joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret 0x28

Function at 0x1000a4d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1000a5b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a770
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b2c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esp, ebp
pop ebp
ret 8

Function at 0x1000b770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x30]
push eax
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esp, ebp
pop ebp
ret 0x2c

Function at 0x1000ba50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ba70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000bf17
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x38
mov eax, 0x100324aa
call fcn.10010c50
mov ebx, ecx
and dword [ebp - 4], 0
push 0xfa00
call fcn.1001060d
mov edi, eax
mov dword [esp], 0x100415c8
lea ecx, [ebp - 0x2c]
call fcn.10002f59
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.10002eb1
cmp eax, 2
jbe 0x1000bf99
push 2
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.1000be20
mov byte [ebp - 4], 2
push 0x100415d4
mov ecx, eax
call fcn.10008f16
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.10002efe
test esi, esi
jne 0x1000bf99
mov esi, 0x1003faf0
push esi
call fcn.10001970
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.10003006
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10003375
push 0
push edi
push 0x7d00
lea ecx, [ebp - 0x2c]
call fcn.10002eb5
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x7cfe
ja 0x1000bfc8
push edi
jmp 0x1000bfd1
lea ecx, [ebp - 0x2c]
call fcn.10002eb5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
push edi
call fcn.100102bb
pop ecx
cmp ebx, 0xffffffff
jne 0x1000bff3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10002efe
jmp 0x1000c012
test bl, 0x10
jne 0x1000bfe5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10002efe
mov al, 1
jmp 0x1000c014
xor al, al
call fcn.10010b9d
ret

Function at 0x1000c450
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, edi
jmp 0x1000c465
mov ebx, dword [ebp - 4]
add edi, 0x200
test esi, esi
je 0x1000c476
push esi
call fcn.100102bb
pop ecx
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001060d
mov esi, eax
pop ecx
test esi, esi
je 0x1000c4df
xor eax, eax
lea ecx, [ebx + 4]
mov word [esi], ax
call fcn.10002eb5
push eax
push edi
push esi
push 0x1003faf0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
lea ecx, [edi - 1]
cmp ebx, ecx
jae 0x1000c462
push esi
call fcn.10001970
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call fcn.10003006
push esi
call fcn.100102bb
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x1000c4e1
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d654
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x100327a8
call fcn.10010c19
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.NGUtils::AFileVersionInfo.0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.NGUtils::CFileVersionInfo.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000d72a
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x1000d72a
mov byte [ebp - 4], 1
push ebx
call fcn.1001060d
pop ecx
mov dword [esi + 0xc], eax
mov dword [ebp - 4], edi
jmp 0x1000d6d3
cmp dword [esi + 0xc], 0
je 0x1000d72a
push dword [esi + 0xc]
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1000d72a
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push str.VarFileInfoTranslation
push dword [esi + 0xc]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
call edi
test eax, eax
je 0x1000d718
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 4]
push eax
push 0x10040ae4
push dword [esi + 0xc]
call edi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.10010b77
ret 4
Function at 0x1000eacd
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x100328eb
call fcn.10010be2
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000ebea
cmp byte [ebx + 0x3e], 0
je 0x1000ebea
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.10010b71
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x1000eb19
xor al, al
jmp 0x1000ebec
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.1000edf0
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x1000eb49
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.10010b71
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x1000eb7e
sub eax, 1
je 0x1000eb82
dec eax
sub eax, 1
je 0x1000ebd8
xor bl, bl
jmp 0x1000ebda
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x1000eb92
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x1000ebba
cmp eax, 0x10
jae 0x1000eba1
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1001f431
add esp, 0x10
cmp esi, eax
jne 0x1000eb7a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x1000ebd8
test esi, esi
jne 0x1000eb3d
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1000884a
jmp 0x1000eb37
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100081ee
mov al, bl
jmp 0x1000ebec
mov al, 1
call fcn.10010b8c
ret

Function at 0x10026468
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002612b

Function at 0x10026473
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100262ac

Function at 0x1002a25d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10029f1d
Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret

Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.1001e2a3
pop ecx
pop edi
pop esi
ret
Function at 0x1001e2a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001e2b2
pop dword [ebp - 0x24]
mov eax, 0x1001e2b2
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xf191b877
add dword [ebp - 0x34], 0x5cc08cd4
mov dword [ebp - 0x30], 0x9dc469cf
sub dword [ebp - 0x30], 0x6b911d8a
mov dword [ebp - 0x2c], 0xb7d899a9
sub dword [ebp - 0x2c], 0x6b8c557b
mov dword [ebp - 0x28], 0xf9053721
sub dword [ebp - 0x28], 0xf9053721
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe93c4edd
sub dword [ebp - 0x34], 0x74c9e587
mov dword [ebp - 0x30], 0x149092d1
sub dword [ebp - 0x30], 0xd324315c
mov dword [ebp - 0x2c], 0x16d82e6c
add dword [ebp - 0x2c], 0x4c973e00
mov dword [ebp - 0x28], 0xd5bba411
sub dword [ebp - 0x28], 0xd5bba411
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x8c0fc83d
sub eax, 0x7c0dd7f9
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3cb40
push 0
call eax
mov ecx, 0x56e2
mov ebx, eax
mov esi, 0xfd8dba9f
add esi, 0x12753761
add esi, dword [ebp - 0x24]
mov edx, 0x40303741
xor dword [ebp - 0xc], esi
mov edi, dword [esi]
add dword [ebp - 0x1c], esi
sub edi, edx
mov dword [ebx], edi
add dword [ebp - 0x14], esi
add ebx, 0x46b79257
sub ebx, 0x46b79253
add esi, 0xc4e3aee
add esi, 0xf3b1c516
loop 0x1001e3be
add eax, 0xbebc941
add eax, 0xf415851a
xor ebx, ebx
add ebx, eax
add eax, 0x4b79dea3
add eax, 0xb4862162
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x10001950
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [ebp - 0x14], edx
mov esi, dword [sym.imp.shlwapi.dll_UrlEscapeA]
mov dword [esp + 4], edx
mov dword [ebp - 0x10], 1
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], edi
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x14]
sub esp, 0x10
cmp eax, 0x80004003
je 0x100019a0
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov ecx, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x10001a1a
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [ebp - 0x14], eax
mov dword [esp], ebx
call esi
mov edx, dword [ebp - 0x14]
sub esp, 0x10
test eax, eax
je 0x10001990
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, ebx
sub esp, 0xc
jmp 0x10001990
mov edx, ebx
jmp 0x10001990
Function at 0x10002980
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x1c
mov edx, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], ecx
mov dword [ebp - 0x1c], edx
call edx
mov ecx, dword [ebx]
mov dword [esp + 4], 0
add eax, 1
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
lea ecx, [esi + ecx*4]
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], edx
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
call eax
mov ecx, dword [ebp - 0x10]
sub esp, 0xc
mov dword [ecx], eax
mov eax, dword [ebx]
lea ecx, [eax + 1]
mov dword [ebx], ecx
mov eax, dword [esi + eax*4]
mov dword [esp + 4], edi
mov edi, dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esp], eax
call edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x10002a4a
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [esp], ecx
call edx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebx]
mov dword [esp + 4], 0
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
lea ecx, [esi + ecx*4]
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
call eax
mov ecx, dword [ebp - 0x10]
sub esp, 0xc
mov dword [ecx], eax
mov eax, dword [ebx]
lea edx, [eax + 1]
mov dword [ebx], edx
mov ebx, dword [ebp + 8]
mov eax, dword [esi + eax*4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10003800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10003858
cmp byte [esi + ebx - 1], 0xa
je 0x1000382c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10009084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10003e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10004058
mov edi, dword [0x10009084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10003f67
test byte [0x10005050], 8
jne 0x10004000
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10005060], 8
jne 0x10003fc0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10003f09
cmp esi, 3
jbe 0x10003f78
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x10003f1a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100075d8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10003f09
mov dword [esp], 0x10005060
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10003ee0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10003ee0
mov dword [esp], 0x10005050
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10003ecb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10003ed3
mov eax, 0xffffffff
jmp 0x10003f67
Function at 0x1000dc83
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 0x20]
push ebx
mov ebx, dword [edx + 0x20]
push esi
mov esi, dword [edx + 0x6c]
imul esi, dword [edx + 0x60]
add esi, ebx
cmp ebx, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], esi
jae 0x1000ddb1
mov eax, 0xf81f
push edi
mov edi, dword [edx + 0x60]
mov edx, dword [edx + 0x68]
lea edx, [ebx + edx*2]
add edi, ebx
cmp ebx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edx
jae 0x1000dd91
movzx ecx, word [edi]
movzx edx, word [edi + 2]
movzx esi, word [ebx + 2]
mov dword [ebp - 4], ecx
movzx ecx, word [ebx]
mov ebx, ecx
and bx, ax
mov edi, edx
and di, ax
mov dword [ebp - 0x1c], ecx
and ecx, 0xffff07e0
add edi, ebx
mov ebx, dword [ebp - 4]
and bx, ax
add edi, ebx
mov ebx, esi
and bx, ax
lea edi, [edi + ebx + 0x1002]
mov ebx, edx
and ebx, 0xffff07e0
add ebx, ecx
mov ecx, dword [ebp - 4]
and ecx, 0xffff07e0
add ebx, ecx
mov ecx, esi
and ecx, 0xffff07e0
lea ecx, [ebx + ecx + 0x40]
mov ebx, dword [ebp - 0xc]
shr ecx, 2
shr edi, 2
xor edi, ecx
mov ecx, dword [ebp - 0x1c]
and ecx, eax
and edx, eax
add edx, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add edx, ecx
and esi, eax
and edi, 0xffff07e0
lea ecx, [edx + esi + 0x1002]
shr ecx, 2
xor edi, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 2
mov word [ecx], di
mov edi, dword [ebp - 0x10]
add ebx, 4
add edi, 4
cmp ebx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
jb 0x1000dcdc
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov edi, dword [edx + 4]
add ecx, dword [edi + 0x60]
mov edx, dword [edx]
mov edi, dword [edx + 0x60]
lea ebx, [ebx + edi*2]
cmp ebx, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
jb 0x1000dcbd
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1000debc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ecx + 4]
push ebx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ecx]
mov ebx, dword [ecx + 0x20]
push esi
mov esi, dword [eax + 0x20]
mov eax, dword [ecx + 0x6c]
imul eax, dword [ecx + 0x60]
add eax, ebx
cmp ebx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], eax
jae 0x1000dfdf
mov eax, 0x83e0
mov edx, 0x7c1f
push edi
mov edi, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x68]
lea ecx, [ebx + ecx*2]
add edi, ebx
cmp ebx, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], ecx
jae 0x1000dfbb
movzx ecx, word [ebx + 2]
movzx esi, word [edi + 2]
mov dword [ebp - 8], ecx
movzx ecx, word [edi]
movzx edi, word [ebx]
mov dword [ebp - 4], ecx
mov ebx, edi
and ebx, eax
mov ecx, esi
and ecx, eax
add ecx, ebx
mov ebx, dword [ebp - 4]
and ebx, eax
add ecx, ebx
mov ebx, dword [ebp - 8]
and ebx, eax
lea ebx, [ecx + ebx + 0x10040]
mov dword [ebp - 0x20], edi
and edi, edx
mov ecx, esi
and ecx, edx
add ecx, edi
mov edi, dword [ebp - 4]
and edi, edx
add ecx, edi
mov edi, dword [ebp - 8]
and edi, edx
lea ecx, [ecx + edi + 0x802]
shr ecx, 2
mov edi, dword [ebp - 0x14]
shr ebx, 2
xor ebx, ecx
mov ecx, dword [ebp - 0x20]
and ecx, eax
and esi, eax
add esi, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add esi, ecx
mov ecx, dword [ebp - 8]
and bx, dx
and ecx, eax
lea ecx, [esi + ecx + 0x10040]
shr ecx, 2
add edi, 4
mov dword [ebp - 0x14], edi
xor ebx, ecx
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0xc], 2
mov word [ecx], bx
mov ebx, dword [ebp - 0x10]
add ebx, 4
cmp ebx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ebx
jb 0x1000df18
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov edi, dword [ecx + 4]
mov esi, dword [ebp - 0x18]
add esi, dword [edi + 0x60]
mov ecx, dword [ecx]
mov edi, dword [ecx + 0x60]
lea ebx, [ebx + edi*2]
cmp ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
jb 0x1000def9
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret