joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46433e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49274c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0045613b
mov dword [ebp - 0x14], eax
cmp dword [0x495368], esi
jne 0x464431
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4643be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x464511
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x464511
push 0x47fba0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x464511
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x495368], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49536c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x495370], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x495378], eax
test eax, eax
je 0x46442e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x495374], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x464456
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x464449
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46446b
push 4
pop eax
jmp 0x464513
cmp dword [ebp - 0x14], esi
je 0x46446b
push dword [0x495368]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x464450
mov eax, dword [0x495374]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4644c9
cmp dword [0x495378], edi
je 0x4644c9
push eax
call ebx
push dword [0x495378]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4644c9
test eax, eax
je 0x4644c9
call ecx
test eax, eax
je 0x4644be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4644be
test byte [ebp - 8], 1
jne 0x4644c9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4644f9
mov eax, dword [0x49536c]
cmp eax, edi
je 0x4644f6
push eax
call ebx
test eax, eax
je 0x4644f6
call eax
mov esi, eax
test esi, esi
je 0x4644f6
mov eax, dword [0x495370]
cmp eax, edi
je 0x4644f6
push eax
call ebx
test eax, eax
je 0x4644f6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x495368]
call ebx
test eax, eax
je 0x464511
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x464513
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fd7f
mov esp, ebp
pop ebp
ret
Function at 0x1005d006
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1005d015
pop dword [ebp - 0x20]
mov eax, 0xdbbda97f
add eax, 0x34482696
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xd5feedd9
sub dword [ebp - 0x30], 0x87aca88e
mov dword [ebp - 0x2c], 0x82631ca3
add dword [ebp - 0x2c], 0xafd02fa2
mov dword [ebp - 0x28], 0xb82bd358
sub dword [ebp - 0x28], 0x6bdf8f2a
mov dword [ebp - 0x24], 0xa51dcb2b
sub dword [ebp - 0x24], 0xa51dcb2b
lea eax, [ebp - 0x30]
push eax
mov eax, 0xc279af05
add eax, 0x4d8e712f
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa6b9ad55
sub dword [ebp - 0x30], 0x324743ff
mov dword [ebp - 0x2c], 0x6f058004
add dword [ebp - 0x2c], 0xd266e171
mov dword [ebp - 0x28], 0x8d759dfc
add dword [ebp - 0x28], 0xd5f9ce70
mov dword [ebp - 0x24], 0x7a9de290
add dword [ebp - 0x24], 0x85621d70
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3f24b
push 0
call eax
mov ecx, 0x433967e5
add ecx, 0xbcc6e49b
xor esi, esi
add esi, eax
mov edi, 0x92a522af
add edi, 0x7d660b51
add edi, dword [ebp - 0x20]
mov ebx, 0xbb0c2fbe
xor dword [ebp - 0x10], 0x2b764e5e
mov edx, dword [edi]
mov dword [ebp - 0xc], 0xa7a45e20
xor edx, ebx
sub dword [ebp - 0x10], eax
mov dword [esi], edx
xor dword [ebp - 0x10], 0xa4efbfc6
add esi, 0xa63d24bb
add esi, 0x59c2db49
add edi, 0x426f2f3c
add edi, 0xbd90d0c8
loop 0x1005d12e
add eax, 0xb4cbfcf
add eax, 0xf4b46504
mov ebx, eax
add eax, 0xc20db5c3
sub eax, 0xc20db5be
mov ecx, 0x2df1b675
sub ecx, 0x1df1b675
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1006ced1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push esi
push edi
call fcn.1006b761
mov edi, dword [esp + 0x38]
push eax
push edi
call sub.glib_lite.dll_Ordinal_400
mov esi, eax
pop ecx
pop ecx
mov eax, dword [esi + 0x74]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1006cefc
xor eax, eax
jmp 0x1006d085
cmp eax, dword [esi + 0x1f0]
je 0x1006cef5
push ebx
push ebp
lea ebx, [esi + 0xc]
push ebx
call sub.glib_lite.dll_Ordinal_209
pop ecx
jmp 0x1006cf15
lea ebx, [esi + 0xc]
push dword [esp + 0x44]
push edi
call fcn.10029e9c
pop ecx
pop ecx
test eax, eax
jne 0x1006d076
push ebx
call sub.glib_lite.dll_Ordinal_208
mov eax, dword [esi + 0x1f8]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
lea eax, [esi + 0xc]
push eax
call sub.glib_lite.dll_Ordinal_209
push edi
call fcn.1002ad4f
add esp, 0xc
cmp ebp, edx
jb 0x1006cf5c
ja 0x1006cf56
cmp ebx, eax
jbe 0x1006cf5c
sub ebx, eax
sbb ebp, edx
jmp 0x1006cf6d
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
push edi
call fcn.1002c986
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, 4
je 0x1006cf9c
cmp dword [edi + 0x168], 0
jne 0x1006d076
cmp eax, 2
je 0x1006cf12
call fcn.1007f79f
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_400
push eax
call fcn.1007f76e
add esp, 0xc
push edx
push eax
call fcn.1007f79f
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_400
pop ecx
pop ecx
push eax
call fcn.1007f685
mov dword [esp + 0x24], eax
lea eax, [esi + 0xc]
push eax
mov dword [esp + 0x24], edx
call sub.glib_lite.dll_Ordinal_208
mov edi, dword [esi + 0x78]
add esp, 0x10
add edi, ebx
mov ebx, dword [esi + 0x7c]
adc ebx, ebp
cmp dword [esp + 0x10], 1
jne 0x1006cffe
add edi, dword [esp + 0x24]
adc ebx, dword [esp + 0x28]
push esi
call fcn.1006b2a4
lea eax, [esp + 0x30]
xor ebp, ebp
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push ebp
push dword [esi + 0x1f0]
call fcn.1002f4b4
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebx
push edi
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esi + 0x1f0]
call fcn.1005d006
mov eax, dword [esi + 0x1f8]
add esp, 0x3c
cmp dword [eax + 8], ebp
jne 0x1006d061
push dword [esp + 0x20]
push dword [esi + 0x1f0]
call fcn.1002f914
pop ecx
pop ecx
push esi
call fcn.1006c697
push 3
push esi
call fcn.1006ad1b
add esp, 0xc
xor eax, eax
jmp 0x1006d083
lea eax, [esi + 0xc]
push eax
call sub.glib_lite.dll_Ordinal_208
pop ecx
push 0xfffffffffffffffe
pop eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4030e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x418008]
xor eax, esp
mov dword [esp + 0x78], eax
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x41a490
push 0x67
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x41a3c8
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, edi
call fcn.004031d0
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.004087b0
add esp, 0xc
mov dword [esp + 0x30], 0x44
xor eax, eax
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
call fcn.00402cc0
lea ecx, [esp + 8]
cmp eax, 0xd
jl 0x403166
push 0xc
push str.SynFPApp.exe
jmp 0x40316d
push 0x11
push str.SynFPAppNet35.exe
call fcn.00402210
cmp dword [esp + 0x1c], 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [esp + 0x1c], 8
jb 0x4031b2
push dword [esp + 8]
call fcn.004041a9
add esp, 4
mov ecx, dword [esp + 0x7c]
xor eax, eax
pop edi
xor ecx, esp
call fcn.00403565
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404c62
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x417058
call fcn.00406dd0
call fcn.004083a2
movzx esi, ax
push 2
call fcn.00409537
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x404b19
xor ebx, ebx
jmp 0x404b4c
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x404b15
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x404b15
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x404b4c
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004079f2
test eax, eax
jne 0x404b60
push 0x1c
call fcn.00404c3b
pop ecx
call fcn.004066de
test eax, eax
jne 0x404b71
push 0x10
call fcn.00404c3b
pop ecx
call fcn.00409620
and dword [ebp - 4], 0
call fcn.00408d4a
test eax, eax
jns 0x404b8b
push 0x1b
call fcn.00404c3b
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x41b63c], eax
call fcn.00409660
mov dword [0x419810], eax
call fcn.00408ffe
test eax, eax
jns 0x404bb1
push 8
call fcn.00406a0e
pop ecx
call fcn.0040923b
test eax, eax
jns 0x404bc2
push 9
call fcn.00406a0e
pop ecx
push 1
call fcn.00406a48
pop ecx
test eax, eax
je 0x404bd5
push eax
call fcn.00406a0e
pop ecx
call fcn.004096bd
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x404bf7
push esi
call fcn.00406cb1
call fcn.00406a39
jmp 0x404c2c
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00406e15
ret
call fcn.00409584
jmp 0x404aeb
Function at 0x40d3bd
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004083f3
mov dword [ebp - 0x14], eax
cmp dword [0x41a3a4], esi
jne 0x40d4b0
push 0x800
push esi
push 0x41642c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d43d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d590
push esi
push esi
push 0x41642c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d590
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d590
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41a3a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41a3a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41a3ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41a3b4], eax
test eax, eax
je 0x40d4ad
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41a3b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d4d5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d4c8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d4ea
push 4
pop eax
jmp 0x40d592
cmp dword [ebp - 0x14], esi
je 0x40d4ea
push dword [0x41a3a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d4cf
mov eax, dword [0x41a3b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d548
cmp dword [0x41a3b4], edi
je 0x40d548
push eax
call ebx
push dword [0x41a3b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d548
test eax, eax
je 0x40d548
call ecx
test eax, eax
je 0x40d53d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d53d
test byte [ebp - 8], 1
jne 0x40d548
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d578
mov eax, dword [0x41a3a8]
cmp eax, edi
je 0x40d575
push eax
call ebx
test eax, eax
je 0x40d575
call eax
mov esi, eax
test esi, esi
je 0x40d575
mov eax, dword [0x41a3ac]
cmp eax, edi
je 0x40d575
push eax
call ebx
test eax, eax
je 0x40d575
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41a3a4]
call ebx
test eax, eax
je 0x40d590
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d592
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403565
mov esp, ebp
pop ebp
ret
Function at 0x298273e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x298273f0
pop dword [ebp - 0x48]
mov eax, 0xa0a66968
sub eax, 0x7723f578
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xbbecfd54
add dword [ebp - 0x58], 0x926547f7
mov dword [ebp - 0x54], 0xc1147c62
sub dword [ebp - 0x54], 0x8ee1301d
mov dword [ebp - 0x50], 0xdad77896
add dword [ebp - 0x50], 0x7174cb98
mov dword [ebp - 0x4c], 0xd015e387
sub dword [ebp - 0x4c], 0xd015e387
lea eax, [ebp - 0x58]
push eax
mov eax, 0x2ab17da8
sub eax, 0x12bfce8
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x842a3592
sub dword [ebp - 0x58], 0xfb7cc3c
mov dword [ebp - 0x54], 0x94aafac
sub dword [ebp - 0x54], 0xc7de4e37
mov dword [ebp - 0x50], 0xd23df72a
sub dword [ebp - 0x50], 0x6ece8abe
mov dword [ebp - 0x4c], 0xac40c7ef
sub dword [ebp - 0x4c], 0xac40c7ef
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x47467
push 0
call eax
mov ecx, 0x32dc62e1
sub ecx, 0x32dc1eb0
mov esi, eax
mov edi, 0x3a3405c0
add edi, 0xef556e40
add edi, dword [ebp - 0x48]
mov ebx, 0x358d9ae7
add ebx, 0x2827a5d0
mov dword [ebp - 4], 0x78d9c143
mov edx, dword [edi]
xor dword [ebp - 0x30], ebx
add edx, ebx
sub dword [ebp - 0x34], 0x8bf12e8f
mov dword [esi], edx
add dword [ebp - 0xc], esi
add esi, 4
add edi, 0x6dbc5254
add edi, 0x9243adb0
loop 0x2982750d
add eax, 0x59244697
sub eax, 0x59234300
mov ebx, eax
add eax, 0xfa3f4eaa
sub eax, 0xfa3f4ea5
mov ecx, 0x61ad84b3
add ecx, 0xc7d27b4d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x40509d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x408010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403f1d
and dword [ebp - 0x14], 0
cmp dword [0x4096f8], 0
mov dword [ebp - 0x18], eax
jne 0x405150
push 0x401dec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4051f8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401de0
push ebx
call edi
test eax, eax
je 0x4051f8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x401dd0
push ebx
mov dword [0x4096f8], eax
call edi
push eax
call esi
push 0x401dbc
push ebx
mov dword [0x4096fc], eax
call edi
push eax
call esi
push 0x401da0
push ebx
mov dword [0x409700], eax
call edi
push eax
call esi
mov dword [0x409708], eax
test eax, eax
je 0x405150
push 0x401d88
push ebx
call edi
push eax
call esi
mov dword [0x409704], eax
mov eax, dword [0x409704]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4051a9
cmp dword [0x409708], ecx
je 0x4051a9
push eax
call esi
push dword [0x409708]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4051a9
test ebx, ebx
je 0x4051a9
call edi
test eax, eax
je 0x4051a0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4051a0
test byte [ebp - 8], 1
jne 0x4051a9
or dword [ebp + 0x10], 0x200000
jmp 0x4051dc
mov eax, dword [0x4096fc]
cmp eax, dword [ebp - 0x18]
je 0x4051dc
push eax
call esi
test eax, eax
je 0x4051dc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4051dc
mov eax, dword [0x409700]
cmp eax, dword [ebp - 0x18]
je 0x4051dc
push eax
call esi
test eax, eax
je 0x4051dc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4096f8]
call esi
test eax, eax
je 0x4051f8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4051fa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402f0f
leave
ret
Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d38
cmp byte [esi + ebx - 1], 0xa
je 0x401d0c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x401e30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x684
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x678], edx
mov dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x670]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov ebx, eax
mov eax, dword [ebp - 0x678]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
add ebx, eax
mov eax, dword [ebp - 0x674]
mov esi, dword [eax*4 + 0x404164]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [ebx + eax + 2]
cmp eax, 0x104
ja 0x401faf
mov eax, dword [ebp - 0x670]
lea edi, [ebp - 0x25c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x66c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
lea eax, [ebp - 0x66c]
mov ebx, dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp + 4], 0x404014
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x678]
mov dword [esp + 4], eax
lea eax, [ebp - 0x66c]
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x66c]
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x66c]
mov dword [esp + 8], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindFirstFileExW]
sub esp, 0x18
mov esi, eax
cmp eax, 0xffffffff
je 0x401f92
lea ebx, [ebp - 0x464]
lea esi, [esi]
nop
lea eax, [ebp - 0x230]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x670]
mov dword [esp + 4], eax
call dword [sym.imp.shlwapi.dll_PathCombineW]
sub esp, 0xc
test eax, eax
je 0x401f7e
mov dword [esp + 4], ebx
mov dword [esp], str._ls_n
call sym._printf.constprop.0
mov dword [0x403048], 1
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401f40
inc dword [ebp - 0x674]
mov eax, dword [ebp - 0x674]
cmp eax, 5
jne 0x401e52
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x403030], 2
je 0x401fa7
mov dword [esp + 0xc], str.Path_too_long_n
mov dword [esp + 8], str.search
mov dword [esp + 4], 0x403030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401fa7
Function at 0x4023f0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x467931
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x467969
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x467957
mov al, 1
jmp 0x4679ba
cmp dword [ebx + 0x54], ecx
jne 0x467960
mov al, 2
jmp 0x4679ba
cmp dword [ebx + 0x7c], ecx
jne 0x4679ba
mov al, 3
jmp 0x4679ba
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x46797e
mov al, 4
jmp 0x4679ba
cmp ecx, 5
jne 0x46799e
cmp ebx, 0
jne 0x46798c
mov al, 5
jmp 0x4679ba
cmp ebx, 1
jne 0x467995
mov al, 6
jmp 0x4679ba
cmp ebx, 2
jne 0x46799e
mov al, 7
jmp 0x4679ba
cmp ecx, 6
jne 0x4679aa
cmp ebx, 0
jne 0x4679ac
mov al, 8
jmp 0x4679ba
cmp ebx, 1
jne 0x4679b3
mov al, 9
cmp ebx, 2
jne 0x4679ba
mov al, 0xa
pop ebx
mov esp, ebp
pop ebp
ret