joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb3c4
Capabilities:
Encode data using xor

Disassembly:
sar dword [edi - 0x48bea190], 1
xchg ecx, eax
inc eax
invalid
push ecx
add byte [ebp + 0x27], ah
sbb bh, byte [edi + esi*4]
pop edi
push 0x9bfba454
fisttp dword [edx + 0x5f20f644]
mul byte [eax]
pop edi
jecxz 0x4bb3b2
popfd
insd dword es:[edi], dx
or ebx, ecx
jb 0x4bb3ff
jge 0x4bb359
sub ebp, esp
push cs
insb byte es:[edi], dx
inc ebp
fadd st(1)
dec ebx
sub esi, ebx
inc edx
jbe 0x4bb3c2
jle 0x4bb3bf
mov eax, dword [ebx - 0x7edede96]
xchg ebx, eax
hlt
and ch, 0xfe
xchg edi, eax
cmp eax, 0x12082d1b
jl 0x4bb428
arpl word [ebx], di
inc edx
cmp esp, dword [ebp + 0x42]
insb byte es:[edi], dx
sub al, 0xc5
lodsb al, byte [esi]
pushal
scasb al, byte es:[edi]
dec esp
adc dl, byte [edi + 0x3d3d9e87]
out 0x42, eax
test eax, 0xa618ad37
mov al, byte [0x5f09e7c1]
movsd dword es:[edi], dword [esi]
test eax, 0x8244a659
add al, 0xf0
mov esi, 0xab42545e
sub eax, edi
mov cl, 0x10
pop edx
xor al, 0x5c
sub dword [edx], 0x4e69914
ja 0x4bb4b2
jmp 0x4bb3f2
and edx, eax
mov cl, 0x65
in eax, 0x45
arpl word [ecx - 0x2b], cx
sub eax, dword [ebp + esi - 0x547fda5c]
xor al, 0xf1
xor dword [eax - 0x5cdf08e5], edi
fucompi st(2)
xor al, 0x74
or ah, byte [eax - 0x30]
sub byte [edx + edi*2], cl
test eax, esp
mov al, byte [0x19c82637]
inc ecx
nop
or byte [edx - 0x35], dl
stosb byte es:[edi], al
mov cs, word [ecx + 0x562c517c]
inc edx
cmp edi, edx
outsd dx, dword [esi]
pop ds
jo 0x4bb548
pushal
pushfd
sar dword [edx + 0x6c56cb5f], 0x1d
inc ebp
sti
sbb dword [ecx - 0x12], 0x77fa005b
jo 0x4bb501
stosd dword es:[edi], eax
or eax, 0x5eddac61
push 0x8f96de36
cmp al, 0x4e
je 0x4bb590
test eax, 0xa9769498
cmp ebp, eax
test eax, 0xa106dd0d
xchg ebx, eax
or byte [ecx - 0x76a26be7], dl
aam 0x41
sbb dword [ebx + 0xc], edx
push edi
push ds
push ss
imul esi, dword [esi + 0x7496f09b], 0xbc267177
mul esp
or eax, 0xa4f0e062
pop esp
push ds
sub al, 0xc8
popal
test eax, ecx
popfd
mov cl, 0x5b
pop ebx
pop ebx
push edi
pushfd
cwde
salc
insb byte es:[edi], dx
pop ss
xchg esi, eax
sub al, al
xchg ah, al
or al, byte [edi + 0x41e94eff]
rcr byte [ebp + ecx*4 - 2], 0x5e
jg 0x4bb56a
jns 0x4bb52c
adc eax, 0x786a0e33
out dx, eax
pop edi
mov ebx, 0x51458dfd
int1
push edx
sub dword [ecx], esi
pop edx
in al, 0x5c
xor eax, 0xcb4a5148
mov byte [0x1e206cd3], al
ljmp 0x9969:0x3e440b96
cdq
pop edi
hlt
nop
mov dl, 0xf8
je 0x4bb587
out dx, al
mov al, byte [0xd84041ff]
sbb eax, 0x844bb650
imul ebx, ebp, 0x173d5c15
test eax, 0x886dc5cd
fidiv word [eax]
jae 0x4bb5ed
pop edx
push esp
sal ah, 1
xchg edx, eax
scasb al, byte es:[edi]
scasb al, byte es:[edi]
push ebp
dec ecx
movsd dword es:[edi], dword [esi]
loopne 0x4bb581
dec edx
add dword [ebp + 0x657a04cf], esi
invalid
ret
Function at 0x4bf53e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c72f0
cmp edx, dword [eax]
je 0x4bf560
add eax, 8
inc ecx
cmp eax, 0x4c7380
jl 0x4bf551
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c72f0]
jne 0x4bf68e
mov eax, dword [0x4cb9dc]
cmp eax, 1
je 0x4bf668
test eax, eax
jne 0x4bf591
cmp dword [0x4c7234], 1
je 0x4bf668
cmp edx, 0xfc
je 0x4bf68e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf5c8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bfc50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bfe80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bf60b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bfe80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c3b70
push edi
call fcn.004c1650
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bfc50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bfc60
lea eax, [ebp - 0xa0]
push 0x4c3b50
push eax
call fcn.004bfc60
push dword [esi + 0x4c72f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bfc60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c15c4
add esp, 0x2c
pop edi
jmp 0x4bf68e
lea eax, [ebp + 8]
lea esi, [esi + 0x4c72f4]
push 0
push eax
push dword [esi]
call fcn.004bfe80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x368c182f
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x56fa6ad8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10008800
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test byte [0x100131c0], 8
jne 0x10008940
cmp ebx, 5
je 0x100088f0
jbe 0x10008860
cmp ebx, 0x64
ja 0x10008865
cmp ebx, 0x52
ja 0x100088d0
cmp ebx, 0x1a
jbe 0x10008880
cmp ebx, 0x23
jne 0x10008865
mov dword [ebp + 0x10], esi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._schan_QueryContextAttributesW_12
cmp ebx, 4
je 0x10008842
mov edi, 0x80090302
test byte [0x100131c0], 1
jne 0x10008893
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp ebx, 0x18
ja 0x10008842
mov edi, 0x80090302
test byte [0x100131c0], 1
je 0x10008873
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Unhandled_attribute__lx_n
mov dword [esp + 8], str.schan_QueryContextAttributesA
mov dword [esp + 4], 0x100131c0
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_2
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea ecx, [ebx - 0x53]
mov eax, 1
shl eax, cl
test eax, 0x20081
je 0x10008865
jmp 0x10008842
mov dword [esp], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 5
call sym._schan_QueryContextAttributesW_12
sub esp, 0xc
mov edi, eax
test eax, eax
jne 0x10008873
mov eax, dword [esi + 0xc]
xor edx, edx
call sym._get_alg_name
xor edx, edx
mov dword [esi], eax
mov eax, dword [esi + 0x10]
call sym._get_alg_name
mov dword [esi + 4], eax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.context_handle__p__attribute__lx__buffer__p_n
mov dword [esp + 8], str.schan_QueryContextAttributesA
mov dword [esp + 4], 0x100131c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x1000881f
Function at 0x1000a840
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
sub esp, 0xc
leave
ret 4
Function at 0x1000d210
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x244
mov ebx, dword [ebp + 8]
test byte [0x10013318], 8
je 0x1000d26d
cmp ebx, 0xe
ja 0x1000d2a8
mov eax, dword [ebx*4 + 0x100172e0]
test eax, eax
je 0x1000d2a8
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__p__p__n
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 8], str.GetUserNameExW
mov dword [esp + 4], 0x10013318
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
cmp ebx, 0xc
ja case.0x1000d272.4
jmp dword [ebx*4 + 0x100170d0]
test byte [0x10013318], 1
jne 0x1000d3a0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x534
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc
mov eax, ebx
call sym._debugstr_NameFormat.part.0
jmp 0x1000d237
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret 0xc
lea esi, [ebp - 0x230]
lea ebx, [ebp - 0x22a]
mov dword [ebp - 0x230], 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x1000d29a
cmp word [ebp - 0x22a], 0
mov eax, ebx
je 0x1000d319
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x1000d310
mov ecx, 0x5c
add eax, 2
mov dword [ebp - 0x230], 0x101
mov word [eax - 2], cx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetUserNameW]
sub esp, 8
test eax, eax
je 0x1000d29a
mov eax, dword [ebp + 0x10]
cmp word [ebp - 0x22a], 0
mov edx, dword [eax]
je 0x1000d40c
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000d360
sub eax, ebx
sar eax, 1
cmp eax, edx
jb 0x1000d3d0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xea
mov eax, ebx
add eax, 2
cmp word [eax], 0
jne 0x1000d380
sub eax, ebx
sar eax, 1
add eax, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
xor eax, eax
jmp 0x1000d29c
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.NameFormat__d_not_implemented_n
mov dword [esp + 8], str.GetUserNameExW
mov dword [esp + 4], 0x10013318
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000d28d
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x1000d3d8
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000d3f0
sub eax, ebx
sar eax, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, 1
jmp 0x1000d29c
test edx, edx
jne 0x1000d427
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xea
mov eax, 1
jmp 0x1000d390
mov eax, dword [ebp + 0xc]
xor edx, edx
mov word [eax], dx
xor eax, eax
jmp 0x1000d3fd
Function at 0x1000d910
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x24
test eax, eax
je 0x1000d9d5
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov ebx, eax
mov dword [esp + 0x18], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x20
mov edi, eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x1000d9d5
mov dword [esp + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x20
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x1000d9e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x1c
test eax, eax
je 0x1000da88
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x1000da88
mov dword [esp + 0x14], edi
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x18
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000daa0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
test eax, eax
je 0x1000dc68
mov esi, eax
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1000dc40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
mov edi, eax
lea ebx, [eax + 0x14]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1000db54
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
add ebx, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x1000dc68
lea edx, [eax + 0x14]
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x1000dbec
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x10]
sub esp, 0x20
add edx, edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1000dc50
mov dword [ebx + 0x10], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov eax, ebx
sub esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
mov ebx, 0x14
jmp 0x1000db07
mov dword [ebx + 0x10], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000dc80
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
test eax, eax
je 0x1000de20
mov edi, eax
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1000ddf0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x10], eax
sub esp, 0x18
lea ebx, [eax + eax + 0x14]
mov eax, dword [edi + 0x10]
xor esi, esi
test eax, eax
je 0x1000dd1b
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov esi, eax
lea ebx, [ebx + eax*2]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x1000de20
lea ecx, [eax + 0x28]
mov eax, dword [edi]
mov edx, dword [edi + 0x10]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x10], edx
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x1000ddaa
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
sub esp, 0x18
lea ecx, [ecx + eax*2]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1000de08
mov dword [ebx + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, ebx
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ebx, 0x14
jmp 0x1000dcd9
mov dword [ebx + 0x10], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000e6e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x10013340], 8
jne 0x1000e7b0
test esi, esi
je 0x1000e828
mov eax, ebx
call sym._strdupWA
mov ebx, eax
mov eax, esi
call sym._strdupWA
mov dword [esp], ebx
mov esi, eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 4], esi
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
call sym.secur32.dll_AcquireCredentialsHandleA
sub esp, 0x24
mov edi, eax
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov edx, dword [ebp - 0x10]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_3
mov edi, eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_3
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp + 0x24]
mov dword [esp + 0xc], 0x1001746b
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 8], str.thunk_AcquireCredentialsHandleW
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 4], 0x10013340
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp], 3
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18], ecx
call sym._wine_dbg_log.constprop.0_4
jmp 0x1000e6fc
mov edi, 0x80090305
jmp 0x1000e79f
Function at 0x1000ec40
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test byte [0x10013340], 8
jne 0x1000ed20
test ebx, ebx
je 0x1000eda0
mov esi, dword [ebx + 4]
test esi, esi
je 0x1000eda0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1000eda0
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x1000edb0
mov eax, edi
call sym._strdupWA
mov edx, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x2c]
mov edi, eax
mov eax, dword [esi + 0x1c]
mov esi, dword [ebp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
mov edx, dword [ebp + 0x30]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x24]
mov dword [esp + 0x28], edx
mov edx, dword [ebp + 0x28]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
call dword [eax + 0x2c]
sub esp, 0x30
mov ebx, eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x30
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_3
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x2c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x30]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], esi
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str._p__p__s__ld__ld__ld__p__ld__p__p__p__p_n
mov dword [esp + 8], str.thunk_InitializeSecurityContextW
mov dword [esp + 4], 0x10013340
mov dword [esp], 3
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x30], edx
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x28], esi
mov esi, dword [ebp + 0x14]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], esi
call sym._wine_dbg_log.constprop.0_4
jmp 0x1000ec5c
mov ebx, 0x80090301
jmp 0x1000ed0a
mov ebx, 0x80090302
jmp 0x1000ed0a
Function at 0x1000ef40
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test byte [0x10013340], 8
jne 0x1000f030
test esi, esi
je 0x1000f0a0
mov edx, dword [esi + 4]
mov esi, dword [esi]
test edx, edx
je 0x1000f0a0
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x10], edx
test eax, eax
je 0x1000f0a0
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x1000f0b0
mov eax, ebx
call sym._strdupWA
mov ebx, eax
mov eax, edi
call sym._strdupWA
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x24]
mov edi, eax
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 8], edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
call dword [eax + 0x6c]
sub esp, 0x20
mov esi, eax
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov edx, dword [ebp - 0x10]
sub esp, 0xc
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x20
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_3
mov dword [ebp - 0x10], eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_3
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0xc], 0x100174bd
mov dword [esp + 0x20], ecx
mov dword [esp + 8], str.thunk_AddCredentialsW
mov dword [esp + 4], 0x10013340
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x1000ef5f
mov esi, 0x80090301
jmp 0x1000f022
mov esi, 0x80090302
jmp 0x1000f022