbg.wine_dbg_log
mov eax, 0x8007000e
add esp, 0x10
jmp 0x100044e6
push dword [ebp - 0x10]
mov ebx, eax
call dbg.FACTWave_Destroy
add esp, 4
mov eax, dword [edi + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x1000e480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.ucrtbase.dll_strlen]
add esp, 4
test eax, eax
je 0x1000e4cd
mov esi, eax
xor eax, eax
cmp byte [edi + esi - 1], 0xa
je 0x1000e4aa
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, 0x1003c5fc
lock xchg dword [ecx], eax
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 4
push eax
push esi
push 1
push edi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
jmp 0x1000e4cf
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x1000f770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xc
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
test eax, eax
je 0x1000f7aa
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
push 0
push 0
push eax
push dbg._FaudioThreadWrapper@4
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
jmp 0x1000f7ac
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000f8b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000f8cf
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ucrtbase.dll_fread]
add esp, 0x10
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10015160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, 0xfffff640
mov ecx, dword [ebp + 8]
nop dword [eax]
imul ecx, ecx, 0x7ff8a3ed
add ecx, 0x2aa01d31
imul edx, ecx, 0x7ff8a3ed
rol ecx, 0x10
xor ecx, 0x31415926
mov dword [eax + 0x1003d024], ecx
add edx, 0x2aa01d31
imul ecx, edx, 0x7ff8a3ed
rol edx, 0x10
xor edx, 0x31415926
add ecx, 0x2aa01d31
mov esi, ecx
rol esi, 0x10
mov dword [eax + 0x1003d028], edx
xor esi, 0x31415926
mov dword [eax + 0x1003d02c], esi
add eax, 0xc
jne 0x10015170
mov dword [0x1003c0e0], 0x9c0
pop esi
pop ebp
ret
Function at 0x1001ed10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
movzx ecx, byte [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], dbg.FAPOBase_AddRef
mov dword [eax + 4], dbg.FAPOBase_Release
mov dword [eax + 8], dbg.FAPOBase_GetRegistrationProperties
mov dword [eax + 0xc], dbg.FAPOBase_IsInputFormatSupported
mov dword [eax + 0x10], dbg.FAPOBase_IsOutputFormatSupported
mov dword [eax + 0x14], dbg.FAPOBase_Initialize
mov dword [eax + 0x18], dbg.FAPOBase_Reset
mov dword [eax + 0x1c], dbg.FAPOBase_LockForProcess
mov dword [eax + 0x20], dbg.FAPOBase_UnlockForProcess
mov dword [eax + 0x28], dbg.FAPOBase_CalcInputFrames
mov dword [eax + 0x2c], dbg.FAPOBase_CalcOutputFrames
mov dword [eax + 0x30], dbg.FAPOBase_SetParameters
mov dword [eax + 0x34], dbg.FAPOBase_GetParameters
mov dword [eax + 0x3c], dbg.FAPOBase_OnSetParameters
mov dword [eax + 0x40], edi
xorps xmm0, xmm0
movsd qword [eax + 0x44], xmm0
movsd qword [eax + 0x4a], xmm0
mov dword [eax + 0x54], esi
mov dword [eax + 0x58], esi
mov dword [eax + 0x5c], esi
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], edx
mov byte [eax + 0x68], 0
mov byte [eax + 0x69], cl
mov ecx, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [eax + 0x70], ecx
mov ecx, dword [sym.imp.ucrtbase.dll_free]
mov dword [eax + 0x74], ecx
mov ecx, dword [sym.imp.ucrtbase.dll_realloc]
mov dword [eax + 0x78], ecx
mov dword [eax + 0x6c], 1
pop esi
pop edi
pop ebp
ret

Function at 0x1001ede0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], dbg.FAPOBase_AddRef
mov dword [eax + 4], dbg.FAPOBase_Release
mov dword [eax + 8], dbg.FAPOBase_GetRegistrationProperties
mov dword [eax + 0xc], dbg.FAPOBase_IsInputFormatSupported
mov dword [eax + 0x10], dbg.FAPOBase_IsOutputFormatSupported
mov dword [eax + 0x14], dbg.FAPOBase_Initialize
mov dword [eax + 0x18], dbg.FAPOBase_Reset
mov dword [eax + 0x1c], dbg.FAPOBase_LockForProcess
mov dword [eax + 0x20], dbg.FAPOBase_UnlockForProcess
mov dword [eax + 0x28], dbg.FAPOBase_CalcInputFrames
mov dword [eax + 0x2c], dbg.FAPOBase_CalcOutputFrames
mov dword [eax + 0x30], dbg.FAPOBase_SetParameters
mov dword [eax + 0x34], dbg.FAPOBase_GetParameters
mov dword [eax + 0x3c], dbg.FAPOBase_OnSetParameters
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x10]
xorps xmm0, xmm0
movsd qword [eax + 0x44], xmm0
movsd qword [eax + 0x4a], xmm0
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], ecx
movzx ecx, byte [ebp + 0x18]
mov byte [eax + 0x68], 0
mov byte [eax + 0x69], cl
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x70], ecx
mov ecx, dword [ebp + 0x20]
mov dword [eax + 0x74], ecx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 0x78], ecx
mov dword [eax + 0x6c], 1
pop ebp
ret
Function at 0x10024190
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
xor eax, eax
test ebx, ebx
je 0x10024318
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 0x14]
cmp dword [ebx], 0
jne 0x10024245
mov eax, dword [0x1003d040]
test eax, eax
je 0x100242e2
push ebx
call eax
mov dword [ebx + 8], eax
test eax, eax
js 0x10024237
lea ebx, [ebp - 0x220]
push 0x104
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax]
push ebx
push str.MODULE
push eax
call dword [ecx + 0xc]
push 0x104
push ebx
push str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax]
push ebx
mov ebx, dword [ebp + 0x14]
push str.SystemRoot
push eax
call dword [ecx + 0xc]
cmp dword [ebx], 0
mov eax, 0
je 0x10024318
push 0
push 0
push esi
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x18]
push esi
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edi, eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x30]
lea ecx, [edi*2 + 2]
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x100242d6
mov ebx, eax
mov eax, edi
inc eax
push eax
push ebx
push dword [ebp - 0x10]
push esi
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov word [ebx + edi*2], 0
xor eax, eax
mov esi, dword [ebp + 0x14]
cmp dword [esi + 4], 0
sete al
mov ecx, dword [esi]
mov edx, dword [ecx]
push ebx
push ecx
call dword [edx + eax*4 + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
not eax
shr eax, 0x1f
jmp 0x10024318
mov eax, dword [ebp + 0x14]
mov dword [eax + 8], 0x8007000e
jmp 0x10024316
push str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [0x1003d044], eax
test eax, eax
je 0x1002430f
push str.AtlCreateRegistrar
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1003d040], eax
test eax, eax
jne 0x100241e4
mov dword [ebx + 8], 0x80004002
xor eax, eax
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret 0x10