joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077cd
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x40f1ad
call fcn.0040e67e
lea ecx, [ebp - 0x10]
xor ebx, ebx
call dword [0x41676c]
mov dword [ebp - 4], ebx
call dword [sym.imp.ATDUhelper.dll_Ordinal_1258]
push str.ATDU_
lea ecx, [ebp - 0x14]
call dword [0x416764]
lea eax, [ebp - 0x18]
push str.CG_Scheduler_92C5B423_76D6_4e85_A186_DCC74D1B3071
push eax
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00405f06
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push dword [ebp - 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x154], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40785a
cmp eax, 5
je 0x40785a
push dword [edi + 0x154]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40785d
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, ebx
call fcn.0040e71d
ret
Function at 0x40acfd
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x41f028]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
mov ecx, edi
call sub.mfc90u.dll_CWnd::CWnd
lea esi, [edi + 0x78]
mov dword [edi], vtable.CMJHeaderCtrl.0
call fcn.0040b3da
lea esi, [edi + 0xa8]
call fcn.0040b3da
lea esi, [edi + 0xd8]
call fcn.0040b3da
lea esi, [edi + 0x108]
call fcn.0040b3da
xor ecx, ecx
lea eax, [edi + 0x140]
mov dword [eax + 4], ecx
mov dword [eax], vtable.CFont.0
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], ecx
mov eax, dword [0x41f94c]
mov dword [edi + 0x138], eax
lea eax, [ebp - 0x80]
push eax
mov byte [edi + 0x148], 1
mov byte [edi + 0x149], cl
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 5
pop esi
jne 0x40adb2
cmp dword [ebp - 0x78], 1
jne 0x40adb2
mov dword [edi + 0x150], 7
mov dword [edi + 0x158], 0x12
jmp 0x40adc6
mov dword [edi + 0x150], 3
mov dword [edi + 0x158], 0x10
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
mov dword [edi + 0x154], 0x15
mov dword [edi + 0x14c], 0xa
mov eax, edi
call fcn.0040de80
add ebp, 0xa0
leave
ret

Function at 0x40de80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f028]
jne 0x40de8a
repz ret
jmp fcn.0040e39e
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x55
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xea
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xef
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xdf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x91
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x93
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf5
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x26
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x35
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x5a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x23
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x27
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x402fec
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x402fef
std
mov ecx, 0x508ddae1
in al, dx
add al, 0x57
pop esp
cmp dl, byte [edx]
mov al, byte [0xd195cc0f]
in al, 0xd7
std
stc
call 0xe65416f7
iretd
Function at 0x401d10
Capabilities:
Access peb ldr_data
Check mutex on windows
Create thread
Get file size
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x405018]
xor eax, esp
mov dword [esp + 0x818], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov eax, dword fs:[0x30]
push 0xf0000000
mov eax, dword [eax + 0xc]
push 1
mov eax, dword [eax + 0x14]
push 0
mov eax, dword [eax + 0x20]
push 0
push 0x405438
mov dword [0x405434], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x401d7c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.004022bd
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [0x405434]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401dd9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x401dd9
push 0
lea eax, [esp + 0x20]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401dd9
push dword [esp + 0xc]
mov edx, edi
mov ecx, ebx
call fcn.00401530
push str.Global3pc6RWOgectGTFqCowxjeGy3XIGPtLwNrsr2zDctYD4hAU5pj4GW7rm8gHrHyTB6
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401e0e
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004022bd
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401cd0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401bb0
push 0
push 0
call esi
push 0x400
lea eax, [esp + 0x24]
push eax
push str.userprofile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [sym.imp.ntdll.dll_NtDelayExecution]
mov dword [esp + 0x10], 0x4d2fa200
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00401a90
lea eax, [esp + 0x10]
push eax
push 0
call esi
jmp 0x401e61

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x491d3b2f
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x4f370b02
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40515c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405195
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40519e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4051a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4051c9
mov al, byte [esp]
jmp 0x4051cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406518
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
test eax, 0x6750009
mov al, 1
jmp 0x4064b4
add al, 0xdd
fdiv dword [ebx]
rcr byte [ebx + 0x6dd9e2db], 0xfa
wait
fnclex
fldcw word [ebp - 6]
wait
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ebx
push esi
pushal
pushfd
test edx, edx
jb 0x4064a7
rol esi, 0x1b
test edx, 0x12eb1c41
jb 0x4064af
xor edx, eax
mov eax, 0x1b1ffa10
add esi, 0x381e220
mov esi, ecx
xor ebx, esi
mov esi, eax
neg ebx
xor ebx, eax
test ecx, esp
jb 0x4064f7
xchg eax, eax
dec edx
xor edx, edx
or edx, eax
mov edx, eax
dec esi
test ebp, esi
jo 0x406547
mov edi, dword [0x40b218]
mov edi, 0x16188f40
xchg eax, edx

Function at 0x406564
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
add esi, 0x4c027b4
call fcn.00402bc9
dec dword [ebx + 0x70c585f0]
das
mov ecx, dword [0x40b0ac]
sub edx, eax
and esi, edi
or esi, edi
xor ebx, edx
call fcn.00407d30
or esi, edi
ror edi, 9
or dword [ecx + 0x210364], edi
invalid
out dx, al
cmp eax, 0x40b102
xchg ebx, eax
shr esi, 0x1a
mov esi, dword [0x40b3c3]
ror eax, 1
xor dword [0x40b936], 0x25218cd
inc esi
shl edi, 0xf
inc eax
neg eax
loop 0x406592
mov eax, eax
mov ecx, dword [0x40b3af]
xor ecx, edi
mov ecx, 0x5de337
inc esi
dec eax
call fcn.00408547
neg esi
inc esi
sub dword [0x40b9c1], ebx
xor esi, dword [0x40b2ee]
xor dword [0x40b8c2], edx
test ecx, esp
jo 0x406643
mov dword [0x40b5d7], esi
rol edi, 0x1b
neg eax
loop 0x4065d9
invalid
invalid
Function at 0x40656c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
add esi, 0x4c027b4
call fcn.00402bc9
dec dword [ebx + 0x70c585f0]
das
mov ecx, dword [0x40b0ac]
sub edx, eax
and esi, edi
or esi, edi
xor ebx, edx
call fcn.00407d30
or esi, edi
ror edi, 9
or dword [ecx + 0x210364], edi
invalid
out dx, al
cmp eax, 0x40b102
xchg ebx, eax
shr esi, 0x1a
mov esi, dword [0x40b3c3]
ror eax, 1
xor dword [0x40b936], 0x25218cd
inc esi
shl edi, 0xf
inc eax
neg eax
loop 0x406592
mov eax, eax
mov ecx, dword [0x40b3af]
xor ecx, edi
mov ecx, 0x5de337
inc esi
dec eax
call fcn.00408547
neg esi
inc esi
sub dword [0x40b9c1], ebx
xor esi, dword [0x40b2ee]
xor dword [0x40b8c2], edx
test ecx, esp
jo 0x406643
mov dword [0x40b5d7], esi
rol edi, 0x1b
neg eax
loop 0x4065d9
invalid
invalid

Function at 0x406594
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sbb eax, 0xffc3e4e8
dec dword [ecx + 0x40b62935]
add cl, al
ret 0x31d

Function at 0x4068b4
Capabilities:
Hash data using murmur3

Disassembly:
inc esi
call fcn.00402b03
neg esi
sub ecx, esp
xor edx, 0x3189b854
rol edx, 0x1b
ror edx, 0x1b
xor edx, 0x3189b854
add ecx, esp
neg esi
dec esi
xor esi, eax
xor dword [0x40b99a], 0x1182254d
add esi, eax
or dword [0x40b67f], ecx
xor eax, 0x76d409c
mov dword [0x40b5ba], 0x607b51a
inc esi
sub eax, esp
dec esi
call fcn.0040761c
push eax
xor esi, 0x4b6443d
not ebx
rol eax, 0x1b
xor edi, dword [0x40bde8]
xor dword [0x40b590], ecx
mov dword [0x40b854], 0x20c4816e
xor esi, 0x19e30297
mov dword [0x40b420], 0x4e1ac52
rol edi, 0xd
not esi
call fcn.004058e2
inc eax
xor edx, 0x2497e798
ror eax, 0x12
sub esi, 0x189fc241
xchg edi, eax
xor edx, dword [0x40bfb4]
xchg eax, eax
xor esi, 0x1af72088
add ecx, 0x1af2248c
sub ecx, 0x1af2248c
xor esi, 0x1af72088
xchg eax, eax
xchg edi, eax
add esi, 0x189fc241
rol eax, 0x12
xor edx, 0x2497e798
dec eax
Function at 0x406984
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00402ac7
not esi
ror edi, 0xd
mov dword [0x40b69e], 0x3e970bc
xor esi, 0x19e30297
and dword [0x40b453], 0x15aeace
or dword [0x40b784], ecx
ror eax, 0x1b
not ebx
xor esi, 0x4b6443d
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esi, esp
rol esi, 0x1d
mov dword [0x40b9c0], 0x71a8254
sub ecx, dword [0x40bb2a]
neg esi
sub esi, eax
sub edx, dword [0x40bf99]
call fcn.004031de
sub esi, dword [0x40bce0]
ror ebx, 0x1c
dec edi
inc edi
rol ebx, 0x1c
add esi, eax
neg esi
sub dword [0x40b4a4], 0x1797c2c
ror esi, 0x1d
add esi, esp
add esp, 0x10
call fcn.004077d8
xor ecx, dword [0x40ba0a]
xor esi, 0x13674644
mov dword [0x40b6d0], ecx
xor ecx, 0x8be0741
inc eax
xor edi, edx
ror esi, 0x13
call fcn.0040782b
xor esi, eax
not eax
xor eax, 0x24f9a71c
call fcn.00405ffb
inc esi
xor esi, eax
ror edx, 0x1d
sub ecx, dword [0x40bf4f]
add dword [0x40b762], esi
xor eax, esp
sub edi, dword [0x40bdfd]
call fcn.0040906b
call fcn.00401655
xor eax, esp
rol edx, 0x1d
xor esi, eax
dec esi
call fcn.00405ffb
xor eax, 0x24f9a71c
not eax
xor esi, eax
rol esi, 0x13
xor edi, edx
dec eax
xor ecx, 0x8be0741
xor esi, 0x13674644
push 0x40
xor eax, 0x4ac85de
ror esi, 0x17
inc esi
add esi, 0x4f36d6a
xor esi, edx
inc eax
xor eax, esp
xor dword [0x40b9bc], edx
xchg eax, eax
rol esi, 0x16
xor edx, dword [0x40bf68]
xor esi, eax
neg edx
invalid

Function at 0x4077a8
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4077c4
shr eax, 1
xor eax, 0xedb88320
jmp 0x4077c6
shr eax, 1
dec edx
jne 0x4077b7
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4077b0
pop esi

Function at 0x4077f3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4077ff
call fcn.004077a8
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40782a
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407805
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x408e14
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408dc8
test al, al
jne 0x408e35
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408e81
xor eax, eax
push ebp
push 0x408e71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e78
lea eax, [ebp - 0xc]
call fcn.00408e04
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
Function at 0x409188
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409277
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c30
mov edx, dword [ebp - 8]
mov ecx, 0x409290
xor eax, eax
call fcn.0040907c
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409245
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x4091a8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408c34
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404be4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004071a8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408c04
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045b0
call fcn.004057e0
call fcn.00402eb4
jmp 0x4091a8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40927e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409330
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40938a
inc esi
xor edi, edi
cmp edi, 1
jne 0x409356
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409364
cmp edi, 1
jle 0x409364
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408e14
test eax, eax
jne 0x40938a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40938a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40938a
inc edi
dec esi
jne 0x409346
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x401860
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 0x18], ebx
dec ebx
test byte [section..data], 8
jne 0x4018d8
test ebx, ebx
jne 0x4018c3
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40189f
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p____lu_n
mov dword [esp + 8], str.factory_Release
mov dword [esp + 4], 0x404000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401889
Function at 0x402150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4021ab
cmp byte [esi + ebx - 1], 0xa
je 0x40217f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x402590
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov esi, dword [eax + 4]
mov edi, dword [eax + 0xc]
mov ecx, dword [ecx]
mov ebx, dword [eax + 8]
mov dword [ebp - 0x1c], esi
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x20], edi
mov esi, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
test byte [section..data], 8
jne 0x402600
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov eax, dword [ecx + 0x18]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoMarshalInterface]
sub esp, 0x18
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
test ebx, ebx
je 0x4026f8
mov eax, ebx
mov dword [ebp - 0x28], edx
shr eax, 0x10
mov dword [ebp - 0x24], ecx
je 0x4026d8
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x24], edx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p__s__p__08lx__p__08lx__n
mov dword [esp + 8], str.marshal_MarshalInterface
mov dword [esp + 4], 0x404000
mov dword [esp], 3
mov dword [ebp - 0x28], ecx
call sym._wine_dbg_log.constprop.0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
jmp 0x4025c9
movzx eax, bx
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
jmp 0x402681
mov eax, str._null_
jmp 0x402681