joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548ac0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov eax, dword [0x61c174]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
lea eax, [esp + 0x2c]
push edi
push dword [esp + 0x5c]
push eax
mov dword [esi + 0xf0], 0xa
call fcn.005482a0
movups xmm0, xmmword [esp + 0x38]
add esp, 8
lea ebp, [esi + 0x10]
mov ebx, 1
movups xmmword [esi], xmm0
mov edx, dword [esp + 0x30]
xorps xmm0, xmm0
mov esi, dword [esp + 0x34]
shr edx, 1
and edx, 0x55555555
shr esi, 1
movups xmmword [esp + 0x10], xmm0
xor dword [esp + 0x14], edx
movups xmmword [esp + 0x20], xmm0
lea eax, [edx + edx]
mov edx, dword [esp + 0x1c]
xor esi, edx
psrldq xmm0, 4
xor eax, dword [esp + 0x30]
and esi, 0x55555555
xor edx, esi
mov dword [esp + 0x10], eax
movd ecx, xmm0
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x2c]
lea eax, [esi + esi]
mov esi, dword [esp + 0x38]
xor eax, dword [esp + 0x34]
shr esi, 1
xor esi, ecx
mov dword [esp + 0x18], eax
and esi, 0x55555555
xor ecx, esi
mov dword [esp + 0x24], ecx
lea eax, [esi + esi]
mov esi, dword [esp + 0x3c]
xor eax, dword [esp + 0x38]
shr esi, 1
xor esi, edx
mov dword [esp + 0x20], eax
and esi, 0x55555555
xor edx, esi
mov dword [esp + 0x2c], edx
lea eax, [esi + esi]
xor eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
call fcn.00549190
mov eax, dword [esp + 0x18]
add esp, 4
mov edi, dword [esp + 0x10]
add eax, eax
mov esi, dword [esp + 0x18]
xor eax, edi
mov edx, dword [esp + 0x20]
and eax, 0xaaaaaaaa
xor edi, eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add eax, eax
mov dword [esp + 0x40], edi
xor eax, esi
movzx edi, byte [ebx + 0x5ba817]
and eax, 0xaaaaaaaa
xor esi, eax
mov eax, dword [esp + 0x24]
add eax, eax
mov dword [esp + 0x44], esi
xor eax, edx
and eax, 0xaaaaaaaa
xor edx, eax
mov eax, dword [esp + 0x2c]
add eax, eax
mov dword [esp + 0x48], edx
xor eax, ecx
and eax, 0xaaaaaaaa
xor ecx, eax
xor eax, eax
mov dword [esp + 0x4c], ecx
nop dword [eax]
mov ecx, dword [esp + eax*4 + 0x40]
mov edx, edi
mov esi, ecx
shr ecx, 8
and esi, 0x3000000
or esi, ecx
mov cl, al
add cl, cl
shr esi, 0x12
shr edx, cl
and edx, 3
xor esi, edx
xor esi, dword [esp + eax*4 + 0x30]
mov ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, esi
mov dword [esp + eax*4 + 0x30], ecx
inc eax
cmp eax, 4
jb 0x548c10
movups xmm0, xmmword [esp + 0x30]
inc ebx
movups xmmword [ebp], xmm0
add ebp, 0x10
cmp ebx, 0xa
jbe 0x548b01
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00549eab
add esp, 0x44
ret
Function at 0x5499d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
xorps xmm0, xmm0
mov dword [esp + 8], 0
movlpd qword [esp + 0x14], xmm0
mov eax, 1
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x40
mov edi, eax
xor ebx, ebx
and edi, 1
neg edi
adc ebx, ebx
and edi, dword [esp + 0x28]
neg ebx
mov ecx, edi
and edi, dword [esp + 0x14]
xor ecx, eax
mov esi, ebx
and esi, dword [esp + 0x2c]
mov eax, esi
and esi, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
shrd ecx, eax, 1
shr eax, 1
add ecx, edi
mov dword [esp + 0x14], ecx
adc eax, esi
and ebx, 0x80000000
shrd ebp, edx, 1
mov dword [esp + 0x10], eax
xor eax, eax
shr edx, 1
add ebp, eax
mov eax, ecx
adc edx, ebx
sub dword [esp + 0x18], 1
jne 0x549a01
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x55d51d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055d393

Function at 0x5644f2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00564045
Function at 0x4104dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4104eb
pop dword [ebp - 0x18]
mov eax, 0x37f7fd15
add eax, 0xc84907d6
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3cd8e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x46b10b98
add ecx, 0xb94f38bf
mov edx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x18]
mov ebx, 0x2563d514
sub ebx, 0x1453f9c5
xor dword [ebp - 0x10], 0x612dfda9
mov edi, dword [esi]
add dword [ebp - 0x14], 0xa6ee7fc4
add edi, ebx
xor dword [ebp - 4], esi
mov dword [edx], edi
sub dword [ebp - 8], ebx
add edx, 0xd962aa86
sub edx, 0xd962aa82
add esi, 0x21d937ff
sub esi, 0x21d937fb
loop 0x41053f
add eax, 0x1042f
xor ebx, ebx
add ebx, eax
add eax, 0x443b76fb
add eax, 0xbbc4890a
mov ecx, 0xfe052682
add ecx, 0x23ad97e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xb44cdd
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
ja 0xc4f897
mov eax, esi
clc
cmp eax, 0x41983033
cmp di, cx
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0xb89eb6
mov eax, dword [ebp + 8]
dec dl
adc cl, 0x2e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x24]
cmp edx, ecx
sbb ch, 0xbc
ror cl, 0x4c
lea ecx, [edx + esi*2]
movzx edx, word [ecx + eax]
jmp 0xcb4c33
jne 0xc3dc9c
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
test edx, edx
je 0xc3dc9c
mov eax, dword [eax + ecx + 0x7c]
clc
jmp 0xc1bbe5
jmp 0xb1deb9
jle 0xa8d501
lea ebx, [esi + 1]
rcr cx, 0x1e
or ch, 1
inc cx
mov ecx, dword [ebp + 8]
jmp 0xb8dd92
mov ecx, dword [ebp + 8]
test sp, si
cmc
lea esp, [esp - 0x114]
test ah, 0x43
jmp 0xc4d62b
jns 0xb1dea6
lea edi, [esi - 1]
jmp 0xad84ba
push ebp
mov ebp, esp
jmp 0xb2152e
test ecx, ecx
jmp 0xcb50bb
cmp ebx, edi
jmp 0xbdc7b6
cmp word [ecx], ax
jmp 0xc3dc96
xor ebx, ebx
jmp 0xcd3189
jle 0xbf5701
jmp 0xcb4c40
mov eax, dword [ebp - 0xc]
bt si, 0xaa
bt esi, esi
mov edx, dword [ebp + 0x10]
rcl si, 0x59
adc esi, ebx
lea esi, [edi + ebx]
cmp dh, bl
clc
sar esi, 1
test edi, ecx
mov eax, dword [eax + esi*4]
test ecx, ecx
clc
push edx
mov edx, dword [ebp + 0xc]
cmp ch, 0x5d
add eax, ecx
jmp 0xbfe9ea
call fcn.00cd16c7
lea esp, [esp + 4]
cmp ebp, ecx
jmp 0xcec34d
je 0xcb4c43
mov eax, dword [edx + ecx + 0x20]
cmc
test edi, esi
test si, 0x5ad3
lea eax, [eax + ecx]
jmp 0xbcd326
push ebx
push edi
cmp ebx, ebp
cmc
test ah, dh
mov dword [ebp - 0x10], eax
stc
jmp 0xcd3aee
je 0xc6a79d
sub eax, eax
xchg esi, esi
pop esi
jmp 0xc75db4
push esi
jmp 0xb7519a
mov edi, dword [edx + ecx + 0x18]
jmp 0xcdef83
mov eax, dword [ecx + 0x3c]
stc
cmp ebp, 0x770f7aae
cmp dword [eax + ecx], 0x4550
jmp 0xab894e
mov esp, ebp
bswap bp
movzx ebp, di
pop ebp
jmp 0x75ccdb
mov dword [ebp - 8], edx
movsx ecx, sp
rcr edx, cl
mov ecx, eax
movzx eax, bx
mov edx, dword [ebp - 4]
je 0xc3dc9c
mov esi, dword [ebp + 0xc]
jmp 0xccddc9
test esi, esi
je 0xc3dc9c
mov eax, 0x5a4d
jmp 0xb8f434
dec edi
jmp 0xcd9712
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0xa82955
mov dword [ebp - 0xc], eax
js 0xcb4c43
jmp 0xbf570c
test edi, edi
jmp 0xc1646e
test eax, eax
jmp 0xb441ba
Function at 0x665031e0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [eax + 0x14]
mov dword [ebp - 0x20], esi
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], ebx
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx]
mov dword [ebp - 0x28], eax
test byte [0x66505018], 8
jne 0x665032d0
test ebx, ebx
je 0x665032c0
test edi, edi
je 0x665032c0
test esi, esi
je 0x665032c0
test edx, edx
mov dword [ebp - 0x2c], edx
je 0x665032c0
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x665032c0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x10], esi
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
and ecx, 3
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
jne 0x665032a6
test dword [ebp - 0x1c], 0x700
je 0x66503330
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], edi
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__08lx__08x__08lx__lu__p__p__p__p__lu__n
mov dword [esp + 8], str.ASN1_CreateModule
mov dword [esp + 4], 0x66505018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x2c]
jmp 0x66503229
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24

Function at 0x66503350
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x66505018], 8
jne 0x665033a0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.ASN1_CloseModule
mov dword [esp + 4], 0x66505018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6650336d
Function at 0x665033d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x20], edx
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
test byte [0x66505018], 8
jne 0x66503510
mov dword [ebp - 0x24], ecx
test esi, esi
je 0x66503558
test edi, edi
je 0x66503558
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x66503562
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x66503463
test byte [0x66505018], 1
jne 0x665034e0
mov dword [ebx], 0x44434e45
mov dword [ebx + 4], 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov eax, dword [esi + 4]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0x2c], eax
test ecx, ecx
je 0x665034ca
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x665034ca
or eax, 8
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x2c], eax
mov dword [edi], ebx
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [ebp - 0x1c], ecx
mov dword [esp + 0xc], str.parent_not_implemented._n
mov dword [esp + 8], str.ASN1_CreateEncoder
mov dword [esp + 4], 0x66505018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov ecx, dword [ebp - 0x1c]
jmp 0x66503463
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov dword [ebp - 0x24], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__p__p__lu__p__n
mov dword [esp + 8], str.ASN1_CreateEncoder
mov dword [esp + 4], 0x66505018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov ecx, dword [ebp - 0x24]
jmp 0x66503407
mov eax, 0xfffffc0f
jmp 0x665034ce
mov eax, 0xfffffc12
jmp 0x665034ce
Function at 0x665035c0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
test byte [0x66505018], 8
jne 0x665036f0
mov dword [ebp - 0x24], edx
test esi, esi
je 0x66503738
test edi, edi
je 0x66503738
mov dword [esp + 8], 0x2c
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x66503742
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
test eax, eax
je 0x6650364f
test byte [0x66505018], 1
jne 0x665036c0
mov eax, dword [ebp - 0x1c]
mov dword [ebx], 0x44434544
mov dword [ebx + 4], 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov eax, dword [esi + 4]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0x28], eax
test edx, edx
je 0x665036a4
or eax, 8
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
mov dword [edi], ebx
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [ebp - 0x20], edx
mov dword [esp + 0xc], str.parent_not_implemented._n
mov dword [esp + 8], str.ASN1_CreateDecoder
mov dword [esp + 4], 0x66505018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x20]
jmp 0x6650364f
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov dword [ebp - 0x24], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__p__p__lu__p__n
mov dword [esp + 8], str.ASN1_CreateDecoder
mov dword [esp + 4], 0x66505018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x24]
jmp 0x665035f7
mov eax, 0xfffffc0f
jmp 0x665036a8
mov eax, 0xfffffc12
jmp 0x665036a8

Function at 0x665038e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6650393b
cmp byte [esi + ebx - 1], 0xa
je 0x6650390f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x66509084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x66503e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x66509094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x66504050
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x66509094]
movzx eax, al
bt eax, esi
jae 0x665040b0
mov ecx, dword [0x66509084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x66503f56
test byte [0x66505030], 8
jne 0x66503ff0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x66505040], 8
jne 0x66503fa0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x66503f25
cmp esi, 3
jbe 0x66503f60
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x665081b0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x66503f25
mov ecx, dword [0x66509094]
test ecx, ecx
je 0x66504090
mov dword [esp], 0x66505040
call dword [0x66509094]
test al, 8
je 0x66503efc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x66503efc
mov ebx, dword [0x66509094]
test ebx, ebx
je 0x66504070
mov dword [esp], 0x66505030
call dword [0x66509094]
test al, 8
je 0x66503ee9
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x66503eef
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x66509094
call sym._load_func.part.0
jmp 0x66503eb0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x66509094
call sym._load_func.part.0
jmp 0x66503ffa
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x66509094
call sym._load_func.part.0
jmp 0x66503fae
mov eax, 0xffffffff
jmp 0x66503f56
Function at 0x40bae2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040b7d1
jae 0x40bb70
rol dword [edx - 0x73], 0x45
rcl byte [eax - 0x18], 0xc5
cld
invalid
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.0040b7e1
push eax
push esi
push dword [ebp + 8]
call fcn.0040b796
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040b7e1
push eax
push esi
push dword [ebp + 8]
call fcn.0040b796
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040b7e1
push eax
push esi
push dword [ebp + 8]
call fcn.0040b796
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040b7d1
mov edi, 0x9d88b9f0
jl 0x40bc56
invalid

Function at 0x40bdb2
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x40bd76
cmp dword [eax + 0xc], ebx
je 0x40be19
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0040b7d1
add ch, ch
inc esp
or bh, byte [ecx]
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
jne 0x40bdb9
mov dword [ebp + 0x10], edi
jmp 0x40bdbe
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.0040b7d1
aad 0x78
lodsd eax, dword ss:[esi]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x40be07
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x40bde2
and eax, 0xffff
push eax
jmp 0x40bde6
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b796
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x40bfc0
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x40bdc7
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x40bd68
call fcn.0040b7d1
jns 0x40be84
test eax, 0xeb0c5d89
push es