joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001401f
pop dword [ebp - 0xc]
mov eax, 0x23a2b860
add eax, 0xec5e87bf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x996ea758
sub dword [ebp - 0x1c], 0x4b1c620d
mov dword [ebp - 0x18], 0x363a8128
add dword [ebp - 0x18], 0xfbf8cb1d
mov dword [ebp - 0x14], 0x6b772b26
add dword [ebp - 0x14], 0xe0d51908
mov dword [ebp - 0x10], 0xba162fd0
add dword [ebp - 0x10], 0x45e9d030
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x56219cc0
add dword [ebp - 0x1c], 0x1e50cc96
mov dword [ebp - 0x18], 0xa2121697
sub dword [ebp - 0x18], 0x60a5b522
mov dword [ebp - 0x14], 0x53d9d58d
sub dword [ebp - 0x14], 0xf06a6921
mov dword [ebp - 0x10], 0x561c4e4
add dword [ebp - 0x10], 0xfa9e3b1c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xade59f2f
sub eax, 0x9de19eff
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x462be
push 0
call eax
mov ecx, 0x5824c0a5
add ecx, 0xa7db8673
mov esi, eax
mov edi, 0xfd6d6ffc
add edi, 0x1297fe04
add edi, dword [ebp - 0xc]
mov ebx, 0x6c605267
mov dword [ebp - 8], 0xc6ff115f
mov edx, dword [edi]
add dword [ebp - 4], 0xdc1270c4
xor edx, ebx
xor dword [ebp - 4], 0xbaa24dd0
mov dword [esi], edx
xor dword [ebp - 8], ebx
add esi, 0xf4dc9947
sub esi, 0xf4dc9943
add edi, 4
loop 0x10014136
add eax, 0x10f33
mov ebx, eax
add eax, 0xce5fe604
add eax, 0x31a01a01
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10014010
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call fcn.10014010
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10014010
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x446150
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x446107
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x446125
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x446183
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
jge 0x446162
jge 0x446162
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x44616a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x446173
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x44617d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44615f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4460e9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4461d0
dec eax
je 0x4461c7
sub eax, 3
je 0x4461be
mov dword [ebp - 4], 0x40
jmp 0x4461ed
mov dword [ebp - 4], 4
jmp 0x4461d3
mov dword [ebp - 4], 0x20
jmp 0x4461d3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x44621f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x44619f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00445a30
popal
or ecx, dword [eax + 0xa]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x44622b
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push es
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00445a40
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004459f5
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00445a30
jge 0x4469ec
je 0x446a42
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00445a30
pushfd
pop ebp
test eax, 0xe06580c0
add byte [eax - 0x39ff1e9b], al
inc ebp
loop 0x446a73
ljmp 0xa95d:0x9cffffef
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00445a40
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
inc ebp
ljmp 0xc6b2
Function at 0x4572f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7cc6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d1088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0047a4e7
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045efda
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45cf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp + 8]
cmp eax, edx
ja 0x45cf32
mov dword [ecx + 0x10], eax
cmp dword [ecx + 0x14], 8
jb 0x45cf28
mov ecx, dword [ecx]
xor edx, edx
mov word [ecx + eax*2], dx
pop ebp
ret 8
sub eax, edx
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004479e0
Function at 0x40d3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40d3ff
pop dword [ebp - 0x48]
mov eax, 0x40d3ff
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xee1a09b7
add dword [ebp - 0x58], 0x60383b94
mov dword [ebp - 0x54], 0xc7d15210
sub dword [ebp - 0x54], 0x959e05cb
mov dword [ebp - 0x50], 0x3ccfdfa8
add dword [ebp - 0x50], 0xf7c6486
mov dword [ebp - 0x4c], 0xfa642f6e
sub dword [ebp - 0x4c], 0xfa642f6e
lea eax, [ebp - 0x58]
push eax
mov eax, 0x2151dd5f
add eax, 0xdeef9339
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa7da9870
add dword [ebp - 0x58], 0xcc97d0e6
mov dword [ebp - 0x54], 0xac9f542b
sub dword [ebp - 0x54], 0x6b32f2b6
mov dword [ebp - 0x50], 0x5d07f82e
add dword [ebp - 0x50], 0x667743e
mov dword [ebp - 0x4c], 0x18b1c583
add dword [ebp - 0x4c], 0xe74e3a7d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x15addfdb
add eax, 0xea939099
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b017
push 0
call eax
mov ecx, 0x44d77400
sub ecx, 0x44d72d62
xor esi, esi
add esi, eax
mov edi, 0xf90e3b43
sub edi, 0xf8cb8343
add edi, dword [ebp - 0x48]
mov edx, 0x327d4ce7
sub edx, 0x1d3c7831
sub dword [ebp - 0x34], 0x8046a858
mov ebx, dword [edi]
xor dword [ebp - 8], 0x86b605be
sub ebx, edx
add dword [ebp - 0x38], 0x19d1f48c
mov dword [esi], ebx
mov dword [ebp - 0x10], 0x266407a9
add esi, 0xcde59558
add esi, 0x321a6aac
add edi, 0x175e2277
add edi, 0xe8a1dd8d
loop 0x40d51e
add eax, 0x1ffb7ceb
sub eax, 0x1ffa6fa0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfb27cd8f
add ecx, 0x5183271
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x10011be
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1002018]
push 0x104
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x174], ecx
push 1
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ecx
push eax
call fcn.01001149
cmp eax, 1
jl 0x100129e
push ebx
xor ebx, ebx
cmp byte [ebp - 0x160], bl
push esi
lea esi, [ebp - 0x160]
je 0x1001238
cmp byte [esi], 0x3a
je 0x100121b
inc esi
cmp byte [esi], bl
jne 0x100120f
jmp 0x100121e
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x1001238
push 0x10010ac
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100123e
lea esi, [ebp - 0x160]
push 0x29
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100129c
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x100129c
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x100129c
push ebx
lea eax, [ebp - 0x170]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001324
leave
ret 0x10
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10003ece
pop dword [ebp - 0x38]
mov eax, 0x8e590cd8
add eax, 0x81a731f6
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x7e2fe9e7
sub dword [ebp - 0x48], 0x2fdda49c
mov dword [ebp - 0x44], 0xa4c9900c
add dword [ebp - 0x44], 0x8d69bc39
mov dword [ebp - 0x40], 0x5dccb13f
add dword [ebp - 0x40], 0xee7f92ef
mov dword [ebp - 0x3c], 0x1e809420
sub dword [ebp - 0x3c], 0x1e809420
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd6f48386
sub dword [ebp - 0x48], 0x62821a30
mov dword [ebp - 0x44], 0x48740ef9
sub dword [ebp - 0x44], 0x707ad84
mov dword [ebp - 0x40], 0xeba3be11
add dword [ebp - 0x40], 0x77cbae5b
mov dword [ebp - 0x3c], 0x64b92c1e
sub dword [ebp - 0x3c], 0x64b92c1e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xe8a09a41
add eax, 0x275fb5ff
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3427a
push 0
call eax
mov ecx, 0x3e16
xor edi, edi
add edi, eax
mov edx, 0x1938f9cb
sub edx, 0x93843cb
add edx, dword [ebp - 0x38]
mov esi, 0x3453a282
add esi, 0xb0bd2856
mov dword [ebp - 0x14], 0x99eb3ee5
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0x1a601eb3
xor ebx, esi
sub dword [ebp - 0x10], 0xdb873bb8
mov dword [edi], ebx
sub dword [ebp - 0x30], ebx
add edi, 0x99568fdd
sub edi, 0x99568fd9
add edx, 0x53d6f9b4
add edx, 0xac290650
loop 0x10003fe7
add eax, 0x6298d2c8
sub eax, 0x6297e79d
mov ebx, eax
add eax, 0x256a8518
sub eax, 0x256a8513
mov ecx, 0xd7b363d1
add ecx, 0x384c9c2f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40c1a4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4122e4], 0
jne 0x40c225
cmp dword [0x412304], 0
jne 0x40c1d4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x412304], eax
test eax, eax
jne 0x40c1d4
push str.GetEnvironmentStrings_failed
call fcn.0040b214
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x412304]
jmp 0x40c1e8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c1e0
lea edi, [ebp + 1]
push edi
call fcn.00404260
pop ecx
mov ebx, eax
mov dword [0x4122e8], ebx
test ebx, ebx
jne 0x40c212
xor eax, eax
jmp 0x40c2e8
push edi
mov edx, dword [0x412304]
push edx
push ebx
call fcn.00404fdc
add esp, 0xc
jmp 0x40c245
xor esi, esi
mov ebx, dword [0x4122e4]
jmp 0x40c23f
push eax
call fcn.0040512c
pop ecx
test eax, eax
jne 0x40c23b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c22f
lea ebx, [esi + 4]
push 4
mov dword [0x4122ec], ebx
inc ebx
push ebx
call fcn.00404060
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40c268
xor eax, eax
jmp 0x40c2e8
cmp dword [0x4122e4], 0
jne 0x40c299
xor esi, esi
mov ebx, dword [0x4122e8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40c28a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c280
jmp 0x40c2ca
xor esi, esi
mov ebx, dword [0x4122e4]
mov eax, dword [esp]
mov edi, eax
jmp 0x40c2c4
push eax
call fcn.0040512c
pop ecx
test eax, eax
je 0x40c2b9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c2bd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c2a8
mov eax, dword [0x4122e4]
test eax, eax
je 0x40c2da
push eax
call fcn.00404270
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4122e4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
salc
inc edi
adc ebp, dword [ebx - 0x7a]
xchg edi, eax
in al, dx
or edi, 0xffffff9e
jge 0x4153ee
test esi, esi
invalid
test bh, 0x75
lodsb al, byte es:[esi]
adc dword [ebp + 0x31], edi
cmpsb byte [esi], byte es:[edi]
inc ebp
pop es
jae 0x415403
xor dword [esi + 0x8730745], esp
push edx
cmp cl, dh
push esi
out 0x83, al
je 0x4153f5
or eax, 0xed4ecec8
invalid
Function at 0x10001430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001488
cmp byte [esi + ebx - 1], 0xa
je 0x1000145c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10006084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10001ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10001c88
mov edi, dword [0x10006084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10001b97
test byte [0x10002030], 8
jne 0x10001c30
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10002040], 8
jne 0x10001bf0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001b39
cmp esi, 3
jbe 0x10001ba8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x10001b4a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100040c4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001b39
mov dword [esp], 0x10002040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10001b10
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10001b10
mov dword [esp], 0x10002030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10001afb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10001b03
mov eax, 0xffffffff
jmp 0x10001b97