joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49efbb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
sub eax, ecx
call fcn.0049eeeb
sub esp, 0x1c
jne 0x49efe6
lea ecx, [ecx + 0x2b]
mov bl, bh
push esp
mov ecx, 0x75b5d63e
xchg bx, cx
jmp 0x49f028
lea ecx, [ecx + 0x2b]
mov bl, bh
jmp 0x49f05a
bswap ebx
xchg bl, bh
stc
xchg ecx, ebx
sub esp, 0x18
neg ebx
cmc
ja 0x49f065
jbe 0x49f065
call 0x49f020
jmp 0x4a16f8
mov ebx, edi
bts ebx, esp
jle 0x49f00a
bswap ebx
jmp 0x49f037
xchg bl, bh
stc
xchg ecx, ebx
jmp 0x49f042
sub esp, 0x18
jmp 0x49f014
mov dword [esp + 0x28], eax
jmp 0x4a1760
push esp
mov ecx, 0x75b5d63e
xchg bx, cx
jmp 0x49f028
lea esp, [esp + 0x18]
jmp 0x49f112
mov ebx, ebp
lea ebx, [edx + edi]
setnp ch
jmp 0x49f096
mov cx, bp
jmp 0x49f0bf
lea ebx, reloc.MSVCRT.dll_strncpy
mov ebx, ebp
lea ebx, [edx + edi]
setnp ch
mov cx, bp
cmc
lea ecx, reloc.MSVCRT.dll_strncpy
rol al, 0
mov ebx, dword [esp]
jmp 0x49f0ed
sub esp, 0xc
jne 0x49f13e
mov bl, 0x58
mov word [esp + 8], bx
mov cl, 0x9a
mov cl, 0xa2
jmp 0x49f6bb
setb bl
bswap ecx
mov cl, 0x6a
mov bl, 0x4e
mov ecx, 0xb03b267c
setbe bl
jmp 0x49f0ce
rol al, 0
bsr cx, cx
jno 0x49f0ae
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x49f088
mov cl, 0x9a
mov cl, 0xa2
jmp 0x49f6bb
mov bl, 0x58
mov word [esp + 8], bx
jmp 0x49f126
mov byte [esp + 0x1b], ah
mov dword [esp + 0x19], ebp
jmp 0x49f505
pushal
push dword [esp + 0x1e]
pop cx
jmp 0x49f2b2
pushal
push dword [esp + 0x1e]
pop cx
mov byte [esp + 0x1b], ah
mov dword [esp + 0x19], ebp
lea esp, [esp + 0xc]
sub al, 0xf7
sub esp, 0x1a
je 0x49f4f6
jne 0x49f35e
pop ecx
sub ecx, 0x1000f9a4
jmp 0x4a178d
cmp ebx, 0xf82f7100
je fcn.004a179e
jne 0x49f047
popal
mov dword [ecx + reloc.MSVCRT.dll_strncpy], eax
movzx ebx, byte [eax]
add ebx, 0xf82f7034
jmp 0x4a173a

Function at 0x4a8caf
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp 0x49292b
lea esp, [esp + 4]
jmp 0x4a8c7e
Function at 0x4bd3ab
Capabilities:
Encrypt data using aes

Disassembly:
push esi
xchg dh, dl
neg bl
push edi
jmp 0x4903f0
movzx edx, byte [eax]
ror ebp, 0x15
mov edi, 0x7365ef08
jmp 0x4904a4
push ebp
dec bp
jmp 0x4903e4
lea esp, [esp + 4]
push ebx
xchg dh, dl
jmp 0x490406
jmp 0x49041e
shl edx, 8
seto bl
lea ebx, [ebp + 0x97]
mov bp, 0xab8b
jmp 0x490481
movzx esi, byte [eax + 2]
lea edi, reloc.MSVCRT.dll_strncpy
jmp 0x490438
movzx esi, byte [eax + 1]
mov bp, word [esp]
xor edx, esi
mov ebx, edx
jmp 0x490456
xor edx, esi
mov bl, byte [esp]
mov edi, dword [esp]
lea ebp, [ebx + ebp]
jmp 0x4904e7
shl edx, 8
not bl
bsf bx, si
jmp 0x49046f
shl edx, 8
lea edi, [esp + edx]
jmp 0x4bd266
movzx esi, byte [eax + 3]
sub bl, bh
mov bl, bh
mov bl, bh
btc edi, ebx
jmp 0x4904cc
xor edx, esi
jmp 0x4bd291
movzx esi, byte [eax + 5]
xchg bl, bh
xchg bl, bh
mov edi, dword [esp]
jmp 0x4bd2ce
mov di, word [esp]
jmp 0x4bd31a
push ebp
mov ebp, ecx
mov dword [ebp], edx
pop ebp
jmp 0x4bd2b6
xor edx, esi
movzx esi, byte [eax + 6]
push edx
sub bl, ch
jmp 0x4bd380
movzx edx, byte [eax + 4]
bswap edi
shl edx, 8
jmp 0x4bd2fa
xor edx, esi
mov bl, bh
mov bp, 0x80f
rcl bl, 5
jmp 0x4bd4c3
pushal
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x4bd340
btr edi, esp
mov byte [esp + 2], dh
shl edx, 8
mov edi, 0xefa8750a
xchg di, bx
jmp 0x4bd363
mov dword [esi], edx
pop esi
mov dl, dh
jmp 0x4bd415
push esi
mov esi, ecx
lea esi, [esi + 4]
jmp 0x4bd394
movzx esi, byte [eax + 9]
lea edi, [esi - 0x25]
lea ebp, [ecx - 0xbb]
clc
jmp 0x4bd3ab
not edi
bswap ebx
xor edx, esi
neg si
xchg bl, bh
jmp 0x4bd3c8
neg di
lea edi, reloc.MSVCRT.dll_strncpy
mov ebx, esi
xor edx, esi
jmp 0x4bd476
movzx edx, byte [eax + 8]
mov bl, bh
sub esp, 0x14
shl edx, 8
jmp 0x4bd3f4
mov edi, dword [esp]
lea edi, [edi*4]
movzx esi, byte [eax + 0xb]
push edx
jmp 0x4bd455
shl edx, 8
sete bl
not bh
xor edx, esi
lea esi, [ebp - 0xe7]
jmp 0x4bd423
shl edx, 8
lea edi, reloc.MSVCRT.dll_strncpy
xor edx, esi
jmp 0x4bd4a9
lea esp, [esp + 0x14]
movzx esi, byte [eax + 0xa]
sub bl, bh
xchg bl, bh
jmp 0x4bd443
mov dword [ecx + 8], edx
mov dx, sp
movzx edx, byte [eax + 0xc]
btc edi, edi
jmp 0x4bd502
mov bl, byte [esp]
jmp 0x4bd4d8
lea esp, [esp + 4]
movzx esi, byte [eax + 0xd]
jmp 0x4bd484
lea esp, [esp + 0x24]
movzx esi, byte [eax + 7]
shl edx, 8
mov edi, dword [esp]
not bl
jmp 0x4bd3e7
xor edx, esi
rcl si, cl
setg bl
movzx esi, byte [eax + 0xe]
jmp 0x4bd4ea
setle bl
mov di, word [esp]
inc bl
jmp 0x4bd52d
mov di, sp
lea edi, [esp + ebx]
shl edx, 8
mov di, word [esp]
xchg bx, di
jmp 0x4bd493
shl edx, 8
mov di, word [esp]
bswap edi
sub esp, 0x10
jmp 0x4bd6cf
movzx eax, byte [eax + 0xf]
mov bl, bh
bswap ebx
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x4bd517
mov eax, edx
shr eax, 0x10
lea esp, [esp + 0x24]
jmp 0x4bd55c
lea ebp, [ebp + 0xc]
mov dword [ebp], edx
pop ebp
mov bl, bh
setle al
jmp 0x4bd575
xor edx, eax
push ebp
mov ebp, ecx
jmp 0x4bd5be
xor edx, esi
shl edx, 8
mov bl, bh
xchg bl, bh
jmp 0x4bd5dd

Function at 0x4bd677
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
and edi, 0xff0000
jmp 0x4bd6a8
Function at 0x4bd752
Capabilities:
Encrypt data using aes

Disassembly:
mov bp, word [esp]
and edi, esi
bt ebp, edi
lea ebp, [eax - 0xa9]
mov ebp, 0x8e7aba0c
jmp 0x4bd760
lea esp, [esp + 1]
lea esp, [esp + 0x20]
popal
bts ebp, edi
jmp 0x4bd733
add bp, 0x7d6e
mov edi, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
lea ebp, [esp + ecx]
bswap ebp
bt ebp, esp
jmp 0x4bd7b3
mov bp, word [esp]
lea esp, [esp + 4]
mov ebp, 0xff00
call fcn.004bd788
lea esp, [esp + 2]
xor eax, edi
lea edi, [eax - 1]
mov di, word [esp]
btr edi, ebx
jmp 0x4bd7ee
stc
lea esp, [esp + 8]
xor eax, dword [ecx]
pushal
mov byte [esp + 0x14], bh
jmp 0x4bd855
bsr ax, cx
lea eax, [edx + ebx]
btr eax, edx
mov eax, dword [ecx + 8]
call fcn.004bd860
sbb dl, byte [eax + 0x52906106]
test byte [0xa417e49d], cl
sbb al, 0x6f
jbe 0x4bd88e
push ecx
mov ecx, edi
mov dword [ecx], eax
pop ecx
mov al, byte [esp]
jmp 0x4bd81b
lea esp, [esp + 0x20]
lea edi, [ecx + 0x10]
xor ebx, eax
jmp 0x4bd83c
mov dword [ecx + 0x14], ebx
jmp 0x4bd897
clc
mov dword [ecx + 0x18], eax
clc
cmc
stc
jmp 0x4bd8ea
lea esp, [esp + 0x28]
jmp 0x4bd939
lea eax, [eax + 0x1c]
mov dword [eax], edx
pop eax
pushal
jmp 0x4bd8bd
xor edx, eax
push eax
mov eax, ecx
jmp 0x4bd8d3
call 0x4a7261
jmp 0x4903ba

Function at 0x5638c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov byte [esp + 0x11], ch
mov byte [esp + 3], ah
cld
xchg dword [esp + 0xd], esi
jmp 0x563908
lea ebx, [eax + edx]
mov bh, byte [esp + 0xd]
push dword [esp + 0x11]
mov edi, 0x653e0982
lea esp, [esp + 6]
jmp 0x5638f1
Function at 0x564317
Capabilities:
Execute anti-debugging instructions

Disassembly:
sete ch
lea ecx, [edi + edi]
mov di, bx
and eax, ecx
mov byte [esp + 0xd], dh
jmp 0x56435b
xchg bx, ax
xchg word [esp], cx
mov ebx, dword [esp]
neg bp
lea ebp, [ebx + edi]
jmp 0x564345
btc ecx, ebx
mov esi, dword [esp]
bswap ecx
sub esp, 8
btc ebp, edi
mov al, ah
jmp 0x564372
lea ebp, [ecx*4]
cpuid
lea edi, [esp + esi]
bswap ebp
mov byte [esp + 7], bh
add esp, 0xc
jmp 0x564328
lea ebx, reloc.MSVCRT.dll_strncpy
add esp, 3
xchg dword [esp], ecx
pop bx
cmc
lea esi, [ebx + edi]
jmp 0x5646e2
not di
mov bp, word [esp + 2]
inc eax
mov di, word [esp + 0x18]
add esp, 0x11
cpuid
jmp 0x56440c
push dword [esp + 0x1a]
push word [esp + 7]
mov edx, ebp
mov dword [esp + 0x21], eax
push word [esp + 0x17]
pop eax
jmp 0x5643b5
push dword [esp + 1]
sub bp, 0xaa30
lea edi, reloc.MSVCRT.dll_strncpy
pop word [esp + 1]
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x564497
mov cx, bx
push dword [esp + 0x11]
xchg ecx, eax
mov ebp, dword [esp + 9]
bswap eax
mov edi, 0xbeb92264
jmp 0x5643eb
mov eax, dword [esp + 0x3d]
xchg dword [esp + 0x36], edx
popal
xchg edx, edi
lea ebp, [ebp*4]
jmp 0x5643d4
xchg word [esp + 0x3b], ax
xchg word [esp + 0x27], ax
bsr ax, bp
push word [esp + 0x29]
jmp 0x56442e
mov dword [esp + 0x19], ebp
xchg bp, bx
pop dword [esp + 0x1a]
lea esi, [esp + eax]
pop dword [esp + 4]
pushal
jmp 0x564447
xchg dh, al
pop dword [esp + 6]
rcr eax, 0x13
pop edi
bsf si, ax
cpuid
jmp 0x5644aa
xchg di, dx
lea esi, [ecx + 0x2b]
pop si
mov dl, 0x14
xchg dword [esp + 2], edi
rcl bx, cl
jmp 0x564478
sub esp, 0x1c
neg ax
popal
lea eax, reloc.MSVCRT.dll_strncpy
lea esp, [esp + 3]
xor dl, ch
jmp 0x564545
mov dx, sp
pop dword [esp + 0xc]
stc
lea eax, [esp + ecx]
push dword [esp + 0x1c]
lea ebx, [ecx + edi]
jmp 0x564463
pushal
btc esi, ebx
xchg ecx, ebx
btr eax, edx
xchg dword [esp + 0x12], ebx
lea edi, [eax + edx]
jmp 0x5644d5
xchg dword [esp + 0x1e], ecx
xchg ah, bl
rdtsc
add esp, 0xb
call fcn.005645ad
mov al, byte [0x23d0b121]
invalid
lea ecx, [eax - 0xb1]
rdtsc
setns ch
xchg byte [esp + 0xf], al
mov cl, 0xba
bsr dx, bp
jmp 0x564505
inc edx
pushal
mov dl, 0xe4
mov al, ah
pop cx
bswap esi
jmp 0x564525
cmc
rol bx, cl
neg bh
mov dword [esp], esi
bswap esi
mov dword [esp], eax
jmp 0x5644f3
Function at 0x5645ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xb], ebp
lea esi, [ebp*4]
bswap esi
push edx
xchg dword [esp + 0xe], ecx
inc si
jmp 0x564589
lea edi, [esi + 0x1d]
mov edx, 0xf344acb4
mov word [esp + 0xe], dx
mov si, word [esp + 0x14]
mov word [esp + 0x16], bx
setno bh
jmp 0x564551
shl bp, cl
lea eax, [esi + edi]
push word [esp + 0xc]
add esp, 7
lea ecx, [eax*4]
rdtsc
jmp 0x5646c9
mov dword [esp + 0x14], ebp
pop cx
jmp 0x56456d
popal
stc
call 0x5645bd
push 0xffffffffffffff83
les eax, [ecx]
cld
mov word [esp], di
mov byte [esp + 1], ah
jmp 0x5645e7
rdtsc
lea ebx, [edx + ebp]
btc edx, edi
xchg byte [esp], bl
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x5645b5
lea esp, [esp + 3]
popfd
jmp 0x56464e
xchg esi, ebx
and ebp, ecx
xchg byte [esp], dl
mov byte [esp + 1], ah
bsf dx, si
lea esp, [esp + 2]
jmp 0x5645d3
mov edx, ecx
mov dx, word [esp + 6]
neg edx
setl ah
lea esp, [esp + 0x19]
mov ax, 0x39d7
jmp 0x56460b
push 0x700b335
add dword [esp], reloc.MSVCRT.dll_strncpy
push esp
call 0x564661
test eax, 0x724648d
call fcn.005646a0
ret 0xd84a
cpuid
xchg ecx, eax
mov dword [esp + 0xf], esi
mov edi, dword [esp + 0x15]
mov byte [esp + 0x15], bh
bsr cx, bp
jmp 0x564638

Function at 0x5664c2
Capabilities:
Parse pe header

Disassembly:
push word [esp + 3]
jmp 0x5664cd
lea esp, [esp + 3]
call fcn.00566539

Function at 0x5664d6
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 2]
mov dword [esp + 1], ebp
jmp 0x56650f
pop word [esp + 3]
mov byte [esp + 4], dh
mov word [esp], di
pushal
lea esp, [esp + 2]
mov dword [esp + 0x3c], edx
jmp 0x566549
pushal
mov dword [esp + 3], eax
mov byte [esp + 0x1b], ch
pop word [esp + 0x15]
push dword [esp + 0x10]
jmp 0x5665dd
mov word [esp + 0xc], di
pop word [esp + 0x17]
push word [esp + 0x17]
call fcn.0056659d

Function at 0x566539
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], ebp
lea esp, [esp + 3]
mov dword [esp + 0x1c], ecx
call fcn.005664d6

Function at 0x5665c4
Capabilities:
Parse pe header

Disassembly:
call fcn.005665ad
or al, 0x8b
sbb edi, dword [esi - 0x73]
mov byte fs:[0x34c5a22c], al
fidiv dword [ecx + edi - reloc.MSVCRT.dll_strncpy]
cwde
sti

Function at 0x5665f1
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 8]
mov word [esp + 0xc], dx
mov dword [esp + 3], esi
lea esp, [esp + 9]
pop word [esp]
jmp 0x56664f
lea esp, [esp + 1]
mov dword [esp + 0x58], esp
pushal
mov word [esp + 0x12], dx
call fcn.00566632
Function at 0x566662
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x564139
call fcn.0056413e
bsf di, si
cld
call fcn.005660b4
call 0x56600c
jmp 0x5667c9
movzx ebx, word [eax + 0x3c]
jmp 0x56678b
mov ecx, 0x27ecf50a
xchg word [esp + 2], bx
mov ch, byte [esp + 4]
mov di, word [esp + 2]
push word [esp + 9]
jmp 0x565ffd
mov edi, dword [esp]
bsr di, cx
and ebx, ecx
not edi
bswap edi
sub esp, 0x10
jmp 0x56601b
mov bl, bh
bsf di, si
setp ch
or bx, 0xa528
add esp, 2
mov edi, dword [esp]
jmp 0x56603b
pop dword [esp + 0xe]
pop dword [esp + 0x14]
mov ebx, dword [esp + 0x17]
mov dword [esp + 0x17], eax
lea esp, [esp + 0x1d]
not edi
jmp 0x566052
xchg dword [esp + 0x14], ebx
pop dword [esp + 0x14]
and cl, bh
mov dword [esp + 3], ebp
pop word [esp + 0x19]
neg ch
jmp 0x566072
mov word [esp + 6], sp
mov byte [esp + 3], bh
lea esp, [esp + 5]
jmp 0x56668f
lea esp, [esp + 3]
lea esp, [esp + 1]
push esp
pop word [esp]
lea esp, [esp]
lea esp, [esp + 3]
jmp 0x566709
mov dword [esp + 0x6c], esi
call fcn.005666e4
lea esp, [esp + 0x8c]
jmp 0x566a22
mov dword [esp + 0x8c], edi
jmp 0x566712
and al, 0x8c
add byte [eax], al
add bl, ch
fmul st(7)
push esi
rol dword [eax - reloc.MSVCRT.dll_strncpy], 0x7c
and al, 0xc
mov dword [esp + 9], eax
and al, 9
add esp, 3
not edi
pushal
mov bx, word [esp + 0x1e]
and al, 0x1e
push ds
jmp 0x5660cb
push ebp
lds ebp, [edi + ebx*2 + 0x54c65ef4]
xor ecx, esi
jns 0x566752
jnp 0x566753
invalid
sub eax, 0x10000
jmp 0x5667cd
add ebx, eax
cmp word [ebx], 0x4550
je 0x563a2d
jne 0x566770
adc dl, byte [edx + 0x73926700]
nop
jae 0x566731
pop ss
xchg edx, esp
adc ebp, edi
push cs
mov byte [esi], bl
jns 0x566733
popal
mov al, byte [0x2fdcb525]
int 0xd2
push esi
les esp, [ebx - 0x34bf4fa2]
pop ebx
int 0x22
out 0x6c, al
loop 0x566747
je 0x56675a
stc
fdivr dword [ebx]
adc cl, byte [ebp - 0x3fcc99a8]
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x566011
jne 0x566770
adc eax, 0xa66b0c9e
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
add dword [ebp - 0xd], esp
arpl word [esi], ax
cmc
daa
jge 0x5667dc
push 0xd
cld
adc ebp, dword [ebp - 0x1f]
jno 0x566800
jecxz 0x566801
lodsd eax, dword [esi]
and dh, byte [eax - 0x123fdd29]
not dword [bp + si - reloc.MSVCRT.dll_strncpy]
adc eax, 0x98690e98
jnp 0x56686a
not dword [edx - reloc.MSVCRT.dll_strncpy]
push cs
imul ebx, dword [eax + reloc.MSVCRT.dll_strncpy], 0x751fff0c
out 0x74, al
adc ebp, esi
cmc
or al, 0xff
pop ds
jne 0x5667f2
je 0x566821
out dx, al
pop es
test dword [ebx], ebx
mov ebp, esi
sbb eax, 0x127cedbc
jne 0x56679f
jne 0x5667fa
dec ecx
fnstcw word [eax - 0x158203b5]
cld
jge 0x56680e
js 0x566845
ljmp 0x9fa:0x9f0f9d43
hlt
invalid
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x566007
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x566875

Function at 0x5666e4
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push esp
mov word [esp + 4], di
push word [esp + 5]
pop word [esp + 1]
pushal
jmp 0x566729
mov byte [esp], dh
mov byte [esp + 2], ch
push word [esp + 3]
push esp
pop dword [esp]
jmp 0x5666cb
pop dword [esp + 0x1e]
lea esp, [esp + 2]
Function at 0x4056d0
Capabilities:
Contain obfuscated stackstrings
Listen for remote procedure calls

Disassembly:
push ebp
xor eax, eax
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x54
mov dword [ebp - 0x34], 0x63006e
mov dword [ebp - 0x30], 0x630061
mov dword [ebp - 0x2c], 0x5f006e
mov dword [ebp - 0x28], 0x70006e
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], 0x70005c
mov dword [ebp - 0x1e], 0x700069
mov dword [ebp - 0x1a], 0x5c0065
mov dword [ebp - 0x16], 0x760073
mov dword [ebp - 0x12], 0x630063
mov dword [ebp - 0xe], 0x6c0074
mov word [ebp - 0xa], dx
call dword [sym.imp.kernel32.dll_CreateThreadpoolCleanupGroup]
mov dword [0x421004], eax
test eax, eax
je 0x40589f
lea eax, [ebp - 0x22]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerUseProtseqEpW]
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x405780
test byte [section..data], 2
jne 0x405840
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x419188]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerRegisterIf]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4057e0
test byte [section..data], 2
je 0x405775
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerRegisterIf_failed_with_error__lu_n
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 4], 0x419000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x405775
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4d2
mov dword [esp], 1
call dword [sym.imp.rpcrt4.dll_RpcServerListen]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x405870
test byte [section..data], 2
je 0x405775
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerListen_failed_with_error__lu_n
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 4], 0x419000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x405775
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerUseProtseq_failed_with_error__lu_n
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 4], 0x419000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x421000
mov dword [esp + 4], 0x3e8
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 0x10
leave
ret
test byte [section..data], 2
jne 0x4058b6
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
jmp 0x405775
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], 0x41a4b8
mov dword [esp + 8], str.RPC_Init
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x419000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4058a8
Function at 0x405a60
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
sub esp, 0x34
test ecx, ecx
je 0x405ab8
cmp word [ecx], 0
mov eax, ecx
je 0x405ae0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405a78
sub eax, ecx
add eax, 2
mov dword [esp], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, dword [ebp - 4]
sub esp, 0x18
leave
ret
mov dword [ebp - 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
sub esp, 8
cmp eax, 2
leave
cmove eax, ecx
ret
mov eax, 2
jmp 0x405a86

Function at 0x405af0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
sub esp, 0x34
test ecx, ecx
je 0x405b4c
cmp word [ecx], 0
mov eax, ecx
je 0x405b6d
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405b08
add eax, 2
cmp word [eax], 0
jne 0x405b08
sub eax, ecx
add eax, 2
mov dword [esp], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0
mov dword [esp + 4], edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, dword [ebp - 4]
sub esp, 0x18
leave
ret
mov dword [ebp - 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
sub esp, 8
cmp eax, 2
leave
cmove eax, ecx
ret
mov eax, 2
jmp 0x405b1f
Function at 0x407340
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 8]
lea esi, [edi + 0x18]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lock dec dword [ebx + 0xc]
jne 0x40736b
mov eax, dword [ebx + 0x74]
test eax, eax
jne 0x407380
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
sub esp, 8
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov dword [ebx + 4], 0
mov dword [ebx], 0
mov dword [esp], ebx
call sym._free_service_entry
jmp 0x40736b

Function at 0x407520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov edi, dword [esi + 8]
lea eax, [edi + 0x18]
add edi, 0x10
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ebx, dword [edi]
sub esp, 8
cmp edi, ebx
jne 0x40756e
jmp 0x407592
mov ebx, dword [ebx]
cmp ebx, edi
je 0x407592
cmp dword [ebx + 0x68], esi
jne 0x407568
mov dword [ebx + 0x18], 1
mov dword [ebx + 0x68], 0
dec dword [esi + 0x10]
mov dword [esp], esi
call sym._release_process
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x40756e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408ea0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x1c]
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x14]
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [eax], 0
lea eax, [ebp - 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x408f18
mov edi, eax
cmp eax, 2
je 0x408ff0
xor ecx, ecx
test byte [0x419080], 2
jne 0x408f38
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x408f78
cmp eax, 2
jne 0x408f2c
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x408f78
mov edi, 0x70c
jmp 0x408ef7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], 0x41b7f0
mov dword [esp + 4], 0x419080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
mov ecx, dword [ebp - 0x2c]
jmp 0x408f02
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x30], eax
call eax
mov dword [esp + 0xc], esi
mov ecx, eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x2c]
sub esp, 0x18
test eax, eax
mov edi, eax
jne 0x408ef9
mov eax, dword [ebp - 0x20]
xor edx, edx
and eax, 0xfffffffe
cmp dword [ebp - 0x1c], 2
mov word [ecx + eax], dx
je 0x409000
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov dword [esp], ecx
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call esi
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x20], eax
mov ebx, eax
jne 0x409040
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
jmp 0x408ef9
add eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [ebp - 0x30], eax
call esi
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
jmp 0x408f0b