joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67542aa0
Capabilities:
Get process heap flags
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [0x67548058]
mov edi, dword [ecx]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 4], edi
mov dword [ebp - 0x24], eax
call eax
sub esp, 8
test byte [0x67548064], 8
jne 0x67542c59
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [esp], 0x67548040
lea esi, [edi + 0x14]
mov dword [ebp - 0x20], eax
call eax
lea eax, [edi + 0x1c]
mov ebx, dword [edi]
mov dword [ebp - 0x1c], eax
sub esp, 4
nop
lea esi, [esi]
test ebx, ebx
jne 0x67542b44
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 0x67548040
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SleepConditionVariableCS]
sub esp, 0xc
test eax, eax
jne 0x67542bd0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x5b4
mov ebx, dword [edi]
jne 0x67542b00
test ebx, ebx
je 0x67542be0
mov dword [esp], 0x67548040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x14]
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.__vcomp_fork_call_wrapper
mov eax, dword [ebp - 0x20]
mov dword [esp], 0x67548040
call eax
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov dword [edi], 0
sub esp, 4
mov dword [edx + 4], eax
mov edx, dword [edi + 0x14]
mov dword [eax], edx
mov eax, dword [0x67548060]
mov dword [edi + 0x14], 0x6754805c
mov dword [edi + 0x18], eax
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [0x67548060], esi
add eax, 1
mov dword [ebx + 8], eax
cmp eax, dword [ebx + 4]
jl 0x67542b04
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WakeAllConditionVariable]
sub esp, 4
jmp 0x67542b04
mov ebx, dword [edi]
jmp 0x67542b00
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov dword [esp], 0x67548040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test byte [0x67548064], 8
jne 0x67542c86
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x67548058]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0
call eax
mov eax, dword [0x6754d010]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibraryAndExitThread]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.starting_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67542adc
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.terminating_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67542c07
Function at 0x67542cc0
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov eax, dword [0x67548058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x67542d00
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 8], 0x60
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x67542d93
mov dword [eax + 0x38], 0
lea eax, [eax + 0x38]
movdqu xmm0, xmmword [0x6754a7e0]
mov dword [eax + 4], 0
mov dword [eax + 0x10], 0
mov dword [eax - 0x38], 0
mov dword [ebx + 4], eax
mov eax, dword [0x67548058]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
movups xmmword [ebx + 0x20], xmm0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test byte [0x67548064], 2
jne 0x67542da9
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_create_thread_data_n
mov dword [esp + 8], str.vcomp_init_thread_data
mov dword [esp + 4], 0x67548064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x67542d9c

Function at 0x675431b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.___divdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x675431d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x67543240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.___udivdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x67543260
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x675432d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, ebx
mov edx, esi
mov dword [esp + 8], ebx
shld edx, ebx, cl
shl eax, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne edx, eax
cmovne eax, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x675432e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67543340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
sar edx, cl
shrd eax, esi, cl
mov dword [esp + 0xc], esi
mov edi, edx
sar edi, 0x1f
test cl, 0x20
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x67543350
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x675433b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
shrd eax, esi, cl
shr edx, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x675433c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67543420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
mov ecx, eax
sub ecx, dword [esp]
sbb ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
mov ebx, ecx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x67543440
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67543570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
divsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x67543588
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x675435e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
subsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x675435f8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x67545a90
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x67548064], 8
jne 0x67545ae0
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIsCriticalSectionLockedByThread]
sub esp, 4
test eax, eax
jne 0x67545b0a
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67545aad
test byte [0x67548064], 2
jne 0x67545b20
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [ebx]
mov dword [esp + 0xc], str.omp_set_lock_called_while_holding_lock__p_n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x67548064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x67545b13

Function at 0x675460e0
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x67548064], 8
jne 0x67546130
cmp ebx, 1
je 0x67546165
cmp ebx, 3
je 0x675461f0
test ebx, ebx
mov ebx, 1
je 0x675461b8
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p___ld___p__n
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp ebx, 1
jne 0x6754610a
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x67548058], eax
cmp eax, 0xffffffff
je 0x67546210
lea eax, [ebp - 0x3c]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [0x6754d010], edi
sub esp, 4
mov dword [0x6754d00c], eax
mov dword [0x6754d008], eax
mov dword [0x6754d004], eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test esi, esi
jne 0x67546120
cmp dword [0x67548058], 0xffffffff
je 0x67546120
call sym._vcomp_free_thread_data
mov eax, dword [0x67548058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
jmp 0x67546120
call sym._vcomp_free_thread_data
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test byte [0x67548064], 2
jne 0x67546220
xor ebx, ebx
jmp 0x67546120
mov dword [esp + 0xc], str.Failed_to_allocate_TLS_index_n
xor ebx, ebx
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x67548064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x67546120
Function at 0x675462e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6754633b
cmp byte [esi + ebx - 1], 0xa
je 0x6754630f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6754d0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x67546950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x67546b18
mov edi, dword [0x6754d0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x67546a38
test byte [0x67548088], 8
jne 0x67546ac0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x67548098], 8
jne 0x67546a88
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x675469da
cmp esi, 3
jbe 0x67546a40
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x675469eb
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x6754a8a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x675469da
mov dword [esp], 0x67548098
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x675469b1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x675469b1
mov dword [esp], 0x67548088
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x6754699e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x675469a4
mov eax, 0xffffffff
jmp 0x67546a38
Function at 0x401050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x401076
pop esi
pop ebx
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x401087
pop esi
pop ebx
ret
mov edx, dword [esp + 0x18]
push edi
push 0x409030
push edx
call fcn.00401637
add esp, 8
mov edi, eax
push edi
push 1
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
call fcn.0040150d
push edi
call fcn.004014b7
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4010d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xe0
mov ecx, 8
xor eax, eax
push esi
push edi
mov esi, str.taskkill.exe__im_xiaobai.exe__f
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x2f
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
add esp, 0xe0
ret

Function at 0x401110
Capabilities:
Get common file path
Terminate process

Disassembly:
sub esp, 0x140
push esi
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
push 0x100
call fcn.0040164a
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 0x24
lea eax, [esp + 4]
push eax
push str.c:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x401198
mov eax, str.c:Xiaobai
pop esi
add esp, 0x140
ret
lea ecx, [esp + 4]
push ecx
push str.d:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x4011b6
mov eax, str.d:Xiaobai
pop esi
add esp, 0x140
ret
lea edx, [esp + 4]
push edx
push str.e:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x4011d4
mov eax, str.e:Xiaobai
pop esi
add esp, 0x140
ret
lea eax, [esp + 4]
push eax
push str.f:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x4011f2
mov eax, str.f:Xiaobai
pop esi
add esp, 0x140
ret
lea ecx, [esp + 4]
push ecx
push str.g:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x401210
mov eax, str.g:Xiaobai
pop esi
add esp, 0x140
ret
lea edx, [esp + 4]
push edx
push str.h:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x40122e
mov eax, str.h:Xiaobai
pop esi
add esp, 0x140
ret
lea eax, [esp + 4]
push eax
push str.i:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x40124c
mov eax, str.i:Xiaobai
pop esi
add esp, 0x140
ret
lea ecx, [esp + 4]
push ecx
push str.j:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x40126a
mov eax, str.j:Xiaobai
pop esi
add esp, 0x140
ret
lea edx, [esp + 4]
push edx
push str.k:Xiaobai
call esi
cmp eax, 0xffffffff
je 0x401288
mov eax, str.k:Xiaobai
pop esi
add esp, 0x140
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401290
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.Setup_1047.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
and ecx, 3
push 0x4090c0
push 0x67
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.00401050
add esp, 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x401310
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x300
push ebx
push esi
push edi
call fcn.00401000
call fcn.00401290
push 0x3fe66666
push 0x66666666
call fcn.00401030
add esp, 8
call fcn.00401110
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, eax
push str.Shadow_XB__config_task.xml
push esi
lea eax, [esp + 0x114]
push 0x409108
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0xc]
push str.Shadow_XB__configconfig.xml
push esi
push 0x409108
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x20c]
push str.Binxiaobai.exe
push esi
push 0x409108
push edx
call edi
add esp, 0x10
call fcn.004010d0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10c]
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
call esi
lea edx, [esp + 0x10c]
push edx
push 0x4090c0
push 0x68
push 0
call fcn.00401050
lea eax, [esp + 0x1c]
push eax
push 0x4090c0
push 0x69
push 0
call fcn.00401050
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x20
push 0x1388
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20c]
push 0
push ecx
call ebx
push 0x40040000
push 0
call fcn.00401030
add esp, 8
call fcn.004010d0
lea edx, [esp + 0xc]
push edx
call esi
lea eax, [esp + 0xc]
push eax
push 0x4090c0
push 0x6a
push 0
call fcn.00401050
add esp, 0x10
push 0x1388
call edi
push 0
lea ecx, [esp + 0x210]
push ecx
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x300
ret 0x10