joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42796e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428f7d
mov eax, dword fs:[0]
push eax
mov eax, 0x10050
call fcn.004213e0
mov eax, dword [0x435398]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1003c], ecx
lea ecx, [ebp - 0x10038]
xor ebx, ebx
push ecx
mov esi, edx
mov dword [ebp - 0x10040], eax
mov dword [ebp - 0x10034], ebx
push eax
lea edi, [ebp - 0x10034]
mov eax, esi
mov dword [ebp - 0x10034], ebx
mov dword [ebp - 0x10038], ebx
call fcn.004276af
mov eax, dword [ebp - 0x10038]
push ebx
shr eax, 1
push eax
lea ecx, [ebp - 0x10030]
call fcn.00403ea4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10034]
mov edx, esi
call fcn.0042787b
cmp dword [ebp - 0x10018], 8
mov eax, dword [ebp - 0x1002c]
jae 0x427a14
lea eax, [ebp - 0x1002c]
mov ebx, dword [ebp - 0x10038]
push eax
push dword [ebp - 0x10040]
call fcn.00427781
mov eax, dword [ebp - 0x1001c]
xor ebx, ebx
cmp eax, ebx
je 0x427a6d
lea esi, [eax - 1]
cmp eax, esi
ja 0x427a44
call fcn.0040eab0
mov eax, dword [ebp - 0x1001c]
cmp dword [ebp - 0x10018], 8
mov ecx, dword [ebp - 0x1002c]
jae 0x427a59
lea ecx, [ebp - 0x1002c]
cmp word [ecx + esi*2], bx
jne 0x427a6d
push ebx
dec eax
push eax
lea ecx, [ebp - 0x10030]
call fcn.0040695c
cmp dword [ebp - 0x10034], 2
jne 0x427ad6
cmp dword [ebp - 0x10018], 8
mov eax, dword [ebp - 0x1002c]
jae 0x427a8b
lea eax, [ebp - 0x1002c]
push 0x8000
lea ecx, [ebp - 0x10014]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
push eax
lea eax, [ebp - 0x10014]
push eax
lea ecx, [ebp - 0x1005c]
call fcn.00406d90
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x10030]
mov byte [ebp - 4], 1
call fcn.004045d6
push ebx
push 1
lea ecx, [ebp - 0x1005c]
mov byte [ebp - 4], bl
call fcn.004046c7
mov ecx, dword [ebp - 0x1003c]
lea eax, [ebp - 0x10030]
push eax
call fcn.00403ecc
push ebx
push 1
lea ecx, [ebp - 0x10030]
call fcn.004046c7
mov eax, dword [ebp - 0x1003c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00411fc4
leave
ret 4
Function at 0x427b18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x428fb5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x435398]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov eax, dword [0x435398]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00425c6f
pop ecx
mov edx, dword [esp + 8]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x5c], ebx
call fcn.0042796e
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x64], 1
call fcn.004045d6
push ebx
push 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], bl
call fcn.004046c7
push 1
push ebx
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.004259f7
pop ecx
pop ecx
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.004046c7
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00411fc4
mov esp, ebp
pop ebp
ret 4
Function at 0x419348
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0xfffefdfc
mov ecx, 0x40
mov ebx, dword [ebp + 0x10]
mov dword [ebx + ecx*4 - 4], eax
sub eax, 0x4040404
dec ecx
jne 0x41935b
mov edi, dword [ebp + 0xc]
mov esi, 0x40
xor ebx, ebx
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x419375
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 8]
mov esi, 0x20
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x4193ae
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov esi, 0x40
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x4193e7
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41941c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
xor edx, edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x419468
push ebp
mov ebp, dword [ebp + 0x10]
mov dl, byte [ebp + ecx]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
mov dl, byte [ebp + edx]
inc dl
mov al, byte [ebp + edx]
xor byte [edi], al
mov dl, byte [ebp + ebx]
xchg byte [ebp + ecx], dl
mov byte [ebp + ebx], dl
inc cl
inc edi
dec esi
test esi, esi
jne 0x419439
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4b84b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046f0
xor eax, eax
push ebp
push 0x4b852c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404294
mov eax, dword [ebp - 4]
call fcn.00404500
mov esi, eax
test esi, esi
jle 0x4b8516
mov ebx, 1
mov eax, edi
call fcn.00404758
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4b84f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8533
lea eax, [ebp - 4]
call fcn.00404240
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x2da1406a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x21394bc3
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.2580f460
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.2580f460
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.2580f460
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.2580f460
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.2580f460
pop ecx
jmp 0x258071e5
Function at 0x2580f460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x2580f46f
pop dword [ebp - 0x38]
mov eax, 0x2580f46f
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x5173e8a5
add dword [ebp - 0x48], 0xfcde5ca6
mov dword [ebp - 0x44], 0xd74b474a
add dword [ebp - 0x44], 0x5ae804fb
mov dword [ebp - 0x40], 0x64e56958
add dword [ebp - 0x40], 0xe766dad6
mov dword [ebp - 0x3c], 0x1b706b18
sub dword [ebp - 0x3c], 0x1b706b18
lea eax, [ebp - 0x48]
push eax
mov eax, 0x206e90b
add eax, 0x237ae739
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x941ffe58
add dword [ebp - 0x48], 0xe0526afe
mov dword [ebp - 0x44], 0x99c1a673
add dword [ebp - 0x44], 0xa7aabb02
mov dword [ebp - 0x40], 0x3b21b31f
sub dword [ebp - 0x40], 0xd7b246b3
mov dword [ebp - 0x3c], 0x7512261a
add dword [ebp - 0x3c], 0x8aedd9e6
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x2f15443c
sub eax, 0x99373bc
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d3c0
push 0
call eax
mov ecx, 0x4987
xor edi, edi
add edi, eax
mov ebx, 0x25829600
add ebx, dword [ebp - 0x38]
mov edx, 0x964aedfc
xor dword [ebp - 0x20], 0x8519cca5
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x5dcc37b7
xor esi, edx
sub dword [ebp - 4], ebx
mov dword [edi], esi
xor dword [ebp - 8], ebx
add edi, 0x2c14798c
sub edi, 0x2c147988
add ebx, 0x3b55cfc
sub ebx, 0x3b55cf8
loop 0x2580f57c
add eax, 0xc8b0903d
sub eax, 0xc8af774e
mov ebx, eax
add eax, 0x9f3fae6c
add eax, 0x60c05199
mov ecx, 0x2cf38adb
add ecx, 0xf88c7525
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x46743c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x467444
mov eax, edx
pop esi
pop ebx
ret

Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f
Function at 0x401480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4014db
cmp byte [esi + ebx - 1], 0xa
je 0x4014af
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x404084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x404094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401bf0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x404094]
movzx eax, al
bt eax, esi
jae 0x401c50
mov ecx, dword [0x404084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401af6
test byte [0x402018], 8
jne 0x401b90
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402028], 8
jne 0x401b40
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401ac5
cmp esi, 3
jbe 0x401b00
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030e0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401ac5
mov ecx, dword [0x404094]
test ecx, ecx
je 0x401c30
mov dword [esp], 0x402028
call dword [0x404094]
test al, 8
je 0x401a9c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401a9c
mov ebx, dword [0x404094]
test ebx, ebx
je 0x401c10
mov dword [esp], 0x402018
call dword [0x404094]
test al, 8
je 0x401a89
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401a8f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x404094
call sym._load_func.part.0
jmp 0x401a50
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x404094
call sym._load_func.part.0
jmp 0x401b9a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x404094
call sym._load_func.part.0
jmp 0x401b4e
mov eax, 0xffffffff
jmp 0x401af6
Function at 0x401db0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401496
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x34], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [str._Y_5]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5d4]
mov dword [ebp - 0x30], eax
call fcn.0040148f
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5d8]
add edi, 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5dc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], eax
pop esi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0x2d4f3ec]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40151f
push 0x418248
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x2d4f3ec]
add eax, dword [ebp - 0x20]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d4f3e8]
mov dword [ebp - 0x1c], 0xedeb2e40
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp ecx, 0x3eb
mov dword [0x2d4f3e8], eax
mov eax, dword [0x2d4f340]
cmove eax, dword [ebp - 0x1c]
mov dword [0x2d4f340], eax
lea eax, [edi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov dword [0x2d4f3e4], 0xf4ea3dee
call fcn.0040146c
mov ecx, dword [ebp - 0x10]
xor ecx, eax
sub ebx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4014e7
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4015ef
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x2d4f3ec]
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2d4f344]
test esi, esi
je 0x401632
cmp eax, 0x959
jne 0x40161e
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, edi
call fcn.00401496
add edi, 8
dec esi
je 0x401632
mov eax, dword [0x2d4f3ec]
jmp 0x401605
pop edi
pop esi
ret 4
Function at 0x40d179
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a36c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00405045
mov dword [ebp - 0x14], eax
cmp dword [0x455aa0], esi
jne 0x40d26c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d1f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d34c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d34c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d34c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x455aa0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x455aa4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x455aa8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x455ab0], eax
test eax, eax
je 0x40d269
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x455aac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d291
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d284
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d2a6
push 4
pop eax
jmp 0x40d34e
cmp dword [ebp - 0x14], esi
je 0x40d2a6
push dword [0x455aa0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d28b
mov eax, dword [0x455aac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d304
cmp dword [0x455ab0], edi
je 0x40d304
push eax
call ebx
push dword [0x455ab0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d304
test eax, eax
je 0x40d304
call ecx
test eax, eax
je 0x40d2f9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d2f9
test byte [ebp - 8], 1
jne 0x40d304
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d334
mov eax, dword [0x455aa4]
cmp eax, edi
je 0x40d331
push eax
call ebx
test eax, eax
je 0x40d331
call eax
mov esi, eax
test esi, esi
je 0x40d331
mov eax, dword [0x455aa8]
cmp eax, edi
je 0x40d331
push eax
call ebx
test eax, eax
je 0x40d331
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x455aa0]
call ebx
test eax, eax
je 0x40d34c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d34e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040432b
mov esp, ebp
pop ebp
ret
Function at 0x471d53
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x471d81
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x471d6d
pop edi
pop esi
ret