joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42360b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x44c3a0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x44c0c8]
je 0x423640
inc eax
cmp eax, 0x13
jb 0x423631
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x44c0c8]
jne 0x423766
mov eax, dword [0x4608d0]
cmp eax, 1
je 0x42373e
cmp eax, edx
jne 0x423670
cmp dword [0x44bcf4], 1
je 0x42373e
cmp ecx, 0xfc
je 0x423766
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4236a6
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00420480
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00420b60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4236da
mov eax, edi
push eax
call fcn.00420b60
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x42a1c8
push edi
call fcn.00420260
add esp, 0x10
push edi
call fcn.00420b60
push dword [esi + 0x44c0cc]
mov ebx, eax
call fcn.00420b60
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00420220
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00420480
push edi
push ebx
call fcn.00420490
push 0x42a1a8
push ebx
call fcn.00420490
push dword [esi + 0x44c0cc]
push ebx
call fcn.00420490
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0042657e
add esp, 0x2c
jmp 0x423766
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x44c0cc]
push dword [esi]
call fcn.00420b60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00425504
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x424dbb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
je 0x424de6
cmp eax, 1
je 0x424de6
jle 0x424dee
cmp eax, 3
jle 0x424de6
cmp eax, 4
jne 0x424dee
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x424e17
mov dword [0x4608e4], 0x16
mov dword [0x4608e8], ebx
or eax, 0xffffffff
jmp 0x424f89
inc eax
cmp byte [eax], bl
jne 0x424e06
lea ecx, [eax + 1]
cmp byte [ecx], bl
je 0x424e17
mov byte [eax], 0x20
mov eax, ecx
cmp byte [eax], bl
jne 0x424e06
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00420090
mov dword [ebp - 0x68], esi
mov esi, dword [0x460b44]
add esp, 0xc
cmp esi, ebx
je 0x424e5a
lea eax, [esi - 1]
mov ecx, eax
sar ecx, 5
mov ecx, dword [ecx*4 + 0x460b60]
mov edx, eax
and edx, 0x1f
cmp byte [ecx + edx*8 + 4], bl
jne 0x424e5a
dec esi
dec eax
cmp esi, ebx
jne 0x424e3d
lea eax, [esi + esi*4 + 4]
mov word [ebp - 0x36], ax
push edi
movzx eax, ax
push 1
push eax
call fcn.004261eb
cmp esi, ebx
mov dword [ebp - 0x34], eax
pop ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
pop ecx
mov dword [ebp - 8], ebx
lea ecx, [eax + 4]
lea edx, [eax + esi + 4]
jle 0x424ebf
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 8]
sar eax, 5
mov eax, dword [eax*4 + 0x460b60]
and edi, 0x1f
lea edi, [eax + edi*8]
mov al, byte [edi + 4]
test al, 0x10
jne 0x424eab
mov byte [ecx], al
mov eax, dword [edi]
mov dword [edx], eax
jmp 0x424eb0
mov byte [ecx], bl
or dword [edx], 0xffffffff
inc dword [ebp - 8]
inc ecx
add edx, 4
cmp dword [ebp - 8], esi
jl 0x424e86
mov eax, dword [ebp - 0x34]
cmp byte [ebp - 1], bl
je 0x424ef0
lea ecx, [eax + 4]
xor edx, edx
lea eax, [eax + esi + 4]
cmp esi, 3
jge 0x424ed6
mov edi, esi
jmp 0x424ed9
push 3
pop edi
cmp edx, edi
jge 0x424ee9
mov byte [ecx], bl
or dword [eax], 0xffffffff
inc edx
inc ecx
add eax, 4
jmp 0x424ecd
mov dword [ebp - 0xc], 8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
mov dword [0x4608e4], ebx
push dword [ebp - 0xc]
mov dword [0x4608e8], ebx
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
mov edi, eax
call fcn.00422906
cmp esi, ebx
pop ecx
jne 0x424f3e
push edi
call fcn.00425199
pop ecx
or eax, 0xffffffff
jmp 0x424f87
cmp dword [ebp + 8], 2
jne 0x424f4a
push ebx
call fcn.00421961
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x424f77
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x24]
call esi
jmp 0x424f80
cmp dword [ebp + 8], 4
je 0x424f70
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42634a
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x460b44]
mov eax, dword [0x44c3a0]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x426510
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x460b60]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x426510
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x4263b4
xor eax, eax
jmp 0x426524
test al, 0x20
je 0x4263c5
push 2
push edi
push edi
push ecx
call fcn.00427a8b
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x42649a
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x4264e1
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x426427
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x426418
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x4263fa
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x426467
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x426473
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x4263ee
jmp 0x426475
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x42650b
cmp dword [ebp + 0x3a4], edi
je 0x4264e1
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x4264d3
mov dword [0x4608e8], eax
jmp 0x426517
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4264c5
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x426475
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x426475
push dword [ebp + 0x3a4]
call fcn.00425199
pop ecx
jmp 0x426521
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4264f9
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x4263ad
mov dword [0x4608e4], 0x1c
mov dword [0x4608e8], edi
jmp 0x426521
sub eax, dword [ebp - 0x7c]
jmp 0x426524
and dword [0x4608e8], 0
mov dword [0x4608e4], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.00425504
add ebp, 0x39c
leave
ret
Function at 0x42657e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x460b04], ebx
push esi
push edi
jne 0x4265fe
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x426639
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42a28c
push edi
call esi
test eax, eax
mov dword [0x460b04], eax
je 0x426639
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x460b08], eax
call esi
cmp dword [0x4608f0], 2
mov dword [0x460b0c], eax
jne 0x4265fe
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x460b14], eax
je 0x4265fe
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x460b10], eax
mov eax, dword [0x460b10]
test eax, eax
je 0x426643
call eax
test eax, eax
je 0x42662a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x460b14]
test eax, eax
je 0x42662a
test byte [ebp - 8], 1
jne 0x426643
cmp dword [0x4608fc], 4
jb 0x42663d
or byte [ebp + 0x12], 0x20
jmp 0x426662
xor eax, eax
jmp 0x426672
or byte [ebp + 0x12], 4
jmp 0x426662
mov eax, dword [0x460b08]
test eax, eax
je 0x426662
call eax
mov ebx, eax
test ebx, ebx
je 0x426662
mov eax, dword [0x460b0c]
test eax, eax
je 0x426662
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x460b04]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4275a5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4275be
or eax, 0xffffffff
jmp 0x42761f
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x42761b
push 0x3d
push esi
call fcn.00424c98
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x42761b
cmp esi, eax
je 0x42761b
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x460910]
sete cl
cmp eax, dword [0x460914]
mov dword [ebp - 8], ecx
jne 0x427601
mov edi, eax
call fcn.00427544
mov dword [0x460910], eax
cmp eax, ebx
jne 0x42765a
cmp dword [ebp + 0xc], ebx
je 0x427623
cmp dword [0x460918], ebx
je 0x427623
call fcn.00425237
test eax, eax
je 0x42765a
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x42762c
xor eax, eax
jmp 0x42761e
push 4
call fcn.004229b0
cmp eax, ebx
pop ecx
mov dword [0x460910], eax
je 0x42761b
mov dword [eax], ebx
cmp dword [0x460918], ebx
jne 0x42765a
push 4
call fcn.004229b0
cmp eax, ebx
pop ecx
mov dword [0x460918], eax
je 0x42761b
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x460910]
call fcn.004274f7
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x4276bb
cmp dword [esi], ebx
je 0x4276bb
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00422906
cmp dword [ebp - 8], ebx
pop ecx
jne 0x42769e
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x4276fc
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x427695
mov eax, edi
shl eax, 2
push eax
push dword [0x460910]
call fcn.00426fbd
cmp eax, ebx
pop ecx
pop ecx
je 0x4276fc
jmp 0x4276f7
cmp dword [ebp - 8], ebx
jne 0x427767
cmp edi, ebx
jge 0x4276ca
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x460910]
call fcn.00426fbd
cmp eax, ebx
pop ecx
pop ecx
je 0x42761b
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x460910], eax
cmp dword [ebp + 0xc], ebx
je 0x427751
push dword [ebp - 4]
call fcn.00420b60
inc eax
inc eax
push eax
call fcn.004229b0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x427751
push dword [ebp - 4]
push esi
call fcn.00420480
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x42774a
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00422906
pop ecx
cmp dword [ebp - 8], ebx
je 0x42775f
push dword [ebp - 4]
call fcn.00422906
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x42761e
push dword [ebp - 4]
call fcn.00422906
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x427628
Function at 0x10120fb
Capabilities:
Encode data using xor

Disassembly:
adc byte [ebp + 0x47fc63db], 0xbb
stosd dword es:[edi], eax
jg 0x10120e3
int1
lahf
ret 0xba00
add byte [edx + 0x7dca1968], bh
out dx, al
push ss
xor edx, dword [ecx]
invd
cmp cl, dl
arpl word [edi], si
xor dword [0x1e1edf71], esi
jno 0x10120d6
push ds
push ds
mov eax, dword [0xb6f5d8b0]
mov dl, 0x90
fdiv st(5)
mov dh, 0xb2
nop
xor dword [ecx], esp
pop esp
mov cl, 0xbc
and byte [eax], ah
salc
mov byte [ebp + 0x3c7295ad], dh
std
sub dword [ecx], esp
jbe 0x10120e3
add byte [edi], ch
salc
dec esp
jbe 0x1012134
mov eax, 0x5e2a9e24
push ecx
push esi
push ecx
mov esp, 0x98cb6906
int 0xbe
jg 0x10120f5
retf
sal byte [ebp + 0x113ed91b], 1
jb 0x1012129
xor dword [ebx + 0x68a3864e], ebp
pop esp
sbb eax, 0x18958e3e
mov esp, dword [esi + 0x7df33760]
dec ebp
dec esi
xchg byte [ebx + 0x3e1d5c68], ah
mov ss, word [ebp + 0x60a68b18]
aaa
jge 0x1012192
or al, 0xa6
or esp, 0x7e
dec edx
daa
out 0x90, al
mov dl, 0x54
hlt
jg 0x10121a4
push ebx
ror ebx, 1
jmp dword [edx + eax*4]
call 0xb27e603f
pop ebx
add al, 0xdb
lahf
dec eax
and eax, 0x5a553112
pop edi
mov dl, 0x1b
inc esp
fisubr word [eax]
push eax
in eax, 0x70
pop ss
jl 0x10121f8
mov edx, 0x1f7d9450
pop esp
ja 0x1012220
sbb byte [ebx + 0x24], al
pop eax
inc ebx
and al, 0x58
or eax, 0xd7e44050
inc eax
in al, 0xd7
arpl word [edi], bp
lea ebx, [ebp + 0x2d]
pop ds
stc
clc
inc ebp
call [esi - 0x700abbe9]
out dx, al
stosd dword es:[edi], eax
mov ecx, 0xd425a6a3
bnd jns 0x10121f5
aas
mov cl, 0xb4
xchg ecx, eax
invalid
mov ecx, 0x7ace9037
inc ecx
into
jp 0x101223c
popal
dec eax
sar dword [eax - 0x6666998d], cl
retf
salc
mov eax, dword [0xb3fa991a]
loopne 0x10121c8
rcl dword [edx - 0x388a070f], cl
or cl, bl
dec eax
push cs
stc
rol dh, cl
pop ebp
adc al, 0x1e
inc eax
leave
wait
test byte [ebp - 0x6cafa1e1], 0x9c
mov bl, 0x87
jecxz 0x10121cd
mov ecx, 0xe78c3dd0
rol dword [edi + 0x7d457414], 0xa9
jmp 0xaf255bee

Function at 0x1012920
Capabilities:
Encode data using xor

Disassembly:
push edi
push ss
mov dh, 0xde
mov byte [edx + 0x192fd7b4], bh
shl dword [edx + 0x627928f0], 0xbb
mov dword [0x5e7aa99e], eax
in eax, dx
mov esi, 0xa5337efa
je 0x101287d
and al, 0x30
add dword [eax + 0x76db0913], ebp
push edi
mov word [ecx - 0x54b32ef4], ds
mov edx, 0x564ab0ce
jne 0x1012940
jmp 0x8792d27e
test al, 0x78
jge 0x10128e7
loop 0x10128df
cld
femms
and cl, byte [eax]
outsb dx, byte [esi]
and dword [edx + 0x29d91d34], esi
adc al, 0x47
sal byte [ebp - 0x7d], 1
pushfd
invalid
nop
xchg esi, eax
sub dword [ebp + 0x3eef8fb5], 0xffffffc7
inc ebx
sub eax, 0x9b27f1fb
and byte [edx], bh
invalid
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x28a90a43
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x56d84565
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100087f0
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test byte [0x100131c0], 8
jne 0x10008930
cmp ebx, 5
je 0x100088e0
jbe 0x10008850
cmp ebx, 0x64
ja 0x10008855
cmp ebx, 0x52
ja 0x100088c0
cmp ebx, 0x1a
jbe 0x10008870
cmp ebx, 0x23
jne 0x10008855
mov dword [ebp + 0x10], esi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._schan_QueryContextAttributesW_12
cmp ebx, 4
je 0x10008832
mov edi, 0x80090302
test byte [0x100131c0], 1
jne 0x10008883
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp ebx, 0x18
ja 0x10008832
mov edi, 0x80090302
test byte [0x100131c0], 1
je 0x10008863
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Unhandled_attribute__lx_n
mov dword [esp + 8], str.schan_QueryContextAttributesA
mov dword [esp + 4], 0x100131c0
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_2
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea ecx, [ebx - 0x53]
mov eax, 1
shl eax, cl
test eax, 0x20081
je 0x10008855
jmp 0x10008832
mov dword [esp], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 5
call sym._schan_QueryContextAttributesW_12
sub esp, 0xc
mov edi, eax
test eax, eax
jne 0x10008863
mov eax, dword [esi + 0xc]
xor edx, edx
call sym._get_alg_name
xor edx, edx
mov dword [esi], eax
mov eax, dword [esi + 0x10]
call sym._get_alg_name
mov dword [esi + 4], eax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.context_handle__p__attribute__lx__buffer__p_n
mov dword [esp + 8], str.schan_QueryContextAttributesA
mov dword [esp + 4], 0x100131c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x1000880f
Function at 0x1000a830
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
sub esp, 0xc
leave
ret 4
Function at 0x1000d1b0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x244
mov ebx, dword [ebp + 8]
test byte [0x10013318], 8
je 0x1000d20d
cmp ebx, 0xe
ja 0x1000d248
mov eax, dword [ebx*4 + 0x10017240]
test eax, eax
je 0x1000d248
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__p__p__n
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 8], str.GetUserNameExW
mov dword [esp + 4], 0x10013318
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
cmp ebx, 0xc
ja case.0x1000d212.4
jmp dword [ebx*4 + 0x10017020]
test byte [0x10013318], 1
jne 0x1000d340
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x534
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc
mov eax, ebx
call sym._debugstr_NameFormat.part.0
jmp 0x1000d1d7
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret 0xc
lea esi, [ebp - 0x230]
lea ebx, [ebp - 0x22a]
mov dword [ebp - 0x230], 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x1000d23a
cmp word [ebp - 0x22a], 0
mov eax, ebx
je 0x1000d2b9
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000d2b0
mov ecx, 0x5c
add eax, 2
mov dword [ebp - 0x230], 0x101
mov word [eax - 2], cx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetUserNameW]
sub esp, 8
test eax, eax
je 0x1000d23a
mov eax, dword [ebp + 0x10]
cmp word [ebp - 0x22a], 0
mov edx, dword [eax]
je 0x1000d3ac
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000d300
sub eax, ebx
sar eax, 1
cmp eax, edx
jb 0x1000d370
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xea
mov eax, ebx
add eax, 2
cmp word [eax], 0
jne 0x1000d320
sub eax, ebx
sar eax, 1
add eax, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
xor eax, eax
jmp 0x1000d23c
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.NameFormat__d_not_implemented_n
mov dword [esp + 8], str.GetUserNameExW
mov dword [esp + 4], 0x10013318
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000d22d
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x1000d378
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000d390
sub eax, ebx
sar eax, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, 1
jmp 0x1000d23c
test edx, edx
jne 0x1000d3c7
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xea
mov eax, 1
jmp 0x1000d330
mov eax, dword [ebp + 0xc]
xor edx, edx
mov word [eax], dx
xor eax, eax
jmp 0x1000d39d
Function at 0x1000d8b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x24
test eax, eax
je 0x1000d975
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov ebx, eax
mov dword [esp + 0x18], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x20
mov edi, eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x1000d975
mov dword [esp + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x20
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x1000d980
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x1c
test eax, eax
je 0x1000da28
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x1000da28
mov dword [esp + 0x14], edi
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x18
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret