joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ea34
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x54eace
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x54ea53
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x54eae4
dec edx
je 0x54eb19
jmp 0x54eb6a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x54eb6a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x54fa74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x54fa95
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x54fa82
pop edi
pop esi
pop ebx
ret
Function at 0x55d564
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55d784
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a1], 1
xor eax, eax
push ebp
push 0x55d75a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41c]
call fcn.0046d8bc
mov eax, dword [ebp - 4]
call fcn.0055d790
movzx eax, byte [ebx + 0x18]
mov ecx, 1
xor edx, edx
call fcn.00487d2c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
call fcn.0055b208
movzx edx, byte [ebx + 0x35]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x404]
mov ecx, dword [eax]
call dword [ecx + 0xdc]
movzx edx, byte [ebx + 0x36]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
mov eax, dword [eax + 0x198]
call fcn.00434d6c
mov edx, eax
mov eax, ebx
call fcn.005047c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x198]
call fcn.00434d6c
mov edx, eax
mov eax, ebx
call fcn.005048a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x49c]
call fcn.00434d6c
mov edx, eax
mov eax, ebx
call fcn.005048a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x444]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x488]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0055df70
mov eax, dword [ebx + 0x1c]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x458]
call fcn.00526aa4
mov edx, dword [ebx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
call fcn.00526aa4
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebx + 0x30]
setne dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov edx, dword [ebx + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
call fcn.00526aa4
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x28]
call fcn.00493a8c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
call fcn.0046d8bc
mov edx, dword [ebx + 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
mov edx, dword [eax + 0x25c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
call fcn.0046da2c
mov eax, dword [0x5d898c]
mov eax, dword [eax]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x438]
call fcn.0046da2c
mov eax, dword [ebp - 4]
call fcn.0055d30c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d761
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a1], 0
ret
Function at 0x5720c8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call fcn.00407d48
test eax, eax
jne 0x572107
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x572107
cmp dword [eax + 0x3c], 0
je 0x572107
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call fcn.00407d48
test eax, eax
jne 0x572105
cmp dword [esi], 0x4550
je 0x572107
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x57210c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call fcn.00407d48
test eax, eax
jne 0x57214b
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x57214b
cmp dword [eax + 0x3c], 0
je 0x57214b
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0x108
push esi
call fcn.00407d48
test eax, eax
jne 0x572149
cmp dword [esi], 0x4550
je 0x57214b
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x59d874
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5dfd9c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x59d896
shr eax, 1
xor eax, 0xedb88320
jmp 0x59d898
shr eax, 1
dec edx
jne 0x59d884
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x59d87d
mov byte [0x5e019c], 1
pop esi
pop ebx
ret

Function at 0x59d8b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5e019c], 0
jne 0x59d8cb
call fcn.0059d874
mov eax, edi
dec eax
test eax, eax
jl 0x59d8f3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5dfd9c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x59d8d5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5a0230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5a02ca.0
jmp dword [ecx*4 + 0x5a0263]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5a0295
sub dl, 8
je 0x5a02a4
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x59fedc
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x59ff34
jmp case.0x5a02ca.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5a02ca.0
movzx ecx, byte [ecx + 0x5a02d1]
jmp dword [ecx*4 + 0x5a02e2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x59ffe0
jmp case.0x5a02ca.0
cmp dl, 3
jne 0x5a030f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a0034
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x59fff0
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a0078
jmp case.0x5a02ca.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5a033a
sub dl, 8
je 0x5a0346
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a00a4
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a0110
jmp case.0x5a02ca.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5a0365
sub dl, 8
je 0x5a0371
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a01cc
jmp case.0x5a02ca.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a01f4
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x5a0415
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0059f3e8
test eax, eax
je 0x5a0415
mov eax, ebx
call fcn.005a0420
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5a03ae
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5a0420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5a0451
dec al
je 0x5a048c
dec al
je 0x5a04d1
dec al
je 0x5a053a
jmp 0x5a05c4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5a05c4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5a0461
jmp 0x5a05c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5a05c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5a049c
jmp 0x5a05c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5a05c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5a0500
xor ebp, ebp
jmp 0x5a0510
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5a0519
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5a04e1
jmp 0x5a05c4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5a05c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5a0593
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0059d8fc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5a054e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000b422
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000b431
pop dword [ebp - 0x4c]
mov eax, 0xd79cecf0
sub eax, 0xc79c38bf
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x38278
push 0
mov eax, 0x2a24e8ea
add eax, 0xe5dbd826
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5635100a
sub ecx, 0x5634c434
mov esi, eax
mov edx, 0x93be79aa
add edx, 0x7c434c56
add edx, dword [ebp - 0x4c]
mov edi, 0xe880551e
sub dword [ebp - 4], 0xfe8593b5
mov ebx, dword [edx]
xor dword [ebp - 0x48], edi
xor ebx, edi
xor dword [ebp - 0x14], 0xccc5381e
mov dword [esi], ebx
mov dword [ebp - 0x44], 0x4f7d21c4
add esi, 4
add edx, 0x1424eb0b
add edx, 0xebdb14f9
loop 0x1000b48a
add eax, 0x6ad45271
sub eax, 0x6ad33046
mov ebx, eax
add eax, 0x6511ede9
add eax, 0x9aee121c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40bc43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40bc52
pop dword [ebp - 0x34]
mov eax, 0x40bc52
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x355a5
push 0
mov eax, 0x7c0da509
sub eax, 0x7bccc431
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x378b
mov ebx, eax
mov edx, 0x413bc4
add edx, dword [ebp - 0x34]
mov edi, 0x4fed8450
add edi, 0xa16b26d3
sub dword [ebp - 8], edx
mov esi, dword [edx]
add dword [ebp - 0x14], ebx
xor esi, edi
add dword [ebp - 0x18], edi
mov dword [ebx], esi
sub dword [ebp - 0x1c], edi
add ebx, 0x34d698e4
add ebx, 0xcb296720
add edx, 0xee9cc60e
add edx, 0x116339f6
loop 0x40bca0
add eax, 0xd0ff
mov ebx, eax
add eax, 0x54ab884e
sub eax, 0x54ab8849
mov ecx, 0xa0deb757
add ecx, 0x5f6148a9
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x63583e10
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 0x10], ebx
dec ebx
test byte [0x6359d0f0], 8
jne 0x63583e50
test ebx, ebx
je 0x63583e80
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6359f069
mov dword [esp + 8], str.Client_Release
mov dword [esp + 4], 0x6359d0f0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test ebx, ebx
jne 0x63583e3d
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x63596360
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 0x10], ebx
dec ebx
test byte [0x6359d120], 8
jne 0x635963a0
test ebx, ebx
je 0x635963d0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__ref___lu_n
mov dword [esp + 8], str.Window_Release
mov dword [esp + 4], 0x6359d120
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
test ebx, ebx
jne 0x6359638d
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4

Function at 0x635978f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp + 8], 0x635a2644
lea esi, [ebx + 0x58]
lea eax, [ebx + 0x13c]
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.rpcrt4.dll_NdrUserMarshalFree]
mov eax, dword [ebx + 0x14c]
sub esp, 0xc
mov dword [ebx + 0x94], eax
mov dword [esp + 8], 0x635a264e
mov eax, dword [ebx + 0x148]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.rpcrt4.dll_NdrConformantArrayFree]
sub esp, 0xc
mov dword [esp + 8], 0x635a2660
mov eax, dword [ebx + 0x150]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.rpcrt4.dll_NdrInterfacePointerFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x63598f30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.user32.dll_IsWindow]
sub esp, 4
test eax, eax
je 0x63599020
mov dword [esp + 8], 0x24
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x63599027
mov dword [esp + 4], 0x635a3360
mov dword [esp], esi
call sym._find_class_data
mov dword [ebx], sym._Client_QueryInterface_12
mov dword [ebx + 4], 0x635a0e90
mov dword [ebx + 8], str.P4Xc
mov dword [ebx + 0xc], 0x635a0ea4
mov dword [ebx + 0x10], 1
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xa
test eax, eax
je 0x63599018
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x20], eax
mov edx, sym._Client_QueryInterface_12
test eax, eax
je 0x63598fe6
mov eax, dword [eax]
test eax, eax
je 0x63598fe6
mov dword [esp], ebx
call eax
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call edx
mov esi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 0x20]
jmp 0x63598fce
mov esi, 0x80004005
jmp 0x63599009
mov esi, 0x8007000e
jmp 0x63599009

Function at 0x63599030
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x6359d22c]
test eax, eax
je 0x635990e8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x63599070
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x635a3600
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6359905c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6359911d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6359d22c], eax
sub esp, 8
test eax, eax
jne 0x6359904d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6359905e