joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4390e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x43912f
call fcn.00445ecc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43912f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43914b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00438bed
mov esi, eax
test edi, edi
je 0x439149
test ebx, ebx
je 0x439149
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43aece
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55afe6
call fcn.00533aeb
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x43aef3
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x43af45
call fcn.0042e490
push eax
lea ecx, [ebp - 0x10]
call fcn.004014b0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005339bd
push eax
call fcn.00402330
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010d0
mov eax, esi
call fcn.00533bc3
ret 8

Function at 0x43f0e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00445ecc
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43f11b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0043ed24
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x43f179
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x43f19d
cmp dword [edi + 0x74], 0
jne 0x43f19d
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00445ecc
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0043f13a
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44663e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x446686
call fcn.00445ecc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x446686
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4466c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4466b2
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4466b2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x4466c6
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44bcb7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5ba6c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x44bcff
push 0x56bc48
push 4
push eax
call fcn.00534007
push eax
call fcn.00402330
add esp, 0x10
jmp 0x44bd15
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x44bd98
push edi
call fcn.00533f11
mov edi, dword [eax]
call fcn.00533f11
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.005315a4
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00533f11
cmp dword [eax], 0
je 0x44bd6c
call fcn.00533f11
push dword [eax]
call fcn.0042dabd
pop ecx
jmp 0x44bd73
call fcn.00533f11
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x44bd98
cmp dword [ebp - 0x11c], esi
jae 0x44bd98
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x44bd9a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052f5f0
leave
ret
Function at 0x44bda7
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5ba6c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.0042ec65
pop ecx
cmp eax, esi
je 0x44be91
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x44be91
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.0052f600
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x44be91
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x44be91
cmp esi, 0x14
jge 0x44be91
push 0x10
push 0
push edi
call fcn.00535be3
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x44be80
call fcn.00533f11
cmp dword [eax], 0x22
je 0x44be80
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.005339da
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x44be56
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x5be0d8], 0
jne 0x44bf1c
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x44bf45
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0044bcb7
pop ecx
pop ecx
test eax, eax
jne 0x44bf47
inc edi
cmp edi, esi
jl 0x44bf22
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f5f0
leave
ret 8

Function at 0x44dfc8
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0044dc87
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x44e012
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00410370
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040f200
jmp 0x44e01d
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004506be
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x44e023
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0043a7bc
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x44e060
call fcn.0044dc87
mov dword [esi + 0xc], 1
jmp 0x44e065
call fcn.0044dc87
cmp dword [esi], 0
je 0x44e0ae
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x44e086
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00410370
jmp 0x44e098
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004016f0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040f200
jmp 0x44e0d2
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x44e0d2
push dword [esi]
push dword [ebp + 8]
call fcn.004506be
pop esi
pop ebp
ret 0xc

Function at 0x451a85
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5ba6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x451aba
xor eax, eax
jmp 0x451b0d
lea eax, [ebp - 0x210]
push eax
call fcn.005339da
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x451aeb
push 0x56c1e4
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0053725c
add esp, 0xc
test eax, eax
jne 0x451ab6
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0053725c
add esp, 0xc
test eax, eax
jne 0x451ab6
lea eax, [ebp - 0x210]
push eax
call fcn.0042f9ed
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052f5f0
leave
ret

Function at 0x4bfe74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4bfe8e
call fcn.00445ecc
mov esi, dword [eax + 0xc]
push dword [0x5c0264]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4bfeac
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4bfea4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4bfed9
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4bfea6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004bfda2
mov esi, eax
jmp 0x4bfecb
Function at 0x50e61f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0043757a
call fcn.00430d30
cmp eax, esi
pop esi
jne 0x50e63b
mov ecx, 0x5be3a0
jmp fcn.004525da
ret

Function at 0x511fb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x511fcc
mov edi, dword [esi + 0xc]
jmp 0x51200c
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x511fe5
call fcn.0043948e
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x511ffa
call fcn.0043948e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x51200c
call fcn.0043948e
call fcn.00445ecc
cmp dword [eax + 0x3c], 0
je 0x512021
push edi
mov ecx, ebx
call fcn.00510de8
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00511ece
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x51203f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x51204b
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x52f5f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ba6c4]
jne 0x52f5fa
repz ret
jmp fcn.0053b38c
Function at 0x54a067
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ba6c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0053ad8c
and dword [ebp - 0x14], 0
cmp dword [0x5c27b4], 0
mov dword [ebp - 0x18], eax
jne 0x54a11a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x54a1c2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x59057c
push ebx
call edi
test eax, eax
je 0x54a1c2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x59056c
push ebx
mov dword [0x5c27b4], eax
call edi
push eax
call esi
push 0x590558
push ebx
mov dword [0x5c27b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5c27bc], eax
call edi
push eax
call esi
mov dword [0x5c27c4], eax
test eax, eax
je 0x54a11a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5c27c0], eax
mov eax, dword [0x5c27c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x54a173
cmp dword [0x5c27c4], ecx
je 0x54a173
push eax
call esi
push dword [0x5c27c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x54a173
test ebx, ebx
je 0x54a173
call edi
test eax, eax
je 0x54a16a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x54a16a
test byte [ebp - 8], 1
jne 0x54a173
or dword [ebp + 0x10], 0x200000
jmp 0x54a1a6
mov eax, dword [0x5c27b8]
cmp eax, dword [ebp - 0x18]
je 0x54a1a6
push eax
call esi
test eax, eax
je 0x54a1a6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x54a1a6
mov eax, dword [0x5c27bc]
cmp eax, dword [ebp - 0x18]
je 0x54a1a6
push eax
call esi
test eax, eax
je 0x54a1a6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5c27b4]
call esi
test eax, eax
je 0x54a1c2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x54a1c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f5f0
leave
ret
Function at 0x1000bef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
cmp edi, 6
jae 0x1000bf57
mov edx, ecx
mov ebx, ecx
mov ecx, 6
sub edx, esi
sub ecx, edi
cmp edx, ecx
jbe 0x1000bf1e
lea ebx, [esi + 6]
mov ecx, ebx
xor edx, edx
sub ecx, esi
cmp ebx, esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1000bf54
mov edi, edi
mov ecx, eax
inc edx
shl ecx, 6
inc edi
xor eax, ecx
lea ecx, [eax*8]
not ecx
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi]
inc esi
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1000bf30
mov ecx, dword [ebp + 0xc]
cmp edi, 9
jae 0x1000bfaa
mov edx, ecx
mov ebx, ecx
mov ecx, 9
sub edx, esi
sub ecx, edi
cmp edx, ecx
jbe 0x1000bf74
mov ebx, esi
sub ebx, edi
add ebx, 9
mov ecx, ebx
xor edx, edx
sub ecx, esi
cmp ebx, esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1000bfaa
lea ecx, [eax*4]
inc edx
xor eax, ecx
inc edi
lea ecx, [eax*8]
not ecx
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi]
inc esi
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1000bf84
mov ecx, dword [ebp + 0xc]
xor edx, edx
sub ecx, esi
cmp dword [ebp + 0xc], esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1000bfdf
lea esp, [esp]
lea ecx, [eax*8]
inc edx
not ecx
lea esi, [esi + 1]
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi - 1]
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1000bfc0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1002a100
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov ebx, ecx
mov edi, dword [edx + 0x10]
jb 0x1002a116
mov edx, dword [edx]
mov esi, 0x811c9dc5
inc edi
je 0x1002a13e
mov edi, edi
mov cl, byte [edx]
lea eax, [ecx - 0x61]
cmp al, 0x19
movsx eax, cl
ja 0x1002a12f
sub eax, 0x20
movsx eax, al
inc edx
xor eax, esi
imul esi, eax, 0x1000193
dec edi
jne 0x1002a120
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8
Function at 0x401150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.kernelbase.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push 0
push ecx
push ebx
push eax
call dword [sym.imp.kernelbase.dll_LoadStringW]
test eax, eax
je 0x401296
mov esi, eax
lea eax, [eax*2 + 2]
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4012cd
mov edi, eax
inc esi
push 0
call dword [sym.imp.kernelbase.dll_GetModuleHandleW]
push esi
push edi
push ebx
push eax
call dword [sym.imp.kernelbase.dll_LoadStringW]
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
push 0
push ecx
push 0
push 0
push edi
push 0x500
call dword [sym.imp.kernelbase.dll_FormatMessageW]
mov esi, eax
test eax, eax
jne 0x4011f9
mov eax, dword fs:[0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x34], 0xeb
jne 0x4012d5
mov ebx, dword [ebp - 0x1c]
push 0xfffffffffffffff5
call dword [sym.imp.kernelbase.dll_GetStdHandle]
lea ecx, [ebp - 0x10]
push 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.kernelbase.dll_WriteConsoleW]
test eax, eax
jne 0x40127f
call dword [sym.imp.kernelbase.dll_GetOEMCP]
push 0
push 0
push 0
push 0
push esi
push ebx
push 0
push eax
call dword [sym.imp.kernelbase.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
test eax, eax
je 0x40127f
mov edi, eax
call dword [sym.imp.kernelbase.dll_GetOEMCP]
push 0
push 0
push dword [ebp - 0x18]
push edi
push esi
push ebx
push 0
push eax
call dword [sym.imp.kernelbase.dll_WideCharToMultiByte]
push 0xfffffffffffffff5
call dword [sym.imp.kernelbase.dll_GetStdHandle]
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x18]
push edi
push eax
call dword [sym.imp.kernelbase.dll_WriteFile]
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push dword [ebp - 0x1c]
call dword [sym.imp.kernelbase.dll_LocalFree]
push dword [ebp - 0x14]
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
jmp 0x4012cd
test byte [section..data], 1
je 0x4012cd
mov eax, dword fs:[0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x34]
sub esp, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.LoadString_failed_with__ld_n
mov dword [esp + 8], str.output_message
call sym._wine_dbg_log
add esp, 0x14
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
test byte [section..data], 1
je 0x401288
mov ecx, edi
call sym._wine_dbgstr_w
mov ecx, eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x34]
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Could_not_format_string:_le_lu__fmt_s_n
mov dword [esp + 8], str.output_formatstring
call sym._wine_dbg_log
add esp, 0x18
jmp 0x401288
Function at 0x401700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.ucrtbase.dll_strlen]
add esp, 4
test eax, eax
je 0x401752
mov esi, eax
xor eax, eax
cmp byte [esi + edi - 1], 0xa
je 0x401731
mov eax, dword fs:[0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
xchg dword [0x4040cc], eax
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 4
push eax
push esi
push 1
push edi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
jmp 0x401754
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebp
ret
Function at 0x401f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push 1
call sym.__configure_wide_argv
add esp, 4
call sym.__initialize_wide_environment
call sym.___p___argc
mov edi, dword [eax]
call sym.___p___wargv
mov ebx, dword [eax]
call sym.__get_initial_wide_environment
mov esi, eax
call sym._get_nt_header
xor ecx, ecx
cmp word [eax + 0x5c], 2
sete cl
inc ecx
push ecx
call sym.__set_app_type
add esp, 4
push esi
push ebx
push edi
call sym._wmain
add esp, 0xc
push eax
call sym._exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x402bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404840], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047c0], 0x30
mov dword [0x4047c4], 2
mov dword [0x4047cc], 0
mov dword [0x4047d0], 0
mov dword [0x4047c8], 0x402f50
jmp 0x402c23
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4047d4], eax
mov dword [0x4047e0], 0xf
mov dword [0x4047e8], 0x404767
mov dword [0x404104], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4047d8], eax
mov dword [0x4047ec], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4047dc], eax
push 0x4047c0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.litform
push str.ndcls
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404838], eax
xor eax, eax
jmp 0x402cc2
push eax
push dword [0x404838]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404838]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x4047f0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402d08
push 0x4047f0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4047f0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402cdb
mov eax, dword [0x4047f8]
jmp 0x402d15
call 0x4022b2
ret

Function at 0x414def
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], edi
add edx, 4
cmp edx, ecx
jne fcn.00414def
or eax, ebx
push eax
pop eax
ret