joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fe860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5fea59
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov edx, dword [ecx]
test edx, edx
jne 0x5fea15
lea edi, [esp + 0x28]
xor eax, eax
call fcn.0046cb25
mov ecx, dword [esp + 0x40]
nop
mov byte [esp + 0x23], 0
mov byte [esp + 0x23], 0x18
test ecx, ecx
jne 0x5fea40
movzx eax, byte [esp + 0x3c]
test al, al
je 0x5fe8f0
mov eax, dword [esp + 0x34]
inc eax
lea ecx, [esp + 0x28]
cmp dword [ecx + 0x10], eax
jge 0x5fe8f0
nop
lea eax, [0x69de40]
mov dword [esp], eax
call fcn.0040d2a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x6e3f9e]
mov dword [eax], ecx
lea ecx, [0x74924c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jmp 0x5fe94f
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x30]
cmp eax, edx
jae 0x5fe939
mov dword [esp + 0x24], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
lea eax, [0x692a40]
mov dword [esp + 0x10], eax
call fcn.004508b0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx + ecx], al
xchg ebp, eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea eax, [0x5fea70]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
lea ecx, [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], 3
mov byte [esp + 8], 0
lea ecx, [esp + 0x58]
mov dword [esp + 0xc], ecx
call fcn.0057f6c0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5fe9a8
mov ecx, dword [esp + 0x2c]
xor ebp, ebp
xor edx, edx
mov ebx, ecx
xor ecx, ecx
jmp 0x5fe9d3
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x44]
cmp ecx, eax
jb 0x5fea3b
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and ebx, eax
sub ecx, eax
add edx, ebx
xor eax, eax
xor ebx, ebx
mov esi, dword [esp + 0x64]
mov dword [esi + 4], ecx
mov dword [esi + 8], ebp
mov edi, dword [0x9aef70]
test edi, edi
je 0x5fe9fb
mov dword [esp + 0x54], ebx
call fcn.0046c8a0
mov dword [edi], edx
mov ebx, dword [esi]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x54]
mov dword [esi], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ebx
add esp, 0x60
ret
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x60
ret
call fcn.0046c970
lea eax, [0x6929c0]
mov dword [esp], eax
lea eax, [0x748bc8]
mov dword [esp + 4], eax
call fcn.00439660
nop
call fcn.0046b490
jmp fcn.005fe860
Function at 0x6055d0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x6056d5
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0046cb18
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
jmp 0x605685
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005c0920
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
dec eax
test eax, eax
jg 0x60564b
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005c0b00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call fcn.0046b490
jmp fcn.006055d0
Function at 0x6056e0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x7c]
cmp eax, dword [ecx + 8]
jbe 0x605919
sub esp, 0xfc
lea eax, [0x692a40]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.004507f0
mov eax, dword [esp + 0xc]
mov dword [esp + 0xf8], eax
nop
lea edi, [esp + 0x94]
xor eax, eax
call fcn.0046cb19
nop
mov dword [esp + 0x94], 0x67452301
mov dword [esp + 0x98], 0xefcdab89
mov dword [esp + 0x9c], 0x98badcfe
mov dword [esp + 0xa0], 0x10325476
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
mov eax, dword [esp + 0x100]
mov ecx, eax
mov edx, dword [esp + 0x104]
jmp 0x6057e2
mov dword [esp + 0x90], edx
mov dword [esp + 0xf4], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
lea ebp, [esp + 0x94]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005bf770
mov eax, dword [esp + 0xf4]
add eax, 0xc
mov ecx, dword [esp + 0x90]
lea edx, [ecx - 1]
mov ecx, dword [esp + 0x100]
test edx, edx
jg 0x605796
nop
lea edi, [esp + 0x34]
lea esi, [esp + 0x94]
call fcn.0046cf5a
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.005bfa50
lea edi, [esp + 0x20]
lea esi, [esp + 4]
call fcn.0046d018
mov dword [esp], 0
mov dword [esp + 4], 0x10
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
lea eax, [0x692a40]
mov dword [esp + 0x10], eax
call fcn.004508b0
mov eax, dword [esp + 0x14]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp], eax
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x10
call fcn.0046d220
mov eax, dword [esp + 0x30]
cmp eax, 0x24
jl 0x605877
mov eax, 0x24
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf8]
cmp ecx, edx
je 0x605899
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0046d220
mov eax, dword [esp + 0x100]
mov dword [esp], eax
mov eax, dword [esp + 0x104]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x108]
mov dword [esp + 8], eax
call fcn.006055d0
mov eax, dword [esp + 0x10]
cmp eax, 0x14
jl 0x6058cc
mov eax, 0x14
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xf8]
lea ebx, [edx + 0x10]
cmp ecx, ebx
je 0x6058f5
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0046d220
mov edx, dword [esp + 0xf8]
mov dword [esp + 0x10c], edx
mov dword [esp + 0x110], 0x24
mov dword [esp + 0x114], 0x24
add esp, 0xfc
ret
call fcn.0046b490
jmp fcn.006056e0
Function at 0x609860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x609a08
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x60988c
movzx ecx, byte [esp + 0x80]
jmp 0x609899
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x6098d1
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x6099ef
cmp cl, 0xe4
je 0x6098b0
cmp ax, 0x303
jmp 0x6098d5
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x609963
cmp cl, 0xe3
jne 0x60992d
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0046cfbe
call fcn.00609540
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.004f37d0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x6929c0]
mov dword [esp], eax
lea eax, [0x748be0]
mov dword [esp + 4], eax
call fcn.00439660
nop
call fcn.0046b490
jmp fcn.00609860
Function at 0x60eef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60f0dc
sub esp, 0x68
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
xor ecx, ecx
mov ebx, 1
jmp 0x60ef2d
mov ebp, dword [esp + 0x5c]
lea ecx, [ebp + 1]
cmp dl, 0x2d
sete bl
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
cmp eax, ecx
jle 0x60f0d0
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x18], bl
movzx ebp, byte [edx + ecx]
xchg ebp, eax
mov byte [esp + 0x19], al
xchg ebp, eax
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 1
shl edx, cl
neg ecx
mov byte [esp + 0x1b], cl
mov eax, 1
shr eax, cl
lea edi, [ebp - 0x60]
mov ecx, edi
mov ebx, 1
shl ebx, cl
mov dword [esp + 0x64], ebx
neg ecx
mov byte [esp + 0x1a], cl
mov ebx, 1
shr ebx, cl
mov dword [esp + 0x60], ebx
add ebp, 0xffffffc0
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and edx, esi
movzx esi, byte [esp + 0x1b]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and eax, esi
or eax, edx
and eax, 0x3ff6cfa
cmp cl, 0x20
sbb edx, edx
and edx, ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
mov ebp, dword [esp + 0x64]
and ebp, ebx
movzx ebx, byte [esp + 0x1a]
cmp bl, 0x20
sbb ebx, ebx
mov esi, dword [esp + 0x60]
and esi, ebx
or ebp, esi
and ebp, 0x57ffffff
or ebp, eax
test ebp, ebp
setne al
test edx, 0xc7fffffe
setne dl
or eax, edx
test al, al
je 0x60f0bc
movzx eax, byte [esp + 0x18]
test al, al
je 0x60f011
movzx edx, byte [esp + 0x19]
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x60f024
test al, al
jne 0x60ef18
jmp 0x60f016
movzx edx, byte [esp + 0x19]
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x60ef18
jmp 0x60f070
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.004547b0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0060f0f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.004547b0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0060f0f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x78], eax
add esp, 0x68
ret
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
add esp, 0x68
ret
call fcn.0046b490
jmp fcn.0060eef0
Function at 0x648510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6486a7
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x648537
mov eax, dword [eax + 0x7c]
jmp 0x648543
lea ecx, [0x74a5bc]
lea eax, [0x9aece0]
mov ecx, dword [ecx + 0x1c]
nop
mov dword [esp], eax
lea eax, [0x697460]
mov dword [esp + 4], eax
lea eax, [0x9aece0]
mov dword [esp + 8], eax
call ecx
lea eax, [0x6a1cc0]
cmp dword [esp + 0xc], eax
jne 0x648572
mov ecx, dword [esp + 0x10]
jmp 0x648574
xor ecx, ecx
test ecx, ecx
je 0x6486a3
mov edx, dword [ecx + 4]
test edx, edx
je 0x6486a3
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x1c]
xor eax, eax
call fcn.0046cb2b
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x24], dl
lea ebx, [ecx + 0x30]
mov dword [esp + 0x4c], ebx
mov dword [esp], ebx
call fcn.00489310
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x60]
test edx, edx
je 0x6485cf
mov eax, dword [edx]
jmp 0x6485d1
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x25], dl
test dl, dl
je 0x64867c
lea esi, [ecx + 0x78]
mov dword [esp + 0x48], esi
lea edi, [esp + 0x34]
call fcn.0046d00e
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
test eax, 0x80000000
je 0x64862c
shl eax, 1
mov edx, ecx
shl ecx, 1
mov ebx, edx
shr edx, 0x1f
or edx, eax
mov eax, edx
shl edx, 1
shr ecx, 0x1f
or edx, ecx
shr eax, 0x1f
add edx, 0xd7b17f80
adc eax, 0xd
jmp 0x648636
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov ebx, ecx
test edx, edx
sete cl
test eax, eax
sete al
and eax, ecx
test al, al
je 0x64864e
test ebx, 0x3fffffff
je 0x64867c
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x48]
call fcn.0046d00e
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.0046d00e
call fcn.004b1d10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00489690
mov eax, dword [esp + 0x30]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x1c]
call fcn.0046d00e
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call fcn.0046b490
jmp fcn.00648510
Function at 0x64ed20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64ef66
sub esp, 0x74
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x68], eax
xor eax, eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
xor ebp, ebp
jmp 0x64ed91
inc eax
mov esi, edx
mov edx, ebx
mov ebx, ebp
mov ebp, esi
cmp eax, 2
jge 0x64ef30
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
mov dword [esp + 0x58], ebp
lea ecx, [esp + eax*8 + 0x60]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0064e130
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x64eeee
mov eax, dword [esp + 8]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x40], edx
lea ebx, [0x6a9c00]
mov dword [esp], ebx
call fcn.0040d2a0
mov eax, dword [esp + 4]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
lea ecx, [0x68f040]
mov dword [esp], ecx
call fcn.0040d2a0
mov eax, dword [esp + 4]
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x54]
mov dword [esp], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], edx
call fcn.005a87d0
movzx eax, byte [esp + 0x18]
lea edi, [esp + 0x2c]
lea esi, [esp + 8]
call fcn.0046d018
lea edi, [esp + 0x1c]
lea esi, [esp + 0x2c]
call fcn.0046d018
mov edi, dword [esp + 0x70]
lea esi, [esp + 0x1c]
call fcn.0046d018
test al, al
je 0x64ee69
mov eax, 0x10
mov ecx, dword [esp + 0x70]
jmp 0x64ee6d
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x50]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [0x9aef70]
test eax, eax
je 0x64ee8e
call fcn.0046c8a0
mov dword [edi], ecx
mov eax, dword [edx + 8]
mov dword [edi + 4], eax
mov dword [edx + 8], ecx
test ecx, ecx
jne 0x64eebe
mov eax, dword [esp + 0x40]
mov dword [edx + 4], eax
mov eax, dword [0x9aef70]
test eax, eax
jne 0x64eeac
mov eax, dword [esp + 0x54]
jmp 0x64eebc
call fcn.0046c8a0
mov eax, dword [esp + 0x54]
mov dword [edi], eax
mov ecx, dword [edx]
mov dword [edi + 4], ecx
mov dword [edx], eax
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x64eed9
mov ecx, dword [esp + 0x4c]
lea ebx, [0x749c98]
mov ebp, dword [esp + 0x5c]
jmp 0x64ed88
lea ecx, [0x749c98]
mov ebx, dword [esp + 0x48]
mov ebp, edx
mov edx, dword [esp + 0x58]
jmp 0x64ed88
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
add esp, 0x74
ret
mov dword [esp + 0x84], edx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
add esp, 0x74
ret
call fcn.0046b490
jmp fcn.0064ed20
Function at 0x100016d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x240]
lea edi, [ebp - 0x23c]
push ebx
sub esp, 0x254
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x240], 0x104
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.shlwapi.dll_PathCreateFromUrlA]
mov dword [ebp - 0x244], eax
sub esp, 0x10
test byte [0x10003018], 8
jne 0x10001770
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
test edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
cmove ebx, edi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test ebx, ebx
je 0x10001958
mov eax, ebx
shr eax, 0x10
je 0x10001840
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x10001855
cmp byte [ebx], 0
je 0x10001968
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp byte [ebx + edx + 1], 0
jne 0x100017b0
mov byte [ebp - 0x138], 0x22
mov esi, ebx
lea ecx, [ebp - 0x137]
mov dword [ebp + 0x10], ebx
jmp 0x10001808
cmp al, 9
je 0x10001890
cmp al, 0xa
jne 0x100018c5
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
lea ebx, [ebp - 0x15]
lea eax, [edx - 1]
cmp ecx, ebx
ja 0x10001910
test edx, edx
jle 0x10001910
mov edx, eax
movzx eax, byte [esi]
add esi, 1
cmp al, 0xd
je 0x100018a8
jle 0x100017d0
cmp al, 0x22
je 0x100018f8
cmp al, 0x5c
jne 0x100018b9
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x100017f0
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str.__p___s___d__n
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x10005094
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10003018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001720
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x100017f0
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x100017f0
lea ebx, [eax - 0x20]
cmp bl, 0x5e
jbe 0x10001948
mov ebx, 0x785c
add ecx, 4
mov word [ecx - 4], bx
mov ebx, eax
and eax, 0xf
shr bl, 4
movzx eax, byte [eax + str.0123456789abcdefFileProtocolHandlerA]
movzx ebx, bl
movzx ebx, byte [ebx + str.0123456789abcdefFileProtocolHandlerA]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x100017f0
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x100017f0
mov byte [ecx], 0x22
mov ebx, dword [ebp + 0x10]
test eax, eax
jle 0x1000197a
mov esi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], si
mov byte [eax], 0
lea eax, [ebp - 0x138]
mov dword [esp], eax
call sym.___wine_dbg_strdup
mov edx, eax
jmp 0x10001855
mov byte [ecx], al
add ecx, 1
jmp 0x100017f0
mov edx, str._null_
jmp 0x10001855
mov eax, 0x2222
lea ecx, [ebp - 0x137]
mov word [ebp - 0x138], ax
lea eax, [ecx + 1]
jmp 0x1000192a
Function at 0x10001a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001ae8
cmp byte [esi + ebx - 1], 0xa
je 0x10001abc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10002110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x100022e8
mov edi, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100021f7
test byte [0x10003030], 8
jne 0x10002290
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x10002250
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002199
cmp esi, 3
jbe 0x10002208
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100021aa
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10005178]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10002199
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10002170
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10002170
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000215b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10002163
mov eax, 0xffffffff
jmp 0x100021f7