joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d89d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x652960
je 0x5d8a95
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push reloc.Enable40.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5d8a7d
mov esi, dword [ebx + 4]
jmp 0x5d8a77
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5d8a67
cmp dword [ebp - 0xc], 4
jne 0x5d8a67
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x5d8a5f
or dword [eax + 0x9c], ecx
jmp 0x5d8a67
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x5d8a2b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x5d8a0e
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x5d9265
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x5ed8de
call fcn.00594e8c
sub esp, 0x11c
mov eax, dword [0x6534d8]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x5d935e
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x5d9332
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040e04b
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.005d9265
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.0040b280
test bl, bl
jne 0x5d9332
or dword [ebp - 4], 0xffffffff
jmp 0x5d92a3
cmp esi, 0x103
je 0x5d9342
cmp esi, 0x3f2
jne 0x5d9352
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0059508d
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5d9f1e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x5d9f53
cmp edi, dword [esi + 0xc]
jge 0x5d9f53
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5d9f53
cmp edi, dword [eax + 8]
jge 0x5d9f53
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x5d9f55
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x5da059
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x5da08d
jmp fcn.005b6281
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x5da0fe
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x5da1f7
cmp eax, dword [edi + 0xc]
jge 0x5da1f7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x5da14f
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x5da1e0
cmp dword [ebp + 0xc], ebx
je 0x5da1e0
jmp 0x5da179
push 0x10
call fcn.005d9dea
cmp eax, ebx
je 0x5da165
mov ecx, eax
call fcn.005da050
mov esi, eax
jmp 0x5da167
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x5da190
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x5da1a0
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x5da1b2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.005b6281
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.005960f0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x5da1f2
cmp ecx, dword [esi + 8]
jge 0x5da1f2
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x5da1f8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5daa73
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6534d8]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.005996cb
mov esi, eax
test esi, esi
pop ecx
je 0x5dab1b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x5dab11
push edi
mov edi, accept
push ebx
push eax
push esi
mov byte [eax], 0
call fcn.0059b20b
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5dab0f
push 0x105
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x5daae9
inc ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x5dab0f
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.005974c1
test eax, eax
pop ecx
pop ecx
jne 0x5daaaa
pop ebx
pop edi
push esi
call fcn.0059514d
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.0059508d
leave
ret 4
Function at 0x5de4b2
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 4], eax
and dword [ebp - 4], 1
push edi
mov edi, str.Insertable
je 0x5de518
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push 0
mov ebx, 0x626cfc
push ebx
push 1
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x5de4f2
push eax
push ebx
push 1
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x5de515
xor esi, esi
cmp dword [ebp - 4], 0
je 0x5de50c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push dword [ebp + 0xc]
call ebx
push edi
push dword [ebp + 8]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp + 0x10]
xor ebx, ebx
test al, 2
je 0x5de523
mov ebx, str.Apartment
test al, 4
je 0x5de52c
mov ebx, str.Free
and eax, 6
cmp al, 6
jne 0x5de538
mov ebx, str.Both
test ebx, ebx
je 0x5de592
lea eax, [ebp + 0x10]
push eax
push 0x20006
push 0
push str.InprocServer32
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x5de4f4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
push 1
push 0
push str.ThreadingModel
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x5de4f4
xor eax, eax
inc eax
jmp 0x5de50e
Function at 0x5de66b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x5ee18f
call fcn.00594e8c
sub esp, 0x118
mov eax, dword [0x6534d8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
call fcn.005bfb85
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x118], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.005bfb85
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
mov edi, accept
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x120], ebx
jne 0x5de6e2
lea eax, [ebp - 0x120]
push eax
push 0x20019
push ebx
push str.CLSID
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 0x124], 1
je 0x5de7cd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [ebp + 8], 4
cmp dword [ebp + 0x18], edi
jne 0x5de711
cmp byte [esi], 0
je 0x5de7b2
push esi
call ebx
push dword [ebp + 0x10]
lea eax, [eax + esi + 1]
push dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
push esi
lea eax, [ebp - 0x118]
push eax
call fcn.005ceb8a
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push dword [ebp + 0xc]
push dword [ebp - 0x114]
push eax
call fcn.005ceb8a
cmp dword [ebp + 0x18], edi
mov eax, dword [ebp - 0x118]
jne 0x5de75a
cmp dword [eax - 0xc], 0
je 0x5de7b2
cmp dword [ebp + 0x14], 0
jne 0x5de78c
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x110]
push ecx
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x114], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x5de7b2
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x11c]
push esi
mov dword [ebp - 0x114], eax
call ebx
push eax
push esi
push 1
push dword [ebp - 0x114]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x5de7c1
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
jne 0x5de6ff
jmp 0x5de7cd
cmp eax, 5
je 0x5de7cd
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x120], 0
pop edi
pop esi
pop ebx
je 0x5de7e5
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.0040b280
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.0040b280
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x124]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0059508d
leave
ret 0x14
Function at 0x5e1ae6
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x5e1b03
cmp dword [ebp + 0xc], edi
je 0x5e1bf8
push 1
push ebx
call fcn.005e16e4
test eax, eax
jne 0x5e1bf8
push esi
push edi
push ebx
call fcn.005e16e4
mov esi, eax
cmp esi, edi
jne 0x5e1b4f
call fcn.005d84d9
mov ecx, dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.005b9109
mov esi, eax
cmp esi, edi
je 0x5e1bf7
push edi
push 0xffffffffffffffff
mov dword [esi + 4], ebx
call fcn.005e1a06
push edi
push esi
push dword [esi + 4]
call fcn.005e193f
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
shr ebx, 0x10
dec eax
je 0x5e1ba8
dec eax
je 0x5e1b9e
dec eax
dec eax
je 0x5e1b94
sub eax, 4
je 0x5e1b8a
sub eax, 8
je 0x5e1b80
sub eax, 0x10
jne 0x5e1bf7
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x30]
jmp 0x5e1bf7
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x2c]
jmp 0x5e1bf7
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x28]
jmp 0x5e1bf7
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x24]
jmp 0x5e1bf7
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x20]
jmp 0x5e1bf7
mov eax, dword [esi + 4]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 8]
push eax
push edi
push edi
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x5e1be5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp dword [ebp + 0xc], 1
je 0x5e1bef
cmp ebx, edi
je 0x5e1bf7
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x1c]
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x5e1e4a
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x5ed665
call fcn.00594e8c
sub esp, 0x198
mov eax, dword [0x6534d8]
push ebx
push esi
push edi
push 0x5d86f2
mov ecx, 0x8388f4
mov dword [ebp - 0x10], eax
call fcn.005d9f7e
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x5e1eac
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x5e1e8a
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x5e1ede
cmp byte [esi], 1
jne 0x5e1ed8
cmp byte [esi + 1], 1
jne 0x5e1ed8
mov dword [edi + 0xc], 0x5e1e17
call fcn.005d84d9
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x5e1eeb
push 0x1c
call fcn.005b955b
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x5e1ee2
push 0xa
call fcn.005b9224
jmp 0x5e1ee4
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x5e1f4e
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x5e1f1d
push 0x1c
call fcn.005b955b
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x5e1f14
push 0xa
call fcn.005b9224
jmp 0x5e1f16
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x5e1f4b
push 0x1c
call fcn.005b955b
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x5e1f46
push 0xa
call fcn.005b8bbd
jmp 0x5e1f48
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0059508d
leave
ret 4
Function at 0x4010c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Query or enumerate registry value

Disassembly:
sub esp, 0x5c
test byte [section..data], 8
mov dword [esp + 0x4c], ebx
mov ebx, eax
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebp
jne 0x4011b0
xor eax, eax
xor edi, edi
mov dword [esp + 8], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea ebp, [esp + 0x3c]
mov dword [esp + 0x10], edi
lea edi, [esp + 0x38]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x20], eax
call eax
sub esp, 0x18
test eax, eax
jne 0x4011e0
mov ecx, dword [esp + 0x3c]
add ecx, 4
mov dword [esp + 0x2c], ecx
mov edx, ecx
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov ecx, dword fs:[0x18]
mov dword [esp + 0x28], ecx
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x18
test eax, eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
jne 0x4011e8
mov eax, dword [esp + 0x2c]
and eax, 0xfffffffe
mov word [edx + eax - 2], 0
mov word [edx + eax - 4], 0
mov ebx, dword [esp + 0x4c]
mov eax, edx
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
mov dword [esp], 3
mov eax, section..rdata
mov dword [esp + 0xc], eax
mov eax, str.GetRegValue
mov dword [esp + 8], eax
mov eax, section..data
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0
jmp 0x4010e4
xor edx, edx
jmp 0x401198
mov dword [esp + 8], edx
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor edx, edx
sub esp, 0xc
jmp 0x401198
Function at 0x4022c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x402330
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x402328
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x4022ed
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x402a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x402bd8
mov edx, dword [0x405084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x402bc8
test byte [0x403018], 8
jne 0x402b70
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x403028], 8
jne 0x402b30
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402a8b
cmp dword [ebp + 8], 3
jbe 0x402af0
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x402a9a
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x4044e8]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x402a8b
mov dword [esp], 0x403028
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x402a60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x402a60
mov dword [esp], 0x403018
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x402a4d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x402a53
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x402ae8
Function at 0x402c50
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete dl
movzx edx, dl
inc edx
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x10002fb6
Capabilities:
Get common file path
Set current directory

Disassembly:
push 0x64c
mov eax, 0x1011128c
call fcn.1011094d
mov dword [ebp - 0x658], ecx
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x64c], edi
mov esi, 0x208
mov dword [ebp - 4], edi
push esi
lea eax, [ebp - 0x440]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x238]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x654], 0x103
mov dword [ebp - 0x650], 0xf
test ebx, ebx
jne 0x1000301f
mov esi, 0x80004003
jmp 0x1000315c
push edi
push edi
push edi
push ecx
push edi
mov edx, ebx
lea ecx, [ebp - 0x64c]
call fcn.10045db3
mov esi, eax
test esi, esi
js 0x1000315c
mov eax, dword [ebp - 0x64c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xbc]
test eax, eax
jne 0x10003058
mov esi, 0x80004005
jmp 0x1000315c
mov eax, dword [ebp - 0x64c]
lea edx, [ebp - 0x654]
push edx
lea edx, [ebp - 0x648]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x60]
mov esi, eax
test esi, esi
js 0x1000315c
cmp dword [ebp - 0x654], 4
jbe 0x1000304e
mov eax, dword [ebp - 0x64c]
lea edx, [ebp - 0x650]
push edx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x68]
mov esi, eax
test esi, esi
js 0x1000315c
cmp dword [ebp - 0x650], 5
je 0x100030b8
cmp dword [ebp - 0x650], 3
jne 0x1000304e
push ecx
mov edx, str.accdb
lea ecx, [ebp - 0x30]
call fcn.10043548
test eax, eax
jne 0x100030e0
push ecx
mov edx, 0x101193ac
lea ecx, [ebp - 0x30]
call fcn.10043548
test eax, eax
je 0x1000304e
lea eax, [ebp - 0x440]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1000304e
push esi
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x64c]
call fcn.10045db3
mov esi, eax
test esi, esi
js 0x1000315c
mov edi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x238]
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x440]
push eax
call edi
test esi, esi
je 0x1000304e
mov esi, dword [ebp - 0x658]
push dword [esi + 0x44]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [esi + 0x44], 0
mov ecx, ebx
call fcn.10006afa
push eax
push ebx
lea ecx, [esi + 0x44]
call fcn.10045db3
mov esi, eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x64c]
test eax, eax
je 0x10003173
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.101108ff
ret 4
Function at 0x100042e4
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x10111452
call fcn.10110919
mov edi, edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x10004307
mov esi, 0x80004003
jmp 0x10004372
test edi, edi
je 0x10004300
push eax
push eax
push eax
push ecx
push eax
mov edx, ebx
mov dword [edi], 1
lea ecx, [ebp - 0x10]
call fcn.10045db3
mov esi, eax
test esi, esi
js 0x10004372
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ecx]
call dword [edx + 0xbc]
test eax, eax
jne 0x1000433a
and dword [edi], eax
jmp 0x10004372
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1000436b
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jne 0x10004372
xor esi, esi
and dword [edi], esi
jmp 0x10004372
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10004386
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.101108ea
ret