joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bcc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x228
push str._PRINT_CONSOLE_
call fcn.0040d5b8
add esp, 4
test eax, eax
je 0x40bd09
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0x419988
push str.conout_
call fcn.0040d5a5
add esp, 8
mov dword [0x41c3ec], eax
test eax, eax
je 0x40bd17
push 0
push 4
push 0
push eax
call fcn.0040d4e4
add esp, 0x10
jmp 0x40bd17
mov eax, 0x4199d0
test eax, eax
je 0x40bd17
mov dword [0x41c3ec], eax
push str._PRINT_FILE_
call fcn.0040d5b8
add esp, 4
test eax, eax
je 0x40bd4e
push 0x419968
push 0x41994c
call fcn.0040d1c5
add esp, 4
push eax
call fcn.0040d418
add esp, 8
mov dword [0x41c3f0], eax
test eax, eax
je 0x40bda9
jmp 0x40bd9a
lea ecx, [esp]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp]
push 0x417830
push edx
call fcn.0040bf2b
mov eax, dword [esp + 0x234]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0040bf2b
lea edx, [esp + 0x10]
push 0x419968
push edx
call fcn.0040d418
add esp, 0x18
mov dword [0x41c3f0], eax
test eax, eax
je 0x40bda9
push 0
push 4
push 0
push eax
call fcn.0040d4e4
add esp, 0x10
add esp, 0x228
ret

Function at 0x40be28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40be80
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x41c254
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40be73
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40be82
xor eax, eax
pop esi
leave
ret 4
Function at 0x4119f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41bf38
cmp edx, dword [eax]
je 0x411a18
add eax, 8
inc ecx
cmp eax, 0x41bfc8
jl 0x411a09
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41bf38]
jne 0x411b46
mov eax, dword [0x41c41c]
cmp eax, 1
je 0x411b20
test eax, eax
jne 0x411a49
cmp dword [0x419c34], 1
je 0x411b20
cmp edx, 0xfc
je 0x411b46
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x411a80
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00414190
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004112c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x411ac3
lea eax, [ebp - 0x1a4]
push eax
call fcn.004112c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x415a1c
push edi
call fcn.0040c680
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00414190
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004141a0
lea eax, [ebp - 0xa0]
push 0x4159fc
push eax
call fcn.004141a0
push dword [esi + 0x41bf3c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004141a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00414280
add esp, 0x2c
pop edi
jmp 0x411b46
lea eax, [ebp + 8]
lea esi, [esi + 0x41bf3c]
push 0
push eax
push dword [esi]
call fcn.004112c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10016550
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10016550
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret

Function at 0x401050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push 0x402128
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x401088
push edi
push str.Failed_to_open_file:__s_n
call fcn.00401010
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 4
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010e7
push edi
push str.fileSize:_d_n
call fcn.00401010
push str.Memory_error_n
call fcn.00401010
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, edi
je 0x401123
push str.Reading_error_n
call fcn.00401010
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 4]
add esp, 4
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436fe3
Capabilities:
Parse pe header

Disassembly:
push eax
push eax
mov ecx, dword [esp + 8]
add esp, 0xc
push ecx
push 0x13
pop ecx
sub dword [esp], ecx
pop ecx
add ebx, 0x2104010
push 6
pop ebx
mov dword [ecx], ebx
push edi
push edi
mov ecx, dword [esp + 8]
add esp, 0xc
mov ebx, esp
mov ebx, dword [ebx]
add esp, 4
pushal
call 0x436df7
pop ebx
mov eax, 0x50031494
sub eax, 0x50031202
add eax, ebx
xor dword [eax], 0x78c9aed2
call 0x436fe3
jmp 0x436f47
call fcn.00436e14
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add byte [ecx - 0x17], ah
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
mov ebx, 0x77000000
add ebx, 0x10000
cmp ebx, 0x80000000
jne 0x436ffe
mov ebx, 0xbff00000
call fcn.00437042
cmp eax, 0
je 0x436feb
cmp word [ebx], 0x5a4d
jne 0x436feb
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp word [eax], 0x4550
jne 0x436feb
test byte [eax + 0x17], 0x20
je 0x436feb
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, dword [eax + 0xc]
add edx, ebx
cmp dword [edx], 0x4e52454b
jne 0x436feb
cmp dword [edx + 4], 0x32334c45
jne 0x436feb
mov eax, ebx
mov esp, ebp
pop ebp
ret
Function at 0x437d0d
Capabilities:
Check for trap flag exception

Disassembly:
xor edx, edi
xor edx, edi
pushal
add edi, 0x7723
sub edi, 0x7723
call 0x437d23
push edx
push esi
add edx, ecx
add esi, eax
pop esi
pop edx
pop edx
mov eax, 0x109
pushal
add ebx, esi
popal
xor edi, esi
xor edi, esi
add eax, edx
push edi
push ebx
pop ebx
pop edi
push edi
dec edi
pop edi
push eax
push esi
str esi
pop esi
xor edx, ecx
xor edx, ecx
mov edx, 0
push dword fs:[edx]
jmp 0x437d57
mov dword fs:[edx], esp
pushal
popal
push esi
neg esi
pop esi
push edi
neg edi
pop edi
push esi
mov esi, ecx
pop esi
mov ecx, 0
pushal
mov eax, ebx
popal
pushal
xor edx, 0x5df
nop
mov ecx, 0x6197
popal
pushal
add esi, edi
add edi, esi
popal
div ecx
push ebx
lar ebx, ecx
pop ebx
push edx
str edx
pop edx
push edi
mov edi, esi
pop edi
mov ecx, edx
pushfd
nop
nop
pushfd
xchg esi, edi
xchg edi, esi
or dword [esp], 0x100
xor edx, edi
xor edx, edi
popfd
inc edx
popfd
pushal
sub esi, ebx
add ebx, edi
popal
cmp edx, ecx
nop
nop
je 0x437de1
push eax
dec eax
pop eax
push 0x8caf1379
pushal
nop
mov esi, 0x1f18
xor ecx, 0x275c
popal
mov edx, 0xc12ade99
pushal
nop
mov edx, 0x92f
popal
ret
pushal
mov ebx, esi
add esi, edi
popal
verr di
push ebx
mov ebx, 0xc101
pop ebx
mov ecx, 0
add edi, 0x1166
sub edi, 0x1166
verr di
push ecx
push edx
xor ecx, esi
xor edx, esi
pop edx
pop ecx
pop dword fs:[ecx]
xor edx, ecx
xor edx, ecx
verr di
push edx
xor edx, eax
pop edx
pop eax
push edi
not edi
pop edi
pushal
mov ebx, esi
popal
inc ebx
dec ebx
popal
jmp 0x437f5a
pushal
xor edi, esi
popal
push eax
push ebx
add esp, 8
push ecx
lar ecx, edx
pop ecx
push edi
push esi
xor esi, edi
pop esi
push ecx
str ecx
pop ecx
inc esi
dec esi
push esi
call fcn.004380f0
pop ecx
loope 0x437fb8
sub ebp, edi
jne 0x437f81
inc esp
add eax, 0x3733d7fd
push edi
out dx, al
pop ebp
imul esp, dword [esi + 0x3f], 0x1e76ba86
rcl cl, cl
xchg ecx, eax
outsb dx, byte [esi]
bound ebp, qword [eax + ebp*4]
pushal
in al, dx
invalid
insb byte es:[edi], dx
mov eax, dword [0xd728151a]
outsd dx, dword [esi]
sub ebx, eax
sbb eax, 0x79889ec0
sub al, al
add eax, 0x975a636a
jns 0x437fe2
rol byte [0x975a636a], 0x73
sar dword [ebp + 0x31], cl
xchg edi, eax
jae 0x437f95
jge 0x437ff5
cmp dword [0x9964c6f], ecx
shl dword [edx], 0xf1
lds esi, [esp + eax*8 + 2]
xchg ecx, eax
stosb byte es:[edi], al
adc byte [edi], ch
pop esp
loop 0x437fab
pop esi
ficom word [ebx]
loopne 0x437fdf
pop ds
jne 0x437ff3
adc ecx, dword [esi - 0x37]
dec esi
leave
jns 0x437fbf
push ebp
in al, dx
pop esi
jnp 0x438028
lea esi, [edi - 0xfb68687]
shr dword [ebx + 0x37], 0xa
sbb eax, dword [ebp + 0x49]
dec ecx
xor ebp, 0x4e
cmp esi, dword ss:[si - 0x134b]
cmp eax, 0xc95c4869
nop
fcom qword [esi + edx*8 - 0x58]
inc edi
mov dl, 0x7d
add eax, 0x76e638d2
lahf
dec eax
pop edx
test byte [esi], dh
insd dword es:[edi], dx
dec ebx
cmp al, 0xdd
test ah, ah
loopne 0x438040
xor cl, ch
rcl byte [0x6b2da6b5], 0xb
movsb byte es:[edi], byte [esi]
push 0x37
adc esp, dword [edx + 0x1bd963ec]
dec esi
adc cl, byte [ecx + ebp*4 + 0x79]
ret 0xd19f
push edx
mov al, 0x90
jmp 0xd440978b
Function at 0x100011e3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
xor ecx, ecx
mov cx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
jmp 0x10001224
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
add ecx, 0x28
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 0x14], ecx
jge 0x100012d7
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x1000128b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jle 0x10001289
push 4
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [0x100328bc]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.10001e30
add esp, 0xc
jmp 0x10001212
push 4
push 0x1000
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
call dword [0x100328bc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10001af0
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
jmp 0x10001212
mov esp, ebp
pop ebp
ret
Function at 0x100012db
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x10001313
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x1000142c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
test ecx, ecx
je 0x10001393
push 0x4000
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [0x100328b8]
jmp 0x10001301
mov eax, dword [ebp - 0x10]
shl eax, 4
mov ecx, dword [ebp - 0x20]
lea edx, [eax + ecx*8 + 0x10008030]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
test eax, eax
je 0x100013c4
mov ecx, dword [ebp - 0x18]
or ch, 2
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10001408
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x40
test edx, edx
je 0x100013ed
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
jmp 0x10001408
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
test ecx, ecx
je 0x10001408
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jbe 0x10001427
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001301
mov esp, ebp
pop ebp
ret

Function at 0x100019ed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x100019ff
jmp 0x10001a3b
mov ecx, dword [ebp + 8]
mov dword [0x100328c0], ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100022a0
add esp, 4
call fcn.10001880
push 0
push 0
push 0
push 0x100019a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401410
Capabilities:
Contain obfuscated stackstrings
Listen for remote procedure calls

Disassembly:
push ebp
xor eax, eax
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x54
mov dword [ebp - 0x34], 0x63006e
mov dword [ebp - 0x30], 0x630061
mov dword [ebp - 0x2c], 0x5f006e
mov dword [ebp - 0x28], 0x70006e
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], 0x70005c
mov dword [ebp - 0x1e], 0x700069
mov dword [ebp - 0x1a], 0x5c0065
mov dword [ebp - 0x16], 0x760073
mov dword [ebp - 0x12], 0x630063
mov dword [ebp - 0xe], 0x6c0074
mov word [ebp - 0xa], dx
call dword [sym.imp.kernel32.dll_CreateThreadpoolCleanupGroup]
mov dword [0x419068], eax
test eax, eax
je 0x4015df
lea eax, [ebp - 0x22]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerUseProtseqEpW]
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x4014c0
test byte [0x419020], 2
jne 0x401580
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x41936c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerRegisterIf]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401520
test byte [0x419020], 2
je 0x4014b5
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerRegisterIf_failed_with_error__lu_n
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 4], 0x419020
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4014b5
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4d2
mov dword [esp], 1
call dword [sym.imp.rpcrt4.dll_RpcServerListen]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4015b0
test byte [0x419020], 2
je 0x4014b5
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerListen_failed_with_error__lu_n
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 4], 0x419020
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4014b5
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerUseProtseq_failed_with_error__lu_n
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 4], 0x419020
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x4190e4
mov dword [esp + 4], 0x3e8
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
test byte [0x419020], 2
jne 0x4015f6
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
jmp 0x4014b5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], 0x41a4b8
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x419020
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4015e8
Function at 0x403c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x403c7b
cmp byte [esi + ebx - 1], 0xa
je 0x403c4f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x419238], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x403fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea edx, [ebp - 0x10]
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 4
mov dword [eax], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x404068
cmp eax, 2
je 0x404090
test byte [0x419040], 2
jne 0x404028
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], str.load_reg_dword
mov dword [esp + 4], 0x419040
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0xc]
sub eax, 3
cmp eax, 1
ja 0x404079
cmp dword [ebp - 0x10], 4
je 0x40401c
mov ebx, 0x70c
test byte [0x419040], 2
je 0x40401c
jmp 0x404028
lea esp, [ebp - 8]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
Function at 0x4040a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [ebp - 0x2c], eax
call eax
sub esp, 0x18
test eax, eax
je 0x404160
mov ebx, eax
xor edx, edx
cmp eax, 2
je 0x404200
test byte [0x419040], 2
jne 0x404120
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], str.load_reg_multisz
mov dword [esp + 4], 0x419040
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
mov edx, dword [ebp - 0x2c]
jmp 0x404104
mov eax, dword [ebp - 0x1c]
cmp eax, 7
je 0x404190
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x404174
cmp eax, 1
je 0x404190
mov ebx, 0x70c
xor edx, edx
test byte [0x419040], 2
je 0x404104
jmp 0x404120
mov eax, dword [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x14], edi
mov dword [ebp - 0x30], eax
mov dword [esp + 0x10], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
mov edx, dword [ebp - 0x30]
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x4040fb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
xor esi, esi
xor edx, edx
and eax, 0xfffffffe
mov word [ecx + eax], dx
mov word [ecx + eax + 2], si
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 2
xor ebx, ebx
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret