joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10102770
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
cmp eax, 0x10000001
jae 0x101028f5
mov ebx, ecx
dec eax
or eax, 1
bsr ecx, eax
xor ecx, 0x1f
neg cl
mov esi, 1
shl esi, cl
lea eax, [ebx + 0xc]
mov edi, dword [ebx + 4]
mov edx, 2
shl edx, cl
mov ecx, eax
push edi
push edx
call fcn.101022f0
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov eax, dword [ebx + 4]
mov eax, dword [eax]
cmp eax, edi
je 0x101028eb
mov dword [esp + 4], ebx
mov dword [esp], edi
jmp 0x101027e4
mov dword [edx + ebx*4], ecx
mov dword [edx + esi*4], ecx
mov ebx, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x101028eb
mov ecx, eax
mov eax, dword [eax]
mov dword [esp + 0xc], eax
movzx edx, byte [ecx + 8]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
movzx esi, byte [ecx + 9]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [ecx + 0xa]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [ecx + 0xb]
xor esi, edx
imul edi, esi, 0x1000193
and edi, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
mov eax, ebx
lea ebx, [edi + edi]
lea esi, [edi*2 + 1]
mov ebp, dword [edx + edi*8]
mov edi, dword [esp]
cmp ebp, edi
je 0x101027d0
mov dword [esp + 8], ebx
mov edi, dword [edx + esi*4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [edi + 8]
je 0x10102890
mov eax, dword [esp + 0xc]
nop
cmp ebp, edi
je 0x101028bd
mov edi, dword [edi + 4]
cmp ebx, dword [edi + 8]
jne 0x10102850
mov edx, dword [edi]
mov esi, dword [ecx + 4]
mov dword [esi], eax
mov edi, dword [eax + 4]
mov dword [edi], edx
mov ebx, dword [edx + 4]
mov dword [ebx], ecx
mov dword [edx + 4], edi
mov dword [eax + 4], esi
mov dword [ecx + 4], ebx
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp eax, edi
jne 0x101027e4
jmp 0x101028eb
mov edi, dword [edi]
cmp edi, ecx
mov eax, dword [esp + 0xc]
je 0x101028d9
mov ebx, dword [ecx + 4]
mov dword [esp + 8], ebx
mov dword [ebx], eax
mov ebp, dword [eax + 4]
mov dword [ebp], edi
mov ebx, dword [edi + 4]
mov dword [ebx], ecx
mov dword [edi + 4], ebp
mov edi, dword [esp + 8]
mov dword [eax + 4], edi
mov dword [ecx + 4], ebx
jmp 0x101028d9
mov esi, dword [ecx + 4]
mov dword [esi], eax
mov edi, dword [eax + 4]
mov dword [edi], ebp
mov ebx, dword [ebp + 4]
mov dword [ebx], ecx
mov dword [ebp + 4], edi
mov dword [eax + 4], esi
mov dword [ecx + 4], ebx
mov esi, dword [esp + 8]
mov dword [edx + esi*4], ecx
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp eax, edi
jne 0x101027e4
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x405d7e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7bd244], 0
push esi
jne 0x405db5
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d8f
mov dword [ecx*4 + 0x7bd240], eax
inc ecx
cmp ecx, 0x100
jl 0x405d8a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405de6
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7bd240]
xor eax, esi
inc ecx
dec edx
jne 0x405dc8
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2a5b40b9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x36fa6795
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100014f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10006014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
push dword [ebp - 8]
mov edi, eax
call esi
add edi, eax
lea eax, [edi*2 + 0x50]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 0xc]
push ebx
push str._s_failed_with_error__d:__s
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
shr eax, 1
push eax
push edi
call fcn.10001180
add esp, 0x18
push 0
push str.Error
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push edi
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001c60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10006014]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100015a0
push 0x2c
push str._c_rundll32.exe__userprofile_help.dll_myfun
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
call fcn.10001ed0
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x10001cf1
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001ce7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001ce7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10002743
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002735
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00406dc2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00406dc2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00406dc2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00406dc2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00406dc2
mov dword [0x41203c], eax
call fcn.00406dc2
test eax, eax
jge 0x402550
push 8
call fcn.00406dc2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00406dc2
pop ecx
push 1
call fcn.00406dc2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00406dc2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00406dc2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00406dc2
jmp 0x402495

Function at 0x406dc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x406dd1
pop dword [ebp - 0x10]
mov eax, 0x406dd1
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x38e3d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x80278ffc
add ecx, 0x7fd8b665
xor edx, edx
add edx, eax
mov ebx, 0x268bb5f0
add ebx, 0xd9b585d4
add ebx, dword [ebp - 0x10]
mov esi, 0x58c8c5b1
sub esi, 0xac93da31
xor dword [ebp - 4], 0x9e9fe4ea
mov edi, dword [ebx]
mov dword [ebp - 8], 0xa8b5f411
xor edi, esi
add dword [ebp - 8], 0x2621aed8
mov dword [edx], edi
xor dword [ebp - 0xc], esi
add edx, 0x875e71f5
add edx, 0x78a18e0f
add ebx, 4
loop 0x406e28
add eax, 0x26723b9
sub eax, 0x2661762
mov ebx, eax
add eax, 5
mov ecx, 0xfc0a9c7
add ecx, 0xf07f5639
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x703c7570
Capabilities:
Get graphical window text

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp eax, 1
je 0x703c75c0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.user32.dll_DefWindowProcW]
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], ebx
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
sub esp, 4
lea eax, [edi + edi]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x703c764d
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
call sym.atl90.dll_AtlAxCreateControlLicEx
sub esp, 0x20
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, 1
jmp 0x703c75ac
Function at 0x703c76c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x24], eax
test byte [0x703cc028], 8
jne 0x703c77b0
mov dword [esp + 4], ebx
mov dword [esp + 8], 5
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x703c7800
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x703c7800
mov dword [esp], eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.kernel32.dll_LockResource]
mov ecx, dword [ebp - 0x28]
sub esp, 4
test eax, eax
mov edi, eax
je 0x703c7818
call sym._AX_ConvertDialogTemplate
mov edi, eax
test eax, eax
je 0x703c778b
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_CreateDialogIndirectParamW]
sub esp, 0x14
mov esi, eax
mov dword [esp], edi
mov edi, esi
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeResource]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_1
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0xc], str.__p__s__p__p__Ix__n
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], str.AtlAxCreateDialogW
mov dword [esp + 0x18], edx
mov dword [esp + 4], 0x703cc028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x703c76f8
lea esp, [ebp - 0x10]
xor edi, edi
pop ecx
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_FreeResource]
sub esp, 4
jmp 0x703c7797
Function at 0x703c7b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov edx, dword [ecx + 4]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
mov edi, dword [ecx + 0x10]
test byte [0x703cc028], 8
jne 0x703c7c00
mov dword [esp + 8], 5
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x703c7bf0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x703c7bf0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockResource]
sub esp, 4
call sym._AX_ConvertDialogTemplate
mov edx, eax
test eax, eax
je 0x703c7bf0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_DialogBoxIndirectParamW]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, edx
mov dword [ebp - 0x20], edx
call sym._wine_dbgstr_wn.constprop.0_1
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.instance__p__name__s__owner__p__proc__p__param__Ix_n
mov dword [esp + 8], str.AtlAxDialogBoxW
mov dword [esp + 4], 0x703cc028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x20]
jmp 0x703c7b62
Function at 0x703c9590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
sub esp, 0xc
test eax, eax
je 0x703c9700
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x703c96c0
mov dword [esp + 4], eax
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov edi, eax
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
test edi, edi
je 0x703c9730
mov dword [ebp - 0x28], eax
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], edi
mov dword [ebp - 0x24], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov ecx, eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
add ecx, 1
mov dword [esp + 4], 2
mov dword [ebp - 0x20], ecx
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp - 0x20]
mov dword [esp + 8], edi
mov dword [ebp - 0x20], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor ecx, ecx
sub esp, 0x18
mov word [edx + eax*2], cx
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov dword [ebp - 0x1c], edx
call sym._string_register
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x703c96e3
test byte [0x703cc038], 4
jne 0x703c9768
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x703cc038], 4
jne 0x703c9798
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
test byte [0x703cc038], 4
je 0x703c96cd
mov dword [esp + 0xc], str.could_not_load_resource_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x703cc038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703c96cd
mov dword [esp + 0xc], str.Could_not_find_source_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x703cc038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703c96cd
mov dword [esp + 0xc], str.Could_not_load_resource_file_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x703cc038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703c970d
Function at 0x703c9b80
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x4c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x703c9c70
mov ebx, eax
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov edi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x10], 0
mov dword [ebp - 0x1c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x703c9ca0
test byte [0x703cc038], 4
jne 0x703c9d90
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
mov esi, dword [sym.imp.ucrtbase.dll_free]
movzx eax, di
mov edx, edi
or eax, 0x80070000
test edi, edi
cmovg edx, eax
mov edi, edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x703cc038], 4
jne 0x703c9d50
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovg edi, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x18
lea edx, [eax + 1]
mov dword [ebp - 0x30], eax
mov dword [esp], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], 2
call dword [sym.imp.ucrtbase.dll_calloc]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0xc], edi
mov esi, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov edx, esi
sub esp, 0x18
mov word [esi + ecx*2], ax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call sym._string_register
mov dword [esp], esi
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov edi, eax
call esi
jmp 0x703c9c4f
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Could_not_open_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.file_register
mov dword [esp + 4], 0x703cc038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703c9c7d
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Failed_to_read_file__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.file_register
mov dword [esp + 4], 0x703cc038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703c9c2f
Function at 0x703ca8d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x703ca92b
cmp byte [esi + ebx - 1], 0xa
je 0x703ca8ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x703dc0c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x703cb2c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x703dc0e0]
test eax, eax
je 0x703cb378
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x703cb300
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x703cb2ec
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x703cb3ad
mov dword [esp + 4], 0x703d68fc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x703dc0e0], eax
sub esp, 8
test eax, eax
jne 0x703cb2dd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x703cb2ee