joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419a40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
xor ecx, ecx
mov eax, 1
mov edx, 0x20
lea esp, [esp]
or ecx, eax
rol eax, 1
sub edx, 1
jne 0x419a60
mov esi, dword [edi + 8]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x419a7d
mov eax, dword [edi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp ecx, esi
jne 0x419a99
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call fcn.00418a80
mov ecx, eax
mov eax, dword [edi]
pop edi
add eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 4
jae 0x419b93
push ebx
xor edx, edx
cmp esi, 0xffffffff
jne 0x419ac4
mov esi, dword [edi + 8]
lea ebx, [ecx + 1]
mov eax, esi
div ebx
xor edx, edx
mov dword [ebp - 4], eax
mov eax, esi
div ecx
inc edx
cmp edx, ecx
jne 0x419acd
inc dword [ebp - 4]
jmp 0x419acd
inc ecx
lea eax, [esi + 1]
div ecx
mov dword [ebp - 4], eax
mov esi, 1
xor ebx, ebx
cmp esi, dword [ebp - 4]
ja 0x419b52
lea esp, [esp]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [edi + 0x1380]
cmp eax, 0x270
jne 0x419af6
push 0
jmp 0x419aff
cmp eax, 0x4e0
jl 0x419b06
push 1
mov ecx, edi
call fcn.00417d70
mov ecx, dword [edi + 0x1380]
mov eax, dword [edi + ecx*4]
inc ecx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov dword [edi + 0x1380], ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov edx, eax
and edx, 0xffffdf8c
shl edx, 0xf
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
mov eax, dword [ebp - 8]
imul ecx, esi
inc eax
imul esi, eax
add ebx, ecx
cmp esi, dword [ebp - 4]
jbe 0x419ae0
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 8]
xor edx, edx
div esi
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.00419a40
imul eax, esi
mov esi, dword [edi + 8]
add ebx, eax
cmp ebx, esi
jbe 0x419b86
mov ecx, dword [ebp - 8]
jmp 0x419aa0
mov eax, dword [edi]
add eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor edx, edx
mov eax, ecx
div esi
cmp eax, 4
jbe 0x419bbd
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0xc], ecx
push edx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.00419720
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
call fcn.00418a80
mov ecx, eax
cmp ecx, dword [edi + 8]
ja 0x419bc0
mov eax, dword [edi]
pop edi
add eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f1e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41f1fd
pop edi
pop ebx
pop ebp
ret 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41f234
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x41f230
lea ecx, [ecx]
cmp esi, eax
jae 0x41f234
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x41f220
cmp esi, eax
jb 0x41f23d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0xc
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x428e30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x47a4a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00440910
mov edx, dword [ebp + 0xc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x428ebb
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428e87
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, esi
call fcn.004073d0
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00440721
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00440721
mov esp, ebp
pop ebp
ret 8
Function at 0x42b644
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x47bc14], 0
push esi
jne 0x42b5b7
call fcn.0042b4dd
test eax, eax
je 0x42b5fa
mov eax, dword [0x47bc14]
cmp eax, 1
jne 0x42b5d8
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42b5fa
pop esi
ret
push eax
call dword [0x47bc1c]
test eax, eax
jne 0x42b642
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42b5fe
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x47bc14]
call dword [0x47bc1c]
mov edi, eax
test edi, edi
je 0x42b623
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x42b63f
mov edi, esi
add esi, 0xff0
push edi
push dword [0x47bc14]
call dword [0x47bc18]
add edi, 0x10
cmp edi, esi
jb 0x42b62b
mov eax, edi
pop edi
pop esi
ret
jmp 0x42b5a4
Function at 0x438cf0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x464b03
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x47a4a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00434480
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00434480
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00434480
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x43f330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
mov eax, 0x4666e9
mov dword [esp], eax
mov dword [esp + 4], 0x468638
mov dword [esp + 8], 0x468634
mov dword [esp + 0xc], 0x468630
mov dword [esp + 0x10], 0x46862c
mov dword [esp + 0x14], 0x468628
mov dword [esp + 0x18], 0x467b30
mov dword [esp + 0x1c], 0x468624
mov dword [esp + 0x20], 0x46730c
mov dword [esp + 0x24], 0x468620
mov dword [esp + 0x28], 0x46861c
mov dword [esp + 0x2c], 0x468618
mov dword [esp + 0x30], 0x467450
mov dword [esp + 0x34], 0x468614
mov dword [esp + 0x38], 0x468610
mov dword [esp + 0x3c], 0x46860c
mov dword [esp + 0x40], str.___.___
mov dword [esp + 0x44], 0x4685fc
mov dword [esp + 0x48], 0x4682ec
mov dword [esp + 0x4c], 0x4683ac
mov dword [esp + 0x50], 0x4685f8
mov dword [esp + 0x54], 0x4685f4
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4685f0
mov dword [esp + 0x64], 0x4685ec
mov dword [esp + 0x68], 0x4685e8
mov dword [esp + 0x6c], 0x4685e4
mov dword [esp + 0x70], 0x4682f0
mov dword [esp + 0x74], 0x4682e0
mov dword [esp + 0x78], 0x4682c0
mov dword [esp + 0x7c], 0x4682b0
mov dword [esp + 0x80], 0x4682ac
mov dword [esp + 0x84], 0x4682a4
mov dword [esp + 0x88], 0x46829c
mov dword [esp + 0x8c], 0x4682e8
mov dword [esp + 0x90], 0x4685e0
mov dword [esp + 0x94], 0x4685dc
mov dword [esp + 0x98], 0x466814
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x466818
mov dword [esp + 0xc0], 0x468378
mov dword [esp + 0xc4], 0x46835c
mov dword [esp + 0xc8], 0x467b34
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x4683a0
mov dword [esp + 0xd4], str._:__n__
mov dword [esp + 0xd8], 0x4682b8
mov dword [esp + 0xdc], 0x46837c
mov dword [esp + 0xe0], 0x468384
cmp cl, 0x39
jae 0x43f52c
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xe4
ret

Function at 0x440721
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47a4a4]
jne 0x44072b
repz ret
jmp fcn.00446f8d
Function at 0x451e13
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044690f
and dword [ebp - 4], 0
cmp dword [0x47c7ec], 0
mov ebx, eax
jne 0x451ec4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x451f75
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x451f75
push eax
call fcn.0044689d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x47c7ec], eax
call esi
push eax
call fcn.0044689d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47c7f0], eax
call esi
push eax
call fcn.0044689d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47c7f4], eax
call esi
push eax
call fcn.0044689d
pop ecx
mov dword [0x47c7fc], eax
test eax, eax
je 0x451ec4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044689d
pop ecx
mov dword [0x47c7f8], eax
mov eax, dword [0x47c7f8]
cmp eax, ebx
je 0x451f1c
cmp dword [0x47c7fc], ebx
je 0x451f1c
push eax
call fcn.00446918
push dword [0x47c7fc]
mov esi, eax
call fcn.00446918
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x451f1c
test edi, edi
je 0x451f1c
call esi
test eax, eax
je 0x451f13
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x451f13
test byte [ebp - 0xc], 1
jne 0x451f1c
or dword [ebp + 0x10], 0x200000
jmp 0x451f55
mov eax, dword [0x47c7f0]
cmp eax, ebx
je 0x451f55
push eax
call fcn.00446918
pop ecx
test eax, eax
je 0x451f55
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x451f55
mov eax, dword [0x47c7f4]
cmp eax, ebx
je 0x451f55
push eax
call fcn.00446918
pop ecx
test eax, eax
je 0x451f55
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47c7ec]
call fcn.00446918
pop ecx
test eax, eax
je 0x451f75
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x451f77
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x458590
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret
Function at 0x4585d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov cl, byte [esi]
test cl, cl
je 0x458634
lea ecx, [ecx]
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [edi + eax*4]
inc esi
mov dword [edx + 8], ecx
mov cl, byte [esi]
test cl, cl
jne 0x4585f0
pop esi
ret
Function at 0x459c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x459c33
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x459cb1
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00442d90
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x459c81
sub eax, edi
jmp 0x459c83
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x459c72
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x459ca2
sub eax, edi
jmp 0x459ca4
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x459c93
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x459d62
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 4]
mov ebx, ecx
mov dword [ebp - 8], eax
cmp ebx, edx
jbe 0x459cd7
mov ebx, edx
test ebx, ebx
je 0x459d24
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x459cfa
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.0045c1d0
jmp 0x459d0c
cmp ecx, 2
jne 0x459d12
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call fcn.0045aa60
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
mov ecx, dword [edi]
push ebx
push ecx
push eax
call fcn.00442d90
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x459d4e
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x459d62
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x459c30
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011de
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x402018]
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x844]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x11
xor eax, eax
pop ecx
xor esi, esi
mov edx, 0x82
lea edi, [ebp - 0x888]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x210], si
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x41c], si
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
mov word [ebp - 0x830], si
mov ecx, 0x104
lea edi, [ebp - 0x82e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x105
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x888], 0x44
mov dword [ebp - 0x884], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
je 0x40130f
lea eax, [ebp + eax*2 - 0x212]
cmp word [eax], 0x5c
jne 0x401285
mov word [eax], si
mov edi, dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x4010fc
push eax
call edi
add esp, 0xc
call fcn.004011a9
test eax, eax
je 0x4012ca
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf70]
lea ecx, [ebp - 0x41c]
mov dword [eax + 0x14c0], ecx
mov dword [eax + 0x14c4], esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x830]
push 0x4010d0
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x888]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x830]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40135c
push esi
push esi
lea eax, [ebp - 0x834]
push eax
push 0x400
mov dword [ebp - 0x834], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x401372
push 0x10
push 0x4010bc
push dword [ebp - 0x834]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x834]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401372
push dword [ebp - 0x844]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x840]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
call fcn.004013f8
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x707c1850
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
mov eax, dword [ecx]
mov word [eax], dx
movzx edx, byte [esi + 2]
mov byte [eax + 2], dl
movzx edx, word [esi + 0x12]
mov edi, dword [esi + 0xc]
mov word [eax + 6], dx
mov edx, dword [esi + 0x14]
mov word [eax + 0xa], dx
movzx edx, word [esi + 0x16]
mov byte [eax + 3], 0
mov word [eax + 4], di
shr edi, 6
mov word [eax + 8], dx
mov edx, dword [esi + 0x18]
mov ebx, edx
shr ebx, 3
and bl, 1
mov byte [eax + 0xf], bl
mov ebx, edi
and bl, 1
mov byte [eax + 0x10], bl
mov ebx, dword [esi + 4]
mov word [eax + 0x12], bx
mov ebx, dword [esi + 0x64]
mov dword [eax + 0x20], ebx
mov ebx, dword [esi + 0x60]
mov dword [eax + 0x24], ebx
mov ebx, dword [esi + 0x50]
mov dword [eax + 0x28], ebx
mov ebx, dword [esi + 0x54]
mov dword [eax + 0x2c], ebx
mov ebx, dword [esi + 0x58]
mov dword [eax + 0x30], ebx
mov ebx, dword [esi + 0x5c]
mov dword [eax + 0x34], ebx
mov ebx, edx
shr ebx, 4
and bl, 1
mov byte [eax + 0xc], bl
movzx ebp, word [esi + 0x3c]
movzx edi, word [esi + 0x48]
jne 0x707c1940
movzx ebx, word [esi + 6]
mov word [eax + 0x38], bp
mov word [eax + 0x44], di
mov word [eax + 0x14], bx
mov ebx, edx
shr ebx, 6
and bl, 1
mov byte [eax + 0xd], bl
movzx edi, word [esi + 0x40]
mov word [eax + 0x3c], di
je 0x707c1912
movzx ebx, word [esi + 0x42]
mov word [eax + 0x3e], bx
shr dl, 7
mov byte [eax + 0xe], dl
movzx ebx, word [esi + 0x44]
mov word [eax + 0x40], bx
je 0x707c192a
movzx edx, word [esi + 0x46]
mov word [eax + 0x42], dx
add eax, 0x48
mov dword [ecx], eax
mov eax, 0x110000
pop ebx
pop esi
pop edi
pop ebp
ret
mov word [eax + 0x38], bp
movzx ebx, word [esi + 0x3e]
mov word [eax + 0x44], di
mov word [eax + 0x3a], bx
movzx ebx, word [esi + 0x4a]
mov word [eax + 0x46], bx
mov ebx, 1
jmp 0x707c18f1
Function at 0x707c5f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x707c5f90
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x707c5f88
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x707cb084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x707c5f4d
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x707c6660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x707c6838
mov edx, dword [0x707cb084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x707c6828
test byte [0x707c7040], 8
jne 0x707c67d0
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x707c7050], 8
jne 0x707c6790
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x707c66eb
cmp dword [ebp + 8], 3
jbe 0x707c6750
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x707c66fa
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x707ca2d8]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x707c66eb
mov dword [esp], 0x707c7050
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x707c66c0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x707c66c0
mov dword [esp], 0x707c7040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x707c66ad
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x707c66b3
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x707c6748
Function at 0x1000cf60
Capabilities:
List drag and drop files
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
push 0
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1000cf80
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0xf
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1000d053
push esi
push 0
push 0
push 0xffffffffffffffff
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x1000d052
test edi, edi
je 0x1000d007
mov edx, 0x8000
lea ecx, [ebp - 8]
call fcn.1000e910
xor edi, edi
test esi, esi
mov esi, dword [ebp - 8]
jle 0x1000cffa
nop
push 0x8000
push esi
push edi
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
push 0x8000
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ecx, dword [ebp - 0xc]
push esi
call fcn.1000e320
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x1000cfd0
test esi, esi
je 0x1000d007
push esi
call fcn.10013c29
add esp, 4
push str.Preferred_DropEffect
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1000d052
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x1000d052
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x1000d052
xor ecx, ecx
cmp dword [eax], 2
mov eax, dword [ebp - 0x14]
sete cl
push esi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 4], 1
pop esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000d070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.10024720
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test edx, edx
je 0x1000d0ac
sub esp, 8
lea edx, [ebp - 0x1044]
call fcn.1000eb90
add esp, 8
lea ecx, [ebp - 0x1044]
test eax, eax
cmove ecx, esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
cmp eax, 0xffffffff
je 0x1000d0d0
test al, 0x10
je 0x1000d0d0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013c18
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10013c18
mov esp, ebp
pop ebp
ret

Function at 0x1000dad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.1000d743
push eax
push esi
push dword [ebp + 8]
call fcn.1000d6f8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]