joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b962c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4da608]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4da608]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4da608]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4da608]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4da18c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4b9657
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4b9724
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4da608]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4da608]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4da608]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4da608]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4da18c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4b975f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4b9840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4da608]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4da608]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4da608]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4da608]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4da18c]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4da608]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4da608]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4da608]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4da608]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4b988b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c8ebc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
call fcn.004c8ce0
xor eax, eax
mov edx, eax
mov esi, eax
mov dword [ebp - 0xc], eax
cmp edi, edx
lea eax, [ebx + edx]
jle 0x4c8f58
mov ecx, edi
sub ecx, edx
cmp ecx, 2
jl 0x4c8ef9
cmp byte [eax], 0xd
jne 0x4c8ef9
cmp byte [eax + 1], 0xa
je 0x4c8f52
cmp byte [eax], 0xa
je 0x4c8f52
cmp byte [eax], 0x3d
jne 0x4c8f18
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, 2
jle 0x4c8f18
mov eax, 0x12
jmp 0x4c902b
cmp byte [eax], 0x7f
ja 0x4c8f2a
xor ecx, ecx
mov cl, byte [eax]
cmp byte [ecx + 0x4df260], 0x7f
jne 0x4c8f34
mov eax, 0x12
jmp 0x4c902b
xor ecx, ecx
mov cl, byte [eax]
cmp byte [ecx + 0x4df260], 0x40
jae 0x4c8f51
cmp dword [ebp - 0xc], 0
je 0x4c8f51
mov eax, 0x12
jmp 0x4c902b
inc esi
inc edx
inc eax
cmp edi, edx
jg 0x4c8ee5
test esi, esi
jne 0x4c8f63
xor eax, eax
jmp 0x4c902b
mov ecx, esi
mov eax, dword [ebp - 8]
add ecx, ecx
lea ecx, [ecx + ecx*2]
add ecx, 7
sar ecx, 3
mov esi, ecx
cmp esi, dword [eax]
jle 0x4c8f88
mov edx, dword [ebp - 8]
mov eax, 0x10
mov dword [edx], esi
jmp 0x4c902b
mov dword [ebp - 0xc], 3
xor ecx, ecx
test edx, edx
mov dword [ebp - 0x10], ecx
mov esi, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
jle 0x4c901e
mov al, byte [ebx]
cmp al, 0xd
je 0x4c9018
cmp al, 0xa
je 0x4c9018
xor ecx, ecx
mov cl, al
cmp byte [ecx + 0x4df260], 0x40
sete al
and eax, 1
inc esi
sub dword [ebp - 0xc], eax
xor eax, eax
mov al, byte [ebx]
mov ecx, dword [ebp - 0x10]
shl ecx, 6
movzx eax, byte [eax + 0x4df260]
and eax, 0x3f
or ecx, eax
cmp esi, 4
mov dword [ebp - 0x10], ecx
jne 0x4c9018
xor esi, esi
cmp dword [ebp - 0xc], 0
jle 0x4c8ff3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
shr eax, 0x10
mov byte [ecx], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0xc], 1
jle 0x4c9007
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
shr eax, 8
mov byte [ecx], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0xc], 2
jle 0x4c9018
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov byte [ecx], al
inc dword [ebp - 0x14]
dec edx
inc ebx
test edx, edx
jg 0x4c8fa0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca0e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4ca14b
xor esi, esi
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 8
jl 0x4ca10c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c96bc
mov ecx, 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.004cc104
add dword [ebp - 0xc], 8
add dword [ebp + 0xc], 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x4ca0ff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ca154
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4ca1c5
lea eax, [ebp - 0x14]
mov ecx, 8
mov edx, dword [ebp - 0xc]
call fcn.004cc104
mov eax, dword [ebp - 4]
add eax, 0x80
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004c96bc
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp - 8]
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 8
jl 0x4ca197
lea edx, [ebp - 0x14]
mov ecx, 8
mov eax, dword [ebp - 8]
call fcn.004cc104
add dword [ebp - 0xc], 8
add dword [ebp + 0xc], 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x4ca16a
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4cbdd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4cbe37
xor esi, esi
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 8
jl 0x4cbdf8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004ca308
mov ecx, 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.004cc104
add dword [ebp - 0xc], 8
add dword [ebp + 0xc], 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x4cbdeb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4cbe40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4cbeb1
lea eax, [ebp - 0x14]
mov ecx, 8
mov edx, dword [ebp - 0xc]
call fcn.004cc104
mov eax, dword [ebp - 4]
add eax, 0x180
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004ca308
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp - 8]
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 8
jl 0x4cbe83
lea edx, [ebp - 0x14]
mov ecx, 8
mov eax, dword [ebp - 8]
call fcn.004cc104
add dword [ebp - 0xc], 8
add dword [ebp + 0xc], 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x4cbe56
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cc1e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
xor eax, eax
mov dword [esp], eax
mov esi, ebp
cmp dword [0x4dfb94], 0
jne 0x4cc215
push 0x5134b4
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x5134c1
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4dfb94], eax
cmp dword [0x4dfb94], 0
je 0x4cc228
push edi
push ebp
call dword [0x4dfb94]
jmp 0x4cc25f
xor ebx, ebx
mov eax, esi
mov esi, eax
cmp edi, ebx
jle 0x4cc25f
call fcn.004cd808
lea edx, [ebx + 1]
mov ecx, edx
xor edx, edx
div ecx
mov dword [esp], eax
mov eax, esp
mov edx, ebx
and edx, 0x80000003
jns 0x4cc254
dec edx
or edx, 0xfffffffc
inc edx
mov al, byte [eax + edx]
inc ebx
mov byte [esi], al
inc esi
cmp edi, ebx
jg 0x4cc232
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4cecc8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
lea edi, [ebp - 0x9c]
mov ecx, 0x1e
mov esi, 0x4e3cd4
rep movsd dword es:[edi], dword [esi]
xor eax, eax
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov byte [ebx], 0
lea eax, [ebp - 0x9c]
push eax
push 0x78
call sub.kernel32.dll_GetLogicalDriveStringsA
mov eax, dword [ebp - 0xc]
xor esi, esi
lea edx, [ebx + eax]
lea ebx, [ebp - 0x9c]
mov dword [ebp - 0x24], edx
jmp 0x4cedfa
mov eax, esi
shl eax, 2
lea edx, [ebp - 0x9c]
add eax, edx
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4ced51
cmp eax, 5
jne 0x4cedf6
mov al, byte [ebx]
call fcn.004cc78c
mov byte [ebx], al
lea edx, [ebp - 8]
mov al, byte [ebx]
call fcn.004ceb68
test eax, eax
jne 0x4cedf6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004cebf8
test eax, eax
je 0x4ced86
mov edx, dword [ebp - 8]
push edx
call sub.kernel32.dll_CloseHandle
jmp 0x4cedf6
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
push ecx
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004cee20
test eax, eax
je 0x4ceda7
mov eax, 1
jmp 0x4cee14
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
test edx, edx
je 0x4cedf6
mov ecx, dword [ebp - 8]
push ecx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
push eax
push edx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004cec70
test eax, eax
je 0x4cee03
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
jne 0x4cedf6
mov eax, dword [ebp - 0x24]
mov dl, byte [ebx]
mov byte [eax], dl
mov ecx, dword [ebp - 0x24]
mov byte [ecx + 1], 0
inc dword [ebp - 0xc]
inc dword [ebp - 0x24]
inc esi
add ebx, 4
cmp byte [ebx], 0
jne 0x4ced30
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
call fcn.004cbf38
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d0844
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, dword [ebx + 0x18]
mov ebp, dword [ebx + 0x1c]
lea eax, [esp + 4]
mov ecx, 0xc
mov edx, edi
call fcn.004cfadc
test byte [esp + 0xf], 0x20
je 0x4d0871
mov al, 6
jmp 0x4d0a1e
test byte [esp + 0xf], 1
je 0x4d08cf
mov si, 1
xor edx, edx
mov byte [edi + 0xb], 0
mov dword [ebx + 0x1c], edx
push esi
lea edx, [esp + 8]
mov ecx, ebp
mov eax, edi
call fcn.004d054c
mov eax, ebx
call fcn.004d062c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4d08aa
inc esi
cmp si, 0x64
jb 0x4d0885
cmp si, 0x64
jne 0x4d08b7
mov al, 7
jmp 0x4d0a1e
cmp byte [esp], 4
je 0x4d08c5
mov al, byte [esp]
jmp 0x4d0a1e
mov dl, byte [esp + 0xf]
mov byte [edi + 0xb], dl
mov dword [ebx + 0x1c], ebp
test byte [esp + 0xf], 2
je 0x4d08f8
xor edi, edi
mov eax, ebp
jmp 0x4d08e0
inc edi
add eax, 2
cmp word [eax], 0
jne 0x4d08dc
movzx eax, di
add eax, 0x19
mov ecx, 0xd
cdq
idiv ecx
mov edi, eax
jmp 0x4d08fc
mov di, 1
xor edx, edx
mov eax, ebx
call fcn.004d0130
mov byte [esp], al
cmp byte [esp], 0
je 0x4d0916
mov al, byte [esp]
jmp 0x4d0a1e
xor ebp, ebp
mov esi, ebp
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx]
call fcn.004cfb84
mov byte [esp], al
cmp byte [esp], 0
jne 0x4d0962
mov ecx, dword [ebx + 0x14]
mov al, byte [ecx]
cmp al, 0xe5
je 0x4d093a
test al, al
jne 0x4d094b
test si, si
jne 0x4d0943
mov bp, word [ebx + 6]
inc esi
cmp di, si
je 0x4d0962
jmp 0x4d094d
xor esi, esi
mov edx, 1
mov eax, ebx
call fcn.004d0234
mov byte [esp], al
cmp byte [esp], 0
je 0x4d091a
cmp byte [esp], 0
jne 0x4d09d0
cmp di, 1
jbe 0x4d09d0
mov edx, ebp
mov eax, ebx
call fcn.004d0130
mov byte [esp], al
cmp byte [esp], 0
jne 0x4d09d0
mov eax, dword [ebx + 0x18]
call fcn.004d060c
mov byte [esp + 1], al
dec edi
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx]
call fcn.004cfb84
mov byte [esp], al
cmp byte [esp], 0
jne 0x4d09d0
mov dl, byte [esp + 1]
push edx
mov ecx, edi
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
call fcn.004d04cc
mov ecx, dword [ebx]
xor edx, edx
mov eax, ebx
mov byte [ecx + 4], 1
call fcn.004d0234
mov byte [esp], al
cmp byte [esp], 0
jne 0x4d09d0
dec edi
test di, di
jne 0x4d098d
cmp byte [esp], 0
jne 0x4d0a1b
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx]
call fcn.004cfb84
mov byte [esp], al
cmp byte [esp], 0
jne 0x4d0a1b
mov esi, dword [ebx + 0x14]
mov ecx, 0x20
xor edx, edx
mov eax, esi
call fcn.004cfb08
mov ecx, 0xb
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.004cfadc
mov eax, dword [ebx + 0x18]
mov dl, byte [eax + 0xb]
and dl, 0x18
mov byte [esi + 0xc], dl
mov ecx, dword [ebx]
mov byte [ecx + 4], 1
mov al, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d5bcc
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x44
call fcn.00402dd4
mov dword [esp + 0x30], 1
mov word [esp + 0x34], 5
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d5c3e
push 0xffffffffffffffff
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_WaitForSingleObject
push esp
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp + 0x48]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
add esp, 0x58
pop ebx
ret
Function at 0x6af815a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], ebx
mov ebx, 0xffffffff
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6af8a018], 8
jne 0x6af81620
test ebx, ebx
jne 0x6af81603
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
xor edx, edx
mov eax, dword fs:[0x18]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock dec dword [section..bss]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
lea eax, [ebx + 1]
mov ecx, 0x6af8c074
mov dword [esp + 0x14], eax
mov eax, str.IDxDiagContainerImpl_Release
mov dword [esp + 8], eax
mov eax, 0x6af8a018
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6af815cf
Function at 0x6af81bf0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
test byte [0x6af8a018], 8
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
jne 0x6af81c80
xor ecx, ecx
mov edx, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x6af81d4f
mov dword [eax], sym._IDxDiagContainerImpl_QueryInterface_12
mov dword [eax + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], esi
mov dword [edi + 8], eax
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 4]
mov eax, dword [ebp + 0x14]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._IDxDiagContainerImpl_QueryInterface_12
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x6af81d48
mov eax, ebx
shr eax, 0x10
je 0x6af81d30
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], 0x6af8c028
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov dword [esp + 0x10], eax
mov edx, dword [ebp + 0x14]
mov eax, str.DXDiag_CreateDXDiagContainer
mov dword [esp + 8], eax
mov edi, str.__s___p__n
mov eax, 0x6af8a018
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp + 0x14], edx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6af81c08
mov dword [esp], 0x6af8c017
movzx eax, bx
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
jmp 0x6af81cf5
mov eax, section..rdata
jmp 0x6af81cf5
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 0x8007000e
jmp 0x6af81c70