joyce8/EMBER2024-capa huggingface dataset:
Function at 0x585330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x58536d
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
nop word [eax + eax]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x5f9c00]
mov dword [eax + 0x260], edx
sub esi, 1
jne 0x585350
pop edi
mov ecx, dword [eax + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, 1
je 0x58541c
sub ecx, 1
je 0x585400
sub ecx, 1
je 0x5853d8
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x24]
mov ecx, dword [eax + 0x44]
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
inc edx
mov dword [eax + 0x44], edx
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
Function at 0x58f230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x58f25d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x58f25d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409483
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a4b
and dword [ebp - 0x14], 0
cmp dword [0x43d54c], 0
mov dword [ebp - 0x18], eax
jne 0x409536
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095de
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095de
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43d54c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43d550], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43d554], eax
call edi
push eax
call esi
mov dword [0x43d55c], eax
test eax, eax
je 0x409536
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43d558], eax
mov eax, dword [0x43d558]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40958f
cmp dword [0x43d55c], ecx
je 0x40958f
push eax
call esi
push dword [0x43d55c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40958f
test ebx, ebx
je 0x40958f
call edi
test eax, eax
je 0x409586
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409586
test byte [ebp - 8], 1
jne 0x40958f
or dword [ebp + 0x10], 0x200000
jmp 0x4095c2
mov eax, dword [0x43d550]
cmp eax, dword [ebp - 0x18]
je 0x4095c2
push eax
call esi
test eax, eax
je 0x4095c2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095c2
mov eax, dword [0x43d554]
cmp eax, dword [ebp - 0x18]
je 0x4095c2
push eax
call esi
test eax, eax
je 0x4095c2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43d54c]
call esi
test eax, eax
je 0x4095de
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095e0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404aec
leave
ret
Function at 0x6d60d87d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6dff2008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6dff2008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6d60d98a
jmp 0x6d60da77
jmp 0x6d60db64
jmp 0x6d60dc51
jmp 0x6d60dd3e
jmp 0x6d60de2b
jmp 0x6d60df18
jmp 0x6d60e005
jmp 0x6d60e0f2
jmp 0x6d60e1df
jmp 0x6d60e2cc
jmp 0x6d60e3b9
jmp 0x6d60e4a6
jmp 0x6d60e593
mov dword [ebp - 0x14], 0
jmp 0x6d60e687
jmp 0x6d60e774
jmp 0x6d60e861
jmp 0x6d60e94e
jmp 0x6d60ea3b
jmp 0x6d60eb28
jmp 0x6d60ec15
jmp 0x6d60ed02
jmp 0x6d60edef
jmp 0x6d60eedc
jmp 0x6d60efc9
jmp 0x6d60f0b6
jmp 0x6d60f1a3
jmp 0x6d60f290
mov dword [ebp - 0x18], 0
jmp 0x6d60f384
jmp 0x6d60f471
jmp 0x6d60f55e
jmp 0x6d60f64b
jmp 0x6d60f738
jmp 0x6d60f825
jmp 0x6d60f912
jmp 0x6d60f9ff
jmp 0x6d60faec
jmp 0x6d60fbd9
jmp 0x6d60fcc6
jmp 0x6d60fdb3
jmp 0x6d60fea0
jmp 0x6d60ff8d
mov dword [ebp - 0x10], 0
jmp 0x6d610081
jmp 0x6d61016e
jmp 0x6d61025b
jmp 0x6d610348
jmp 0x6d610435
jmp 0x6d610522
jmp 0x6d61060f
jmp 0x6d6106fc
jmp 0x6d6107e9
jmp 0x6d6108d6
jmp 0x6d6109c3
jmp 0x6d610ab0
jmp 0x6d610b9d
jmp 0x6d610c8a
mov dword [ebp - 0x10], 0
jmp 0x6d614daa
jmp 0x6d610d83
jmp 0x6d610e70
jmp 0x6d610f5d
jmp 0x6d61104a
jmp 0x6d611137
jmp 0x6d611224
jmp 0x6d611311
jmp 0x6d6113fe
jmp 0x6d6114eb
jmp 0x6d6115d8
jmp 0x6d6116c5
jmp 0x6d6117b2
jmp 0x6d61189f
jmp 0x6d61198c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6dff2004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6d611a8a
jmp 0x6d611b77
jmp 0x6d611c64
jmp 0x6d611d51
jmp 0x6d611e3e
jmp 0x6d611f2b
jmp 0x6d612018
jmp 0x6d612105
jmp 0x6d6121f2
jmp 0x6d6122df
jmp 0x6d6123cc
jmp 0x6d6124b9
jmp 0x6d6125a6
jmp 0x6d612693
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6dff200c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6d612791
jmp 0x6d61287e
jmp 0x6d61296b
jmp 0x6d612a58
jmp 0x6d612b45
jmp 0x6d612c32
jmp 0x6d612d1f
jmp 0x6d612e0c
jmp 0x6d612ef9
jmp 0x6d612fe6
jmp 0x6d6130d3
jmp 0x6d6131c0
jmp 0x6d6132ad
jmp 0x6d61339a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x6d6134a3
jmp 0x6d613590
jmp 0x6d61367d
jmp 0x6d61376a
jmp 0x6d613857
jmp 0x6d613944
jmp 0x6d613a31
jmp 0x6d613b1e
jmp 0x6d613c0b
jmp 0x6d613cf8
jmp 0x6d613de5
jmp 0x6d613ed2
jmp 0x6d613fbf
jmp 0x6d6140ac
add dword [ebp - 0xc], 0x28
jmp 0x6d61419d
jmp 0x6d61428a
jmp 0x6d614377
jmp 0x6d614464
jmp 0x6d614551
jmp 0x6d61463e
jmp 0x6d61472b
jmp 0x6d614818
jmp 0x6d614905
jmp 0x6d6149f2
jmp 0x6d614adf
jmp 0x6d614bcc
jmp 0x6d614cb9
jmp 0x6d614da6
add dword [ebp - 0x10], 1
mov eax, dword [0x6dff2008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6d610c96
nop
leave
ret
Function at 0x6d639bf0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6dff1040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6d639c50

Function at 0x6d639c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6dff2378]
test esi, esi
jle 0x6d639d3d
mov edi, dword [0x6dff237c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6d639c84
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6d639d36
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6d639c70
mov dword [esp], eax
mov esi, eax
call fcn.6d63a3f0
test eax, eax
mov edi, eax
je 0x6d639d7a
mov esi, dword [0x6dff237c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6d63a500
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6dff237c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d639d5a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6d639d2f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6d639d2f
mov eax, dword [esp + 0x20]
add ebx, dword [0x6dff237c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6d639d44
add dword [0x6dff2378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6d639c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d639bf0
mov eax, dword [0x6dff237c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d639bf0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d639bf0
lea esi, [esi]
Function at 0x6d63a060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6dff2388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6dff2380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6d63a0b5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6d63a0ae
test esi, esi
je 0x6d63a0ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d63a090
mov dword [esp], 0x6dff2388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401080
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x88]
sub esp, 0x9c
mov dword [esp + 4], eax
mov dword [esp], str.browseui.dll
call dword [0x4061dc]
sub esp, 8
test eax, eax
jne 0x4010c8
mov dword [esp], str.Native_IE_detected__not_doing_registration_n
call sym._wine_dbg_printf.constprop.0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov dword [ebp - 0x8c], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], str.browseui.dll
call dword [0x4061e0]
lea eax, [ebp - 0x80]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x7c]
mov dword [esp + 8], eax
mov eax, dword [0x4061e4]
mov dword [esp + 4], str.VarFileInfoTranslation
mov dword [esp], esi
mov dword [ebp - 0x8c], eax
call eax
sub esp, 0x10
test eax, eax
jne 0x401178
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4010ac
mov eax, dword [ebp - 0x7c]
movzx edx, word [eax + 2]
mov dword [esp + 0xc], edx
movzx eax, word [eax]
lea edx, [ebp - 0x78]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.StringFileInfo_04x_04xFileDescription
call dword [0x4061d0]
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x78]
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x84]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x8c]
call eax
sub esp, 0x10
test eax, eax
je 0x401148
mov dword [esp + 4], 0x4030e6
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsstr]
mov dword [ebp - 0x8c], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x8c]
sub esp, 0xc
test edx, edx
je 0x4010ac
test ebx, ebx
mov edx, str.RegisterIE
mov eax, str.UnregisterIE
mov dword [esp + 8], 0
cmovne eax, edx
mov dword [esp], 0
mov dword [esp + 4], eax
call sym._RegInstallA_12
sub esp, 0xc
lea esp, [ebp - 0xc]
shr eax, 0x1f
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4013a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4013fb
cmp byte [esi + ebx - 1], 0xa
je 0x4013cf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4019d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x405094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401b90
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x405094]
movzx eax, al
bt eax, esi
jae 0x401bf0
mov ecx, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401a96
test byte [0x402074], 8
jne 0x401b30
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402084], 8
jne 0x401ae0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401a65
cmp esi, 3
jbe 0x401aa0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4031c4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401a65
mov ecx, dword [0x405094]
test ecx, ecx
je 0x401bd0
mov dword [esp], 0x402084
call dword [0x405094]
test al, 8
je 0x401a3c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401a3c
mov ebx, dword [0x405094]
test ebx, ebx
je 0x401bb0
mov dword [esp], 0x402074
call dword [0x405094]
test al, 8
je 0x401a29
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401a2f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x4019f0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401b3a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401aee
mov eax, 0xffffffff
jmp 0x401a96
Function at 0x401db0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x401e20
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401e87
xor ecx, ecx
xor edx, edx
jmp 0x401e69
cmp ax, 0x5c
jne 0x401ef8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401e87
cmp ax, 9
je 0x401e75
cmp ax, 0x20
jne 0x401e50
test ecx, ecx
je 0x401ee3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401e69
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x401f18
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x401ee0
cmp ax, 0x20
je 0x401ee0
jmp 0x401e87
cmp ax, 0x22
jne 0x401e79
and edx, 1
jne 0x401e79
xor ecx, 1
jmp 0x401e5d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x401ea0
Function at 0x77296166
Capabilities:
Encode data using xor

Disassembly:
call 0x772960df
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x7729610f
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x7729612b
xor edx, 0
jmp 0x77296136
xor edx, edx
jmp 0x7729614d
jmp 0x77296159
xor eax, eax
push 0x8427d7c0
call 0x77296166
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x772961a2
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x7729617b
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x772961b9
add eax, 0
jno 0x772961be
add esi, 0
ret 0x10

Function at 0x77296f27
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x77296f49
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x772970eb
cmp edi, dword [ebp + 0x10]
jb 0x772970eb
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.77296a13
inc edi
jmp 0x77296fd2
jmp 0x77296fdf
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.77296a13
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.77296a13
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x77297033
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x77297017
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.77297061
add dword [eax], 0x39
jle 0x7729703d
sub al, 0xf5
mov ch, al
call fcn.77297076
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10