joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469d60
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x46e478
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b308]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x491474]
test eax, eax
jne 0x469d92
xor esi, esi
jmp 0x469d9b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x469dc7
cmp dword [esi + 0x14], 0
jne 0x469e09
cmp dword [esi + 0x10], 0
jne 0x469e10
push 0
call fcn.00469cd0
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x469df5
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x469df5
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x469e50
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x469e3e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x469e10
cmp dword [esi + 0x14], 0
je 0x469db7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x469e75
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x469ea6
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x469ea6
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x469ea6
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x469e5a
jmp 0x469db1
Function at 0x1001277a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10012789
pop dword [ebp - 0x34]
mov eax, 0x9f9efe4
sub eax, 0xf9f8c85b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xca14f90
add dword [ebp - 0x44], 0x41b0f5bb
mov dword [ebp - 0x40], 0x75632c22
add dword [ebp - 0x40], 0xbcd02023
mov dword [ebp - 0x3c], 0x1cf65014
add dword [ebp - 0x3c], 0x2f55f41a
mov dword [ebp - 0x38], 0x67330d8b
add dword [ebp - 0x38], 0x98ccf275
lea eax, [ebp - 0x44]
push eax
mov eax, 0x530e25fc
add eax, 0xbcf42a88
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xd98070ef
sub dword [ebp - 0x44], 0x650e0799
mov dword [ebp - 0x40], 0x59bf101
sub dword [ebp - 0x40], 0xc42f8f8c
mov dword [ebp - 0x3c], 0x670b6408
sub dword [ebp - 0x3c], 0x39bf79c
mov dword [ebp - 0x38], 0xd42e05b2
add dword [ebp - 0x38], 0x2bd1fa4e
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb390b2e8
sub eax, 0xa38e626c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39586
push 0
call eax
mov ecx, 0xd58bba9c
sub ecx, 0xd58b7ae1
xor ebx, ebx
add ebx, eax
mov edx, 0x4c9e78a8
add edx, 0xc3649358
add edx, dword [ebp - 0x34]
mov edi, 0x7bdfb4d6
sub dword [ebp - 0x28], esi
mov esi, dword [edx]
sub dword [ebp - 0x18], 0x24a6bb1b
xor esi, edi
add dword [ebp - 0x20], esi
mov dword [ebx], esi
xor dword [ebp - 8], 0xf4254cd9
add ebx, 0x34916155
add ebx, 0xcb6e9eaf
add edx, 0xcc9bce9d
sub edx, 0xcc9bce99
loop 0x100128a7
add eax, 0x36cc6fe4
add eax, 0xc93481db
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd78acc5d
sub ecx, 0xc78acc5d
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001277a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001277a
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001277a
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001277a
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10

Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001277a
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8
Function at 0x10001750
Capabilities:
Encode data using xor

Disassembly:
movaps xmm1, xmmword [0x10012de0]
xor eax, eax
test edx, edx
je 0x100017a6
cmp edx, 0x10
jb 0x10001791
push esi
mov esi, edx
and esi, 0xfffffff0
nop dword [eax + eax]
movups xmm0, xmmword [ecx]
add eax, 0x10
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
movups xmmword [ecx], xmm0
add ecx, 0x10
cmp eax, esi
jb 0x10001770
pop esi
cmp eax, edx
jae 0x100017a6
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001793
ret

Function at 0x100017b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 1
push dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100017e3
or eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.1000227a
push esi
mov edi, eax
push 0
push edi
call fcn.10003960
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov edx, esi
mov ecx, edi
call fcn.10001750
push dword [ebp - 8]
mov edx, esi
mov ecx, edi
push dword [ebp - 0xc]
call fcn.100016d0
push edi
mov esi, eax
call fcn.10002283
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402c30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418018
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x42a018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], vtable.ON_SimpleArray_class_ONX_Model_Object__.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], eax
call dword [sym.imp.opennurbs.dll_public:_void___thiscall_ON_wString::constructor_void_]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov dword [esi + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40bab0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4193b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x42a018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x638]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x41c404
push eax
mov eax, dword [ecx]
call eax
test eax, eax
mov eax, dword [ebp - 0x10]
jne 0x40bbec
test eax, eax
je 0x40bbec
mov bl, 1
cmp byte [esi + 0x862], bl
jne 0x40bb55
push ecx
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [ebp - 0x14], esp
je 0x40bb2e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov ecx, esi
call fcn.0040b290
mov bl, al
cmp bl, 1
jne 0x40bb55
mov ecx, esi
call fcn.0040b830
test al, al
jne 0x40bb55
push str.Error_writing_out_textures_n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 4
mov eax, dword [esi + 0x664]
mov ecx, dword [eax]
lea edx, [esi + 0x668]
push edx
push 0x41c474
push eax
mov eax, dword [ecx]
call eax
cmp bl, 1
jne 0x40bb9c
push 0xffffffffffffffff
push 0
push 0
push ecx
mov ecx, dword [ebp - 0x10]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [ebp - 0x14], esp
je 0x40bb93
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.0040bc20
mov bl, al
cmp byte [esi + 0x870], 1
jne 0x40bbc4
cmp byte [esi + 0x871], 1
jne 0x40bbc4
lea ecx, [esi + 0x874]
call dword [sym.imp.opennurbs.dll_public:_wchar_t_const____thiscall_ON_wString::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.MSVCR80.dll__wrmdir]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40bbda
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x40bbff
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414580
Capabilities:
Move file

Disassembly:
push ebx
mov ebx, dword [sym.imp.opennurbs.dll_public:_wchar_t_const____thiscall_ON_wString::operator_wchar_t_const__void_const]
push esi
push edi
mov edi, eax
lea esi, [edi + 0xe8]
mov ecx, esi
call ebx
push eax
call dword [sym.imp.MSVCR80.dll__wunlink]
add esp, 4
add edi, 0xec
push 0
mov ecx, edi
call dword [sym.imp.opennurbs.dll_public:_wchar_t____thiscall_ON_wString::operator___int_]
cmp word [eax], 0
je 0x4145c8
mov ecx, esi
call ebx
push eax
mov ecx, edi
call ebx
push eax
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x41620c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a018]
jne 0x416216
repz ret
jmp fcn.00416704
Function at 0x1001d471
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10048aac], 0
push esi
push edi
jne 0x1001d3e7
call fcn.1001d353
test eax, eax
je 0x1001d42c
mov eax, dword [0x10048aac]
cmp eax, 1
jne 0x1001d408
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1001d42c
jmp 0x1001d46e
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1001d46e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1001d430
xor eax, eax
jmp 0x1001d46e
mov eax, dword [esi]
push dword [0x10048aac]
call edi
mov edi, eax
test edi, edi
je 0x1001d452
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1001d46e
lea edi, [esi + 0xff0]
push esi
push dword [0x10048aac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1001d458
mov eax, esi
pop edi
pop esi
ret
jmp 0x1001d3d3

Function at 0x1001d742
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047578]
jne 0x1001d74c
repz ret
jmp fcn.10023329

Function at 0x1001fa50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001fa5f
pop dword [ebp - 0x4c]
mov eax, 0x1001fa5f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x4146e
push 0
mov eax, 0x4184ac74
sub eax, 0x318129a4
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xccac1dfb
sub ecx, 0xccabd30e
mov edi, eax
mov ebx, 0x10077a00
add ebx, dword [ebp - 0x4c]
mov esi, 0xf5819289
add esi, 0x4abc8596
add dword [ebp - 0x38], edi
mov edx, dword [ebx]
sub dword [ebp - 8], 0x3939be16
xor edx, esi
sub dword [ebp - 0x24], eax
mov dword [edi], edx
add dword [ebp - 0x30], ebx
add edi, 4
add ebx, 0xa188e7e7
add ebx, 0x5e77181d
loop 0x1001fab3
add eax, 0x35f7d503
add eax, 0xca094984
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x25815b05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x25815b14
pop dword [ebp - 0x24]
mov eax, 0x25815b14
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5020edda
add dword [ebp - 0x34], 0xfe315771
mov dword [ebp - 0x30], 0xa6aff555
add dword [ebp - 0x30], 0x8b8356f0
mov dword [ebp - 0x2c], 0xe25d85db
sub dword [ebp - 0x2c], 0x961141ad
mov dword [ebp - 0x28], 0x2debd633
sub dword [ebp - 0x28], 0x2debd633
lea eax, [ebp - 0x34]
push eax
mov eax, 0xcbefe9f
add eax, 0x18c2d1a5
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xdf5044f1
sub dword [ebp - 0x34], 0x6adddb9b
mov dword [ebp - 0x30], 0x637456bd
sub dword [ebp - 0x30], 0x2207f548
mov dword [ebp - 0x2c], 0xdefaadff
add dword [ebp - 0x2c], 0x8474be6d
mov dword [ebp - 0x28], 0x3a2166b1
sub dword [ebp - 0x28], 0x3a2166b1
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x9dca9ecb
add eax, 0x87b731b5
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3d091
push 0
call eax
mov ecx, 0x6d8d9a5d
sub ecx, 0x6d8d5065
mov edx, eax
mov ebx, 0x25829600
add ebx, dword [ebp - 0x24]
mov edi, 0xa802b8c4
add edi, 0x66a27a30
mov esi, dword [ebx]
sub dword [ebp - 0x18], 0x49ef0aa8
xor esi, edi
xor dword [ebp - 8], 0xc20d1dc
mov dword [edx], esi
add dword [ebp - 4], edi
add edx, 4
add ebx, 0x9246dce
add ebx, 0xf6db9236
loop 0x25815c2b
add eax, 0xb03672e4
add eax, 0x4fcaa7cf
mov ebx, eax
add eax, 0x4f54f936
add eax, 0xb0ab06cf
mov ecx, 0xf875eb7e
add ecx, 0x2d0a1482
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x68242470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242480
xor eax, eax
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0xc], str.__p__s__stub__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.RasCreatePhonebookEntryA
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 8

Function at 0x682424d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x682424e0
xor eax, eax
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.__p__s__stub__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.RasCreatePhonebookEntryW
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 8

Function at 0x68242610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242620
xor eax, eax
ret 0xc
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_an.constprop.0
mov ebx, eax
mov eax, dword [ebp + 8]
call sym._wine_dbgstr_an.constprop.0
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str.__s__s_0x_08lx__stub__n
mov dword [esp + 8], str.RasDeleteSubEntryA
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret 0xc

Function at 0x68242d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242d40
xor eax, eax
ret 0x14
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
call sym._wine_dbgstr_an.constprop.0
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], str.__s__p__p__p__p__stub__n
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], str.RasGetAutodialAddressA
mov dword [esp + 0x1c], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], 0x68245038
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0xc]
mov dword [esp], 0
mov dword [esp + 0x14], edx
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 0x14
Function at 0x68242da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242db0
xor eax, eax
ret 0x14
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], str.__s__p__p__p__p__stub__n
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], str.RasGetAutodialAddressW
mov dword [esp + 0x1c], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], 0x68245038
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0xc]
mov dword [esp], 0
mov dword [esp + 0x14], edx
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 0x14

Function at 0x68242e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242e20
xor eax, eax
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__lx__p__stub__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.RasGetAutodialEnableA
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 8

Function at 0x68242e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242e80
xor eax, eax
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__lx__p__stub__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.RasGetAutodialEnableW
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 8

Function at 0x68242f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68242fa0
xor eax, eax
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p__p__stub__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.RasGetConnectStatusA
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 8

Function at 0x68242ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x68245038], 1
jne 0x68243000
xor eax, eax
ret 8
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p__p__stub__n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.RasGetConnectStatusW
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x68245038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
leave
ret 8