joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58d48d
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x61ed78
call fcn.005ebcf5
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404800
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x625070
call fcn.00403aa0
cmp eax, 0xffffffff
jne 0x58d568
push 0
push 0x6306f4
lea ecx, [ebp - 0x4d0]
call fcn.00403aa0
cmp eax, 0xffffffff
jne 0x58d568
push 0
push 0x625b74
lea ecx, [ebp - 0x4d0]
call fcn.00403aa0
cmp eax, 0xffffffff
jne 0x58d568
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404800
add eax, 0x10
pop ecx
mov dword [ebp - 0x4d8], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x4d4], edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x58d537
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x6249f8]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00404d70
jmp 0x58d5a1
lea eax, [ebp - 0x218]
push eax
call fcn.005fa7a4
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00405050
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00404d70
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x58d58e
mov edi, dword [ebp - 0x4cc]
jmp 0x58d5a1
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x6249f8]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00404d70
mov eax, edi
call fcn.005ebc9f
ret

Function at 0x5a7199
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005ff51f
pop ecx
test eax, eax
jne 0x5a71db
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004042d0
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a71a1
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x60527b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00604f2c

Function at 0x605286
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006050b6
Function at 0x10019d39
Capabilities:
Create directory

Disassembly:
mov eax, 0x1017c9aa
call fcn.10166ba4
sub esp, 0x18c
mov eax, dword [0x101cb280]
push esi
push 0
mov dword [ebp - 0x10], eax
push str.ScreenShot
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str..ScreenShotTantra
lea ecx, [ebp - 0x110]
call fcn.101521f0
and dword [ebp - 4], 0
call fcn.101691c1
lea eax, [ebp - 0x198]
push eax
call fcn.10168b52
lea eax, [ebp - 0x198]
push eax
call fcn.10168944
push eax
push str.__Y_m_d__H__M__S_
lea eax, [ebp - 0x190]
push 0x80
push eax
call fcn.10168929
add esp, 0x18
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x110]
call fcn.10152380
push 0x1018f104
lea ecx, [ebp - 0x110]
call fcn.10152380
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
lea edx, [ebp - 0x110]
push edx
call dword [eax + 0x38]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.101521c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.10165cbe
leave
ret

Function at 0x1001b96e
Capabilities:
Hide graphical window

Disassembly:
lea eax, [ecx + 0x213c]
cmp byte [eax], 0
jne 0x1001b97f
mov eax, 0x80004005
ret
mov byte [eax], 0
push dword [0x10a1f778]
call dword [0x10a1f784]
mov ecx, dword [0x10a1f7a4]
test ecx, ecx
je 0x1001b9b5
push esi
mov esi, 0x11a
push esi
call fcn.100951ef
test al, al
je 0x1001b9b4
mov ecx, dword [0x10a1f7a4]
push esi
call fcn.1009c3d3
pop esi
push 0
push dword [0x10a1f778]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x10a1f770]
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
ret
Function at 0x1013e51f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
ja 0x1013e531
xor eax, eax
jmp 0x1013e5d1
cmp dword [esi + 0x20014], ebx
jle 0x1013e540
mov ecx, esi
call fcn.1013e0a4
mov eax, dword [esi + 0x20008]
mov edx, 0x10000
cmp eax, edx
push edi
jg 0x1013e5c2
cmp eax, ebx
jl 0x1013e5c2
mov ecx, dword [esi + 0x20014]
cmp ecx, eax
jg 0x1013e566
cmp ecx, edx
jge 0x1013e566
cmp ecx, ebx
jge 0x1013e572
mov dword [esi + 0x20008], ebx
mov dword [esi + 0x20014], ebx
mov ecx, dword [esi + 0x20014]
mov eax, dword [esi + 0x20008]
push ebx
sub eax, ecx
push eax
lea eax, [ecx + esi + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
je 0x1013e59f
add dword [esi + 0x20014], edi
jmp 0x1013e5a5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, dword [esi + 0x20014]
cmp eax, dword [esi + 0x20008]
jl 0x1013e5bd
cmp edi, 0xffffffff
je 0x1013e5bd
xor eax, eax
inc eax
jmp 0x1013e5c4
xor eax, eax
inc eax
jmp 0x1013e5d0
xor eax, eax
mov dword [esi + 0x20008], ebx
mov dword [esi + 0x20014], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10165a0b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10165c50
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10165aa6
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10a6ea54]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10165aa6
cmp eax, 1
je 0x10165ac7
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10165aa6
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10165a73
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10165aa2
xor eax, eax
inc eax
jmp 0x10165ae6
cmp edi, eax
jae 0x10165aaa
xor eax, eax
jmp 0x10165ae6
cmp eax, esi
jae 0x10165ab1
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10a6ea54]
jmp 0x10165aca
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1016940f
Capabilities:
Terminate process

Disassembly:
push 8
push 0x1019fae0
call fcn.10165af0
push 8
call fcn.1016cdf8
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x10a6ea94], esi
jne 0x10169443
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x10a6ea90], esi
mov al, byte [ebp + 0x10]
mov byte [0x10a6ea8c], al
cmp dword [ebp + 0xc], edi
jne 0x1016948d
cmp dword [0x10a70250], edi
je 0x1016947d
mov eax, dword [0x10a7024c]
sub eax, 4
mov dword [0x10a7024c], eax
cmp eax, dword [0x10a70250]
jb 0x1016947d
mov eax, dword [eax]
cmp eax, edi
je 0x1016945e
call eax
jmp 0x1016945e
push 0x101b907c
mov eax, 0x101b9074
call fcn.1016938d
pop ecx
push 0x101b9088
mov eax, 0x101b9080
call fcn.1016938d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x101694be
cmp dword [ebp + 0x10], edi
jne 0x101694cc
mov dword [0x10a6ea94], esi
push dword [ebp + 8]
call fcn.1016934b
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x101694cb
push 8
call fcn.1016cd43
pop ecx
ret
call fcn.10165b2b
ret
Function at 0x1016b24d
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x1019fd10
call fcn.10165af0
mov edi, 0x94
mov eax, edi
call fcn.10165c50
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x10a6ea54], ecx
mov eax, dword [esi + 4]
mov dword [0x10a6ea60], eax
mov edx, dword [esi + 8]
mov dword [0x10a6ea64], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10a6ea58], esi
cmp ecx, 2
je 0x1016b2ad
or esi, 0x8000
mov dword [0x10a6ea58], esi
shl eax, 8
add eax, edx
mov dword [0x10a6ea5c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1016b2e8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016b2e8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1016b300
cmp eax, 0x20b
je 0x1016b2ed
mov dword [ebp - 0x1c], esi
jmp 0x1016b314
cmp dword [ecx + 0x84], 0xe
jbe 0x1016b2e8
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x1016b30e
cmp dword [ecx + 0x74], 0xe
jbe 0x1016b2e8
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.1016ce43
pop ecx
test eax, eax
jne 0x1016b328
push 0x1c
call fcn.1016b229
pop ecx
call fcn.1016f346
test eax, eax
jne 0x1016b339
push 0x10
call fcn.1016b229
pop ecx
call fcn.10172e38
mov dword [ebp - 4], esi
call fcn.10174929
test eax, eax
jge 0x1016b352
push 0x1b
call fcn.1016b204
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10a70244], eax
call fcn.101763d6
mov dword [0x10a6eaa4], eax
call fcn.10176334
test eax, eax
jge 0x1016b378
push 8
call fcn.1016b204
pop ecx
call fcn.10176101
test eax, eax
jge 0x1016b389
push 9
call fcn.1016b204
pop ecx
push 1
call fcn.101693a5
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x1016b39f
push eax
call fcn.1016b204
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.101760a4
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1016b3c0
movzx eax, word [ebp - 0x40]
jmp 0x1016b3c3
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.1003a654
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x1016b3e1
push edi
call fcn.101694d2
call fcn.101694f4
jmp 0x1016b413
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.10165b2b
ret
push 0x10188076
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x1016b24d
Function at 0x10001640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
imul ebx, eax, 0x508
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x100060ec]
test eax, eax
je 0x10001730
lea esi, [ebx + 0x100060a0]
mov edi, edx
mov eax, esi
call sym._controller_lock.part.0
test eax, eax
je 0x10001730
movzx ecx, word [esi + 0x30]
xor cx, word [esi + 0x3c]
mov edx, 1
xor eax, eax
movzx ecx, cx
jmp 0x10001697
mov edx, dword [eax*8 + 0x10009ba0]
test ecx, edx
jne 0x10001740
add eax, 1
cmp eax, 0xe
jne 0x10001690
imul edx, dword [ebp - 0x10], 0x508
cmp byte [edx + 0x100060d2], 0x1e
lea eax, [edx + 0x100060a0]
seta cl
cmp byte [edx + 0x100060de], 0x1e
seta dl
cmp cl, dl
jne 0x10001790
cmp byte [eax + 0x33], 0x1e
seta dl
cmp byte [eax + 0x3f], 0x1e
seta cl
cmp dl, cl
je 0x100017d0
mov dword [edi], 0x5807
xor edx, edx
cmp byte [eax + 0x33], 0x1f
setb dl
movzx ebx, byte [ebp - 0x10]
mov byte [edi + 7], 0
add edx, 1
mov word [edi + 4], dx
mov byte [edi + 6], bl
movzx edx, byte [eax + 0x33]
mov byte [eax + 0x3f], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 0x48f
pop ebx
pop esi
pop edi
pop ebp
ret
imul ecx, dword [ebp - 0x10], 0x508
movzx eax, word [eax*8 + 0x10009ba4]
mov word [edi], ax
xor eax, eax
mov word [edi + 2], ax
lea eax, [ecx + 0x100060a0]
movzx ecx, word [ecx + 0x100060d0]
test ecx, edx
jne 0x100017c0
mov ecx, 2
not edx
mov word [edi + 4], cx
and word [eax + 0x3c], dx
movzx eax, byte [ebp - 0x10]
mov byte [edi + 7], 0
mov byte [edi + 6], al
xor eax, eax
jmp 0x10001710
mov dword [edi], 0x5806
xor edx, edx
cmp byte [eax + 0x32], 0x1f
setb dl
movzx ebx, byte [ebp - 0x10]
mov byte [edi + 7], 0
add edx, 1
mov word [edi + 4], dx
mov byte [edi + 6], bl
movzx edx, byte [eax + 0x32]
mov byte [eax + 0x3e], dl
xor eax, eax
jmp 0x10001710
mov ebx, 1
mov word [edi + 4], bx
or word [eax + 0x3c], dx
jmp 0x10001778
lea eax, [ebx + 0x100060e2]
mov dword [esp + 0xc], 0x5820
lea ecx, [ebx + 0x100060d4]
mov edx, edi
mov dword [esp + 8], eax
lea eax, [ebx + 0x100060e0]
mov dword [esp + 4], eax
lea eax, [ebx + 0x100060d6]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call sym._check_joystick_keystroke
test eax, eax
je 0x10001710
lea eax, [ebx + 0x100060e6]
lea ecx, [ebx + 0x100060d8]
mov dword [esp + 0xc], 0x5830
mov edx, edi
mov dword [esp + 8], eax
lea eax, [ebx + 0x100060e4]
add ebx, 0x100060da
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], ebx
call sym._check_joystick_keystroke
jmp 0x10001710
Function at 0x10001bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x18
movzx esi, word [eax + 0x264]
mov edi, dword [eax + 0x468]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x258]
test eax, eax
jne 0x10001c77
test byte [ebx + 0x1a], 1
jne 0x10001ca0
lea eax, [ebx + 0x454]
mov edx, dword [ebx + 0x450]
mov dword [ebx + 0x258], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x454], 0
mov dword [ebx + 0x458], 0
mov dword [ebx + 0x45c], 0
mov dword [ebx + 0x460], 0
mov dword [ebx + 0x464], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x10001c80
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x3e5
je 0x10001c80
mov eax, ebx
call sym._controller_destroy.constprop.0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x1000c008]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x10]
mov eax, ebx
call sym._HID_set_state.isra.0
jmp 0x10001bf6
Function at 0x10001cc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 8]
sub esp, 0x1c
mov dword [esp + 8], eax
mov dword [esp + 4], sym._hid_update_thread_proc_4
mov dword [esp], 4
call dword [sym.imp.kernel32.dll_GetModuleHandleExW]
sub esp, 0xc
test eax, eax
jne 0x10001cf7
test byte [0x100074c0], 4
jne 0x10001ea0
mov dword [esp + 0xc], 0
mov ebx, dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [0x1000c00c], eax
sub esp, 0x10
test eax, eax
je 0x10001e58
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [0x1000c008], eax
sub esp, 0x10
test eax, eax
je 0x10001e10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._hid_update_thread_proc_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x10001dd0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x1000c00c]
sub esp, 4
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ebx, dword [ebp - 4]
mov eax, 1
sub esp, 8
leave
ret 0xc
test byte [0x100074c0], 2
je 0x10001d9d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.failed_to_create_update_thread__error__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100074c0
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10001d9d
test byte [0x100074c0], 2
je 0x10001d5f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.failed_to_create_update_event__error__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100074c0
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10001d5f
test byte [0x100074c0], 2
je 0x10001d2e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.failed_to_create_start_event__error__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100074c0
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10001d2e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_increase_modules_reference_count__error:__lu_n
mov dword [esp + 8], str.start_update_thread_once
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100074c0
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x10001cf7
Function at 0x10004eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10004f08
cmp byte [esi + ebx - 1], 0xa
je 0x10004edc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1000c0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10005530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10005708
mov edi, dword [0x1000c0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10005617
test byte [0x100074e8], 8
jne 0x100056b0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100074f8], 8
jne 0x10005670
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100055b9
cmp esi, 3
jbe 0x10005628
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100055ca
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1000a528]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100055b9
mov dword [esp], 0x100074f8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10005590
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10005590
mov dword [esp], 0x100074e8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000557b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10005583
mov eax, 0xffffffff
jmp 0x10005617
Function at 0x430000
Capabilities:
Check for software breakpoints
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x78815bd5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x3b542b52
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219