joyce8/EMBER2024-capa huggingface dataset:
Function at 0x687d22a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov edx, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x54
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x48]
mov dword [esp + 4], 8
add eax, 0xc
mov dword [esp + 8], eax
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov edx, dword [ebx + 0x54]
mov dword [ebp - 0x2c], eax
sub esp, 0xc
add eax, dword [edx + 0x48]
mov edx, dword [ebp + 0xc]
mov dword [eax], 0x79616c70
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 4], 0xb0005
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], edx
mov edx, dword [ebx + 0x54]
mov dword [ebp - 0x20], 0
mov edx, dword [edx + 0x34]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], edx
test byte [0x687da07c], 8
jne 0x687d2398
lea eax, [ebp - 0x28]
mov dword [esp], 7
mov ecx, 0x7530
lea edx, [ebp - 0x24]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, ebx
call fcn.687d1d80
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
test byte [0x687da07c], 8
jne 0x687d23d0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov ebx, dword [ebp - 4]
xor eax, eax
sub esp, 0xc
leave
ret
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Asking_for_player_id_w__dwFlags_0x_08x_n
mov dword [esp + 8], str.DP_MSG_SendRequestPlayerId
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x687da07c
mov dword [esp], 3
call fcn.687d1cf0
jmp 0x687d2330
mov eax, dword [eax + 8]
mov dword [esp + 0xc], str.Received_reply_for_id__0x_08x_n
mov dword [esp + 8], str.DP_MSG_SendRequestPlayerId
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x687da07c
mov dword [esp], 3
call fcn.687d1cf0
mov eax, dword [ebp - 0x2c]
jmp 0x687d2368
Function at 0x687d2690
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
movzx edi, word [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x3c]
mov dword [esp], eax
mov dword [ebp - 0x1c], eax
call sub.kernel32.dll_EnterCriticalSection
mov ecx, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [ecx + 0x7c]
mov ebx, edx
jmp 0x687d26d6
mov eax, dword [ebx]
cmp word [ebx + 0xc], di
je 0x687d2708
cmp edx, eax
je 0x687d26da
mov ebx, eax
test ebx, ebx
jne 0x687d26c8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.kernel32.dll_LeaveCriticalSection
sub esp, 4
test byte [0x687da07c], 2
jne 0x687d2790
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sub.kernel32.dll_DebugBreak
mov edx, dword [ebx + 4]
test eax, eax
je 0x687d2780
mov dword [eax + 4], edx
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.kernel32.dll_LeaveCriticalSection
mov dword [ebx + 0x14], esi
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebx + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.kernel32.dll_SetEvent
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ecx + 0x80], edx
jmp 0x687d2712
mov dword [esp + 0xc], str.No_receipt_event_set___only_expecting_in_reply_mode_n
mov dword [esp + 8], str.DP_MSG_ReplyReceived
mov dword [esp + 4], 0x687da07c
mov dword [esp], 1
call fcn.687d1cf0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sub.kernel32.dll_DebugBreak

Function at 0x687d27c0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov edx, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x44
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x48]
mov dword [esp + 4], 8
add eax, 8
mov dword [ebp - 0x28], eax
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov edx, dword [ebx + 0x54]
mov ecx, 0x1388
mov dword [ebp - 0x2c], eax
sub esp, 0xc
add eax, dword [edx + 0x48]
lea edx, [ebp - 0x24]
mov dword [eax], 0x79616c70
mov dword [eax + 4], 0xb03e8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x34]
mov dword [esp], 0x3e8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, ebx
call fcn.687d1d80
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x687d33e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x50]
test eax, eax
je 0x687d3482
test byte [0x687da08c], 1
je 0x687d3482
mov dword [esp + 0xc], str.Should_kill_the_msg_thread_n
mov dword [esp + 8], str.dplobby_destroy
mov dword [esp + 4], 0x687da08c
mov dword [esp], 0
call fcn.687d3010
mov eax, dword [ebx + 0x54]
test eax, eax
jne 0x687d3489
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x18], 0
lea eax, [ebx + 0x34]
mov dword [esp], eax
call sub.kernel32.dll_DeleteCriticalSection
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
mov dword [edx + 4], ecx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [esp], eax
call fcn.687cd1e0
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x687d342c
mov edx, dword [eax]
mov ecx, dword [eax + 4]
test edx, edx
jne 0x687d3470
mov dword [ebx + 0x58], ecx
jmp 0x687d3473
Function at 0x687d6da0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
test byte [0x687da08c], 8
jne 0x687d6eb0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [esp + 8], 0x5c
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x687d6f7f
mov dword [eax], 0x687e14a0
lea eax, [eax + 0x34]
lea edi, [ebx + 0x10]
mov dword [eax - 0x30], 0x687e14e0
mov dword [eax - 0x2c], 0x687e1420
mov dword [eax - 0x28], 0x687e1460
mov dword [eax - 0x24], 0x687e1360
mov dword [eax - 0x20], 0x687e13c0
mov dword [eax - 0x1c], 1
mov dword [eax + 0x1c], 0
mov dword [eax - 0x18], 0
mov dword [eax - 0x14], 0
mov dword [eax - 0x10], 0
mov dword [eax - 0xc], 0
mov dword [eax - 8], 1
mov dword [eax - 4], 0
mov dword [esp], eax
call sub.kernel32.dll_InitializeCriticalSection
mov eax, dword [ebx + 0x34]
mov edx, dword [ebp + 0xc]
sub esp, 4
mov dword [eax + 0x18], str..._.._.._.._proton_wine_dlls_dplayx_dplobby.c:_IDirectPlayLobbyImpl.lock
lea eax, [ebx + 0x54]
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x54], 0
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [eax]
mov esi, eax
mov eax, dword [ebx + 0x10]
sub esp, 0xc
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x687d6f78
mov eax, esi
shr eax, 0x10
je 0x687d6f60
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x687e08a8
mov dword [esp + 4], eax
call fcn.687d2fb0
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x687e0a5b
mov dword [esp + 0x14], ecx
mov dword [esp + 8], str.dplobby_create
mov dword [esp + 4], 0x687da08c
mov dword [esp], 3
call fcn.687d3010
jmp 0x687d6db9
movzx eax, si
mov dword [esp], 0x687e0897
mov dword [esp + 4], eax
call fcn.687d2fb0
jmp 0x687d6f25
mov eax, 0x687e0947
jmp 0x687d6f25
mov esi, 0x8007000e
jmp 0x687d6ea0
Function at 0x687d7ac0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test byte [0x687da09c], 8
jne 0x687d7b50
mov dword [edi], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x687d7c1f
mov dword [eax], str._xhPrh
mov dword [eax + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], eax
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.687d7860
mov esi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x687d7c18
mov eax, esi
shr eax, 0x10
je 0x687d7c00
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x687e1554
mov dword [esp + 4], eax
call fcn.687d7160
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___p__n
mov dword [esp + 8], str.dplobbysp_create
mov dword [esp + 4], 0x687da09c
mov dword [esp], 3
call fcn.687d71c0
jmp 0x687d7ad8
movzx eax, si
mov dword [esp], 0x687e1545
mov dword [esp + 4], eax
call fcn.687d7160
jmp 0x687d7bc5
mov eax, 0x687e153e
jmp 0x687d7bc5
mov esi, 0x8007000e
jmp 0x687d7b42

Function at 0x687d7c30
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
mov esi, dword fs:[0x18]
sub esp, 0x10
mov eax, dword [eax + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx + 0x10]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x687d7e20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [esp + 4], 8
mov esi, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov dword [edi + 0x10], eax
sub esp, 0xc
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sub.ucrtbase.dll_memcpy

Function at 0x687d7e70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
movzx eax, byte [0x687da0ac]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test al, 8
jne 0x687d7f28
test al, 1
jne 0x687d7fd4
mov eax, dword [edi + 0x18]
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
add eax, 0x20
mov dword [ebp - 0x24], eax
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov edx, dword [edi + 4]
mov dword [ebp - 0x28], eax
add eax, dword [edi + 0x18]
sub esp, 0xc
mov dword [ebp - 0x20], edx
mov edx, ebx
shr edx, 7
mov dword [eax + 0x1c], ebx
and edx, 1
mov dword [eax + 0x18], 0
mov dword [ebp - 0x1c], edx
mov dword [eax], 0x79616c70
mov dword [eax + 4], 0xb0002
mov edx, dword [esi]
mov dword [eax + 8], edx
mov edx, dword [esi + 4]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 8]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0x14], edx
mov eax, dword [edi]
lea edx, [ebp - 0x28]
mov dword [esp], edx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x687d8018
mov eax, esi
shr eax, 0x10
je 0x687d8000
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.687d7cb0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.enumerating_for_guid__s_n
mov dword [esp + 8], str.NS_SendSessionRequestBroadcast
mov dword [esp + 4], 0x687da0ac
mov dword [esp], 3
call fcn.687d7d10
movzx eax, byte [0x687da0ac]
test al, 1
je 0x687d7e99
mov dword [esp + 0xc], str.:_not_all_data_fields_are_correct_n
mov dword [esp + 8], str.NS_SendSessionRequestBroadcast
mov dword [esp + 4], 0x687da0ac
mov dword [esp], 0
call fcn.687d7d10
jmp 0x687d7e99
movzx eax, si
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call fcn.687d7cb0
jmp 0x687d7f9d
mov eax, str._null_
jmp 0x687d7f9d
Function at 0x687d80b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov edx, dword [ebp + 8]
sub esp, 0xc
mov dword [edx], eax
test eax, eax
je 0x687d8110
lea edx, [eax + 4]
mov dword [eax + 4], 0
mov dword [eax + 8], edx
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov eax, 1
leave
ret
leave
xor eax, eax
ret
Function at 0x687d85f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0x14]
test byte [0x687da0ac], 1
jne 0x687d86f8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call sub.kernel32.dll_MultiByteToWideChar
mov edx, dword [ebp + 0x10]
mov edi, eax
mov eax, dword [esi + 0x54]
sub esp, 0x18
mov eax, dword [eax + 0x48]
lea eax, [eax + edi*2 + 0x5c]
mov dword [edx], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov edx, dword [ebp + 0xc]
sub esp, 0xc
mov dword [edx], eax
mov edx, dword [esi + 0x54]
add eax, dword [edx + 0x48]
mov dword [eax], 0x79616c70
mov ebx, eax
mov dword [eax + 4], 0xb0001
mov eax, dword [esi + 0x54]
lea edx, [ebx + 8]
add ebx, 0x5c
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 8], ecx
call sub.ucrtbase.dll_memcpy
mov dword [ebx - 4], 0x5c
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], eax
call sub.kernel32.dll_MultiByteToWideChar
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.:_few_fixed__need_to_check_request_for_response__might_need_UNICODE_input_ability._n
mov dword [esp + 8], str.NS_ReplyToEnumSessionsRequest
mov dword [esp + 4], 0x687da0ac
mov dword [esp], 0
call fcn.687d7d10
jmp 0x687d8609
Function at 0x1001f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001f87f
pop dword [ebp - 0x10]
mov eax, 0xee3238c8
add eax, 0x21cfbfb7
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x43571
push 0
mov eax, 0x4a03f76e
add eax, 0xc5ff696e
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x53a5
xor esi, esi
add esi, eax
mov edi, 0x6ed1e4ca
sub edi, 0x5ece26ca
add edi, dword [ebp - 0x10]
mov edx, 0xb75cf1f4
add edx, 0x5d25ca0f
xor dword [ebp - 0xc], ecx
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0xfcff24d5
xor ebx, edx
xor dword [ebp - 8], 0x579ef09c
mov dword [esi], ebx
mov dword [ebp - 0xc], 0x9d4cddf8
add esi, 0xbf9518d7
sub esi, 0xbf9518d3
add edi, 0xf56b2e51
add edi, 0xa94d1b3
loop 0x1001f8da
add eax, 0x2cc69663
add eax, 0xd33aab04
mov ebx, eax
add eax, 0xa2b63d44
add eax, 0x5d49c2c1
mov ecx, 0x285502b4
add ecx, 0xe7aafd4c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001f870
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001f870
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x417b9d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00406a60
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00413de5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x417bdf
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417d3b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421c40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x44b218]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00417fc3
mov ecx, dword [esi*4 + 0x44b218]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x417d34
cmp eax, dword [edi + ecx + 0x24]
jne 0x417d34
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417d34
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00417fc3
add esp, 0x14
test edx, edx
jl 0x417d34
jg 0x417caa
test eax, eax
jb 0x417d34
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x417d34
jl 0x417cc4
cmp dword [ebp - 0x1008], eax
ja 0x417d34
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x417ce2
test ebx, ebx
je 0x417d1b
cmp ecx, edi
jae 0x417d1b
mov al, byte [ecx]
cmp al, 0xd
jne 0x417cfc
lea eax, [edi - 1]
cmp ecx, eax
jae 0x417d08
cmp byte [ecx + 1], 0xa
jne 0x417d08
inc ecx
jmp 0x417d08
movzx eax, al
movsx eax, byte [eax + 0x42e9b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x417ce2
cmp edx, ebx
jne 0x417ce2
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417d39
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405cbb
leave
ret
Function at 0x41e995
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x44b218]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e9d5
cmp byte [ebx], 0xa
jne 0x41e9d5
or byte [eax + edi + 0x28], 4
jmp 0x41e9da
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41ead8
mov al, byte [edx]
cmp al, 0x1a
je 0x41eaba
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41ea09
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41ea2e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41ea38
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41e9eb
jmp 0x41ead8
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41eab5
cmp dword [ebp - 0xc], 0
je 0x41eab5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x44b218]
test byte [eax + edi + 0x28], 0x48
je 0x41ea8f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41ea7a
mov byte [esi], dl
jmp 0x41ea8b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x44b218]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41ead8
cmp byte [ebp - 1], 0xa
jne 0x41ea9e
cmp esi, ebx
jne 0x41ea9e
mov byte [esi], 0xa
jmp 0x41ead7
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00417fe1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41ead8
mov byte [esi], 0xd
jmp 0x41ead7
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x44b218]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41ead4
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ead8
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret