joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445270
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4452d9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00441ce0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x446ecc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x446ef8
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044ce17
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x446f09
push ebx
call fcn.0044ce11
add esp, 4
pop eax
mov dword [ebp - 4], eax
test eax, eax
je 0x446f71
mov ecx, dword [eax + 4]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x446f71
mov edx, ebx
mov esp, ecx
or bh, bl
cmp edx, 0xff
cmovbe edx, ebx
mov ebx, edx
and esp, 0xfffffffc
shl ebx, 0x10
sub ecx, esp
or bx, dx
cmp edx, 0xffff
cmovbe edx, ebx
lea ebx, [eax + 8]
test esp, esp
je 0x446f52
add esp, ebx
xor dword [ebx], edx
add ebx, 4
cmp esp, ebx
jne 0x446f49
test ecx, ecx
je 0x446f71
xor byte [ebx], dl
test ecx, 2
je 0x446f71
xor byte [ebx + 1], dh
test ecx, 1
je 0x446f71
shr edx, 0x10
xor byte [ebx + 2], dl
leave
ret 8

Function at 0x446fac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x7fff
push 1
mov ebx, 0x184
call fcn.0044d661
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x446ff8
push ebx
call fcn.0044ce11
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x7fff
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x447032
push 0x4f
push 0x402e875
push 6
call fcn.0044ce1d
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x447049
mov eax, 0
jmp 0x4470a2
push 0x80000301
push 0
push dword [ebp - 8]
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x447066
mov eax, 0x5a47aa
push eax
push 2
mov ebx, 0x134
call fcn.0044d6a1
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x447092
push ebx
call fcn.0044ce11
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, 1
jmp 0x4470a2
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4470b3
push ebx
call fcn.0044ce11
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44b83b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
inc eax
push dword [eax]
pop word [ebp - 4]
cmp dword [ebp - 4], 0xc25e
je 0x44b870
cmp dword [ebp - 4], 0xc35e
je 0x44b870
jmp 0x44b873
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44b855
cmp dword [ebp - 4], 0xc25e
jne 0x44b913
push eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [ebp - 8]
push 0xffffffff
xor eax, eax
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x44b8c6
push 0x1c8
push 0x40100a7
push 6
call fcn.0044ce1d
add esp, 0xc
pop eax
push 0x9090c35e
pop dword [eax]
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push 4
push dword [ebp - 8]
push 0xffffffff
xor eax, eax
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x44b913
push 0x261
push 0x40100a7
push 6
call fcn.0044ce1d
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x44e2d0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x46cf78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5a6758]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], 0x41
mov dword [esp + 0x2c], 0x1a
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push 0x5a5238
push edx
call fcn.00467334
mov esi, dword [esp + 0x34]
add esp, 0xc
test esi, esi
jne 0x44e348
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x44e341
jmp dword [eax*4 + 0x44e3cc]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, esi
jne case.default.0x44e341
push 3
call fcn.0044ef99
mov edi, dword [esp + 0x14]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [ebx], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
add ebx, 4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
inc ecx
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], eax
jne 0x44e30f
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004680fb
mov ecx, dword [esp + 0x18]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x459d05
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a5940]
jne 0x459d0f
repz ret
jmp fcn.004601a6
Function at 0x45abcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a5940]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00451613
and dword [ebp - 0x14], 0
cmp dword [0x5c33dc], 0
mov dword [ebp - 0x18], eax
jne 0x45ac7e
push 0x4734a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45ad26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47349c
push ebx
call edi
test eax, eax
je 0x45ad26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x47348c
push ebx
mov dword [0x5c33dc], eax
call edi
push eax
call esi
push 0x473478
push ebx
mov dword [0x5c33e0], eax
call edi
push eax
call esi
push 0x47345c
push ebx
mov dword [0x5c33e4], eax
call edi
push eax
call esi
mov dword [0x5c33ec], eax
test eax, eax
je 0x45ac7e
push 0x473444
push ebx
call edi
push eax
call esi
mov dword [0x5c33e8], eax
mov eax, dword [0x5c33e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45acd7
cmp dword [0x5c33ec], ecx
je 0x45acd7
push eax
call esi
push dword [0x5c33ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45acd7
test ebx, ebx
je 0x45acd7
call edi
test eax, eax
je 0x45acce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45acce
test byte [ebp - 8], 1
jne 0x45acd7
or dword [ebp + 0x10], 0x200000
jmp 0x45ad0a
mov eax, dword [0x5c33e0]
cmp eax, dword [ebp - 0x18]
je 0x45ad0a
push eax
call esi
test eax, eax
je 0x45ad0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45ad0a
mov eax, dword [0x5c33e4]
cmp eax, dword [ebp - 0x18]
je 0x45ad0a
push eax
call esi
test eax, eax
je 0x45ad0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5c33dc]
call esi
test eax, eax
je 0x45ad26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45ad28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459d05
leave
ret
Function at 0x4648db
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x46d304
call fcn.0046013b
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x4649d2
cmp byte [esi + 0x4a], bl
je 0x4649d2
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x464917
xor al, al
jmp 0x4649d4
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004646a1
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x464975
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x46497a
dec eax
je 0x46497e
dec eax
dec eax
je 0x4649ce
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00463c11
mov al, bl
jmp 0x4649d4
mov edx, dword [ebp - 0x2c]
jmp 0x464940
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x46498a
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x4649b0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x46499d
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.0044f65e
add esp, 0x10
cmp edi, eax
jne 0x464963
cmp byte [esi + 0x4a], 0
je 0x4649ce
test edi, edi
jne 0x464932
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004645f3
jmp 0x464932
mov bl, 1
jmp 0x464965
mov al, 1
call fcn.00460185
ret
Function at 0x4649da
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x46d2d7
call fcn.0046013b
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4649fc
xor eax, eax
jmp 0x464b6f
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x464a2a
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x464a2a
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x464b6f
cmp dword [esi + 0x54], ebx
je 0x464b6a
mov ecx, esi
call fcn.004639f5
cmp dword [esi + 0x44], ebx
jne 0x464a5a
push dword [esi + 0x54]
push edi
call fcn.00463e95
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x464b6f
jmp 0x464b6a
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004646a1
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x464b17
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x14]
xor ebx, ebx
inc ebx
test eax, eax
js 0x464b5f
cmp eax, ebx
jg 0x464b1f
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x464ac9
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x464aee
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x464adc
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push ebx
push eax
call fcn.0044f65e
add esp, 0x10
cmp edi, eax
jne 0x464b5f
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], bl
cmp dword [ebp - 0x38], eax
jne 0x464b4e
test edi, edi
jne 0x464a7b
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x464b64
push 8
call fcn.004645f3
jmp 0x464a7b
mov edx, dword [ebp - 0x2c]
jmp 0x464a8d
cmp eax, 3
jne 0x464b5f
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.00463e95
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x464b3e
mov esi, 0xffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00463c11
mov ax, si
jmp 0x464b6f
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00463c11
mov ax, word [ebp + 8]
jmp 0x464b6f
push 0
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00463c11
mov eax, 0xffff
call fcn.00460185
ret 4
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6a854d55
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x72cd3383
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403d9d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x403dd8
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x403dbf
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x403dd0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x403dda
inc edi
add eax, 0x28
cmp edi, esi
jb 0x403db5
xor eax, eax
pop edi
pop esi
ret

Function at 0x403fd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00403d5d
dec ebx
push 0x458d4634
test al, 0x50
call fcn.00403d6d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403d22
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40404b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403d5d
cmp ebp, dword [ecx - 0x2d]
sub dword [ebp - 0x17af3fbb], ecx
invalid

Function at 0x405f90
Capabilities:
Set file attributes

Disassembly:
jne 0x405f92
call fcn.0040455d
add byte [eax], 0x83
clc
push dword [esi + ecx - 0x7d]
loopne 0x405fa0
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405fb0
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40968c]
mov dword [ebp - 8], eax
mov eax, dword [0x409690]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406030
test edi, edi
jne 0x405fed
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x40602a
Function at 0x617413c0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x61743018], 8
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
jne 0x61741448
test esi, esi
je 0x617414b0
xor edx, edx
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x617414ba
test byte [0x61743018], 8
mov dword [eax], 1
jne 0x61741480
mov dword [esi], ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov ecx, str.handle__p._n
mov ebx, str.CreateInteractionContext
mov dword [esp + 0x10], esi
mov eax, 0x61743018
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x617413e4
mov dword [esp + 0x10], eax
mov edx, str.CreateInteractionContext
mov ecx, 0x61743018
mov dword [esp + 8], edx
mov eax, str.Created_context__p._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6174142c
mov eax, 0x80004003
jmp 0x61741430
mov eax, 0x8007000e
jmp 0x61741430

Function at 0x617414d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x61743018], 8
mov dword [ebp - 4], ebx
mov ebx, dword [ecx]
mov dword [ebp - 8], ecx
jne 0x61741530
test ebx, ebx
je 0x6174155d
mov dword [esp + 8], ebx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov eax, str.DestroyInteractionContext
mov ecx, str.context__p._n
mov dword [esp + 8], eax
mov eax, 0x61743018
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x617414f1
mov eax, 0x80070006
jmp 0x61741519

Function at 0x617419f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x61741a60
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x61741a58
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x61746084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x61741a1d
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x61742130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x61742308
mov edx, dword [0x61746084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x617422f8
test byte [0x61743030], 8
jne 0x617422a0
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x61743040], 8
jne 0x61742260
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x617421bb
cmp dword [ebp + 8], 3
jbe 0x61742220
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x617421ca
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x61745308]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x617421bb
mov dword [esp], 0x61743040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x61742190
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x61742190
mov dword [esp], 0x61743030
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x6174217d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x61742183
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x61742218
Function at 0x1017a210
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10193490], 0x795
mov dword [0x1019349c], 0
mov byte [0x101934a0], 0
mov dword [0x10193498], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov dword [0x10193490], 0xc9a
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10193498]
add eax, 1
mov dword [0x10193498], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1017a255
jmp 0x1017a351
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0xf92
mov esi, 0x100
mov dword [0x101934a4], 0
mov dword [0x10193494], eax
mov eax, dword [0x1019349c]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + ecx]
add ebx, eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x28], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x101934a4], ebx
mov eax, ebx
cdq
idiv esi
mov dword [0x1019349c], edx
mov dword [0x10193490], 0x1e22
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x101934a0], bl
mov dword [0x10193490], 0x112f
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x101934a0]
mov ecx, dword [0x1019349c]
mov byte [esi + ecx], bl
mov dword [0x10193490], 0xa8a
mov dword [0x10193494], 0xfffffb26
mov ecx, dword [0x10193498]
add ecx, 1
mov dword [0x10193498], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jl 0x1017a28a
jmp 0x1017a37e
mov dword [0x10193490], 0x9b7
xor eax, eax
mov dword [0x10193498], 0
mov ecx, dword [0x10193494]
add ecx, 0x146c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x1017a28a
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret