joyce8/EMBER2024-capa huggingface dataset:
Function at 0x656b7a
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
and al, 0x42
or ebp, 0x10dc3e7d
mov ebp, esp
shl ax, cl
cmp dl, 0xb4
and esp, 0xfffffff8
push 0xffffffffffffffff
jmp 0x6d2cf7
mov eax, dword fs:[0]
jmp 0x6f940e
push 0x4c02bb
movsx eax, ax
bswap eax
jmp 0x68f67f
push eax
cbw
movzx eax, bx
movsx eax, si
push ecx
cbw
setle ah
bswap eax
mov eax, 0x1bd4
call fcn.00455860
mov eax, dword [0x4f65e8]
jmp 0x70780f
xor eax, esp
clc
test ebx, esi
mov dword [esp + 0x1bd0], eax
btr eax, edx
stc
push ebx
sbb bh, 0xfa
push esi
bt ax, 0x7f
push edi
movzx eax, cx
bswap ax
bsr eax, esi
mov eax, dword [0x4f65e8]
bswap di
xor eax, esp
movzx ebx, si
push eax
movsx ax, cl
cmovo ebx, esp
cwde
lea eax, [esp + 0x1be8]
mov edi, edx
jmp loc.0042d3e3

Function at 0x6707d7
Capabilities:
Parse pe header

Disassembly:
mov byte [ebp - 0xb], 0x2e
jmp loc.0041f2c4
mov byte [ebp - 0x10], 0x6e
jmp 0x7a5c42
push ebx
jmp 0x717f13
push edi
jmp 0x69bc22
push ebp
xor al, 0x4c
mov ebp, esp
xadd eax, eax
lea esp, [esp - 0x11c]
mov eax, dword [0x4f65e8]
jmp 0x69168d
xor eax, ebp
jmp 0x6ccef1
call 0x6c3299
lea eax, [ebp - 0x10]
jmp 0x6f25a7
mov dword [ebp - 4], eax
jmp 0x5e3d9f
push eax
jmp 0x5d5e9c
mov byte [ebp - 0xc], 0x6c
jmp 0x53f817
push esi
jmp 0x61ab18
mov byte [ebp - 0xe], 0x64
jmp 0x757927
mov byte [ebp - 0xd], 0x6c
jmp 0x70e3c1
mov byte [ebp - 0xf], 0x74
jmp 0x75772a

Function at 0x6dcbcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [0x5009f0], 0
jmp 0x5f9a30
mov dword [ebp - 0x20], 0xffffffff
jmp 0x6be013
mov word [ebp - 8], cx
jmp 0x742805
mov word [ebp - 0xa], ax
bswap ax
movsx ax, dl
lahf
push edx
not ah
cmovg eax, edx
lea eax, [ebp - 0x20]
jmp 0x72fedb
push ebp
bts ecx, ecx
adc ecx, ecx
mov ebp, esp
xadd ch, ah
and dx, 0x1b58
lea esp, [esp - 0x20]
mov eax, dword [0x4f65e8]
test esp, 0x7bc86d8d
mov cl, 0x44
clc
xor eax, ebp
rcl dl, cl
xor dh, 0x57
mov dword [ebp - 4], eax
mov edx, eax
add al, 0x7f
and eax, 0x4e640033
mov ecx, 0x5c
rdtsc
mov word [ebp - 0x1a], cx
cbw
movsx eax, sp
mov ecx, 0x78
or ax, 0x54b0
stc
mov word [ebp - 0x14], cx
sal dl, 0x8b
sar cx, 0x9f
mov eax, 0x2e
shl dl, 0x47
mov word [ebp - 0x1c], ax
shl edx, 0xdb
movsx eax, di
push esi
movsx ecx, ax
bts dx, si
mov edx, 0x54
not eax
sub eax, esi
mov word [ebp - 0x18], dx
mov ecx, 0x70
jmp 0x6e0c37
mov eax, 0x65
mov word [ebp - 0x16], ax
rdtsc
mov word [ebp - 0xe], cx
sub ah, 0x48
sub ecx, ecx
lahf
mov edx, 0x49312a81
cwde
push ecx
cdq
setp ah
lahf
mov edx, 0x74
movsx eax, si
lahf
setno al
mov word [ebp - 0x12], dx
movzx ax, ch
mov ah, 0x36
mov eax, 0x2e
movzx dx, cl
movsx edx, ax
mov word [ebp - 0x10], ax
mov edx, 0x61
cbw
movsx eax, dx
push 0x10
cwde
mov word [ebp - 0xc], dx
cbw
setg dh
mov eax, 0x6b
push 0x8000
movsx edx, cx
jmp 0x781927
push eax
jmp 0x54b315
call fcn.004534d9
mov esi, eax
bts ax, si
stc
mov eax, dword [ebp - 0x20]
stc
lea esp, [esp + 0x14]
cmp eax, 0xffffffff
jmp loc.00420eb8
lea edx, [ebp - 0x1c]
jmp 0x6d5015
Function at 0x6f940e
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
and al, 0x42
or ebp, 0x10dc3e7d
mov ebp, esp
shl ax, cl
cmp dl, 0xb4
and esp, 0xfffffff8
push 0xffffffffffffffff
jmp 0x6d2cf7
mov eax, dword fs:[0]
jmp 0x6f940e
push 0x4c02bb
movsx eax, ax
bswap eax
jmp 0x68f67f
push eax
cbw
movzx eax, bx
movsx eax, si
push ecx
cbw
setle ah
bswap eax
mov eax, 0x1bd4
call fcn.00455860
mov eax, dword [0x4f65e8]
jmp 0x70780f
xor eax, esp
clc
test ebx, esi
mov dword [esp + 0x1bd0], eax
btr eax, edx
stc
push ebx
sbb bh, 0xfa
push esi
bt ax, 0x7f
push edi
movzx eax, cx
bswap ax
bsr eax, esi
mov eax, dword [0x4f65e8]
bswap di
xor eax, esp
movzx ebx, si
push eax
movsx ax, cl
cmovo ebx, esp
cwde
lea eax, [esp + 0x1be8]
mov edi, edx
jmp loc.0042d3e3

Function at 0x70780f
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
and al, 0x42
or ebp, 0x10dc3e7d
mov ebp, esp
shl ax, cl
cmp dl, 0xb4
and esp, 0xfffffff8
push 0xffffffffffffffff
jmp 0x6d2cf7
mov eax, dword fs:[0]
jmp 0x6f940e
push 0x4c02bb
movsx eax, ax
bswap eax
jmp 0x68f67f
push eax
cbw
movzx eax, bx
movsx eax, si
push ecx
cbw
setle ah
bswap eax
mov eax, 0x1bd4
call fcn.00455860
mov eax, dword [0x4f65e8]
jmp 0x70780f
xor eax, esp
clc
test ebx, esi
mov dword [esp + 0x1bd0], eax
btr eax, edx
stc
push ebx
sbb bh, 0xfa
push esi
bt ax, 0x7f
push edi
movzx eax, cx
bswap ax
bsr eax, esi
mov eax, dword [0x4f65e8]
bswap di
xor eax, esp
movzx ebx, si
push eax
movsx ax, cl
cmovo ebx, esp
cwde
lea eax, [esp + 0x1be8]
mov edi, edx
jmp loc.0042d3e3
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2e903988
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3c903e25
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x14c
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x88]
add eax, edx
lea ecx, [esi + 0x78]
add ecx, edx
cmp word [edx + esi + 4], di
cmovne ecx, eax
mov eax, dword [ecx]
test eax, eax
je 0x10001e25
cmp dword [ebp + 0x10], 0
lea ecx, [eax + esi]
mov dword [ebp - 8], ecx
ja 0x10001d6c
mov eax, dword [ebp + 0xc]
jb 0x10001d3b
cmp eax, 0xffff
ja 0x10001d6c
movzx edx, ax
xor eax, eax
sub edx, dword [ecx + 0x10]
sbb eax, eax
test eax, eax
ja 0x10001e25
jb 0x10001d58
cmp edx, dword [ecx + 0x14]
jae 0x10001e25
mov eax, dword [ecx + 0x1c]
pop edi
lea eax, [eax + edx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
add edx, esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x18], eax
jbe 0x10001e25
nop word [eax + eax]
mov ebx, dword [edx + eax*4]
add ebx, esi
mov esi, ebx
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001da0
sub esi, ecx
call fcn.10002730
push 0xeeeeeeee
push 0x7fed7fed
mov edi, eax
push edi
push 1
push esi
push ebx
call fcn.10002660
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 2
push esi
push dword [ebp - 0xc]
mov ebx, eax
call fcn.10002660
xor ecx, ecx
or ecx, ebx
cmp dword [ebp + 0xc], eax
jne 0x10001dea
cmp dword [ebp + 0x10], ecx
je 0x10001e01
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0x18]
jae 0x10001e25
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10001d90
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx ecx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100026ba
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
nop word [eax + eax]
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0x14]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002680
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x10003bdd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10003c1c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10003c1c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10003c1c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10003c1c
cmp dword [ecx + 0x74], 0xe
jbe 0x10003c1c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100045ff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x1000cde8
push str.FlsGetValue
push 0x21
call fcn.1000453a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10004636
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000c0f8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000463e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x1000cdfc
push str.FlsSetValue
push 0x22
call fcn.1000453a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10004678
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000c0f8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10002e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x106c
call fcn.10007518
sub esp, eax
mov eax, dword [esp + eax]
mov ebx, eax
mov eax, dword [0x10008044]
test eax, eax
je 0x10002e89
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
mov esi, 0x10008044
lea esi, [esi]
mov dword [esp + 4], eax
add esi, 4
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_EnableWindow]
mov eax, dword [esi]
sub esp, 8
test eax, eax
jne 0x10002e60
xor eax, eax
lea esi, [ebp - 0x1054]
mov dword [ebp - 0x105c], 0x1048
mov word [ebp - 0x1054], ax
lea eax, [ebp - 0x105c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1058], 1
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x18], str.about:blank
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.Start_Page
mov dword [esp], str.SoftwareMicrosoftInternet_ExplorerMain
call dword [sym.imp.shlwapi.dll_SHRegGetUSValueW]
sub esp, 0x20
test eax, eax
jne 0x10002f01
cmp dword [ebp - 0x1058], 1
je 0x10002f10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], 0x3e8
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10003300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x106c
call fcn.10007518
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
cmp edx, 0x3ec
je 0x100033c0
ja 0x10003370
cmp edx, 0x3ea
je 0x10003400
cmp edx, 0x3eb
jne 0x100034a0
mov dword [esp + 8], str.about:blank
mov ebx, 1
mov dword [esp + 4], 0x3e8
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edx, 0x30003e8
jne 0x100034a0
mov dword [esp], eax
mov ebx, 1
call dword [sym.imp.user32.dll_GetParent]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x468
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, ebx
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], eax
mov eax, dword [0x1000c0c0]
mov ebx, 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], sym._delhist_dlgproc_16
mov dword [esp + 4], 0x3f2
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov eax, ebx
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x105c]
lea edi, [ebp - 0x1054]
mov dword [ebp - 0x105c], 0x1048
mov ebx, 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1058], 1
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x18], str.about:blank
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.Default_Page_URL
mov dword [esp], str.SoftwareMicrosoftInternet_ExplorerMain
call dword [sym.imp.shlwapi.dll_SHRegGetUSValueW]
sub esp, 0x20
test eax, eax
jne 0x1000335f
cmp dword [ebp - 0x1058], 1
jne 0x1000335f
mov dword [esp + 8], edi
mov dword [esp + 4], 0x3e8
mov dword [esp], esi
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
jmp 0x1000335f
xor ebx, ebx
test byte [0x10008050], 8
je 0x1000335f
movzx eax, dx
shr edx, 0x10
mov dword [esp + 0xc], str.not_implemented_for_command:__d__d_n
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], str.general_on_command
mov dword [esp + 4], 0x10008050
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x1000335f
Function at 0x10006bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10006c08
cmp byte [esi + ebx - 1], 0xa
je 0x10006bdc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1000c0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10007230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10007408
mov edi, dword [0x1000c0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10007317
test byte [0x1000813c], 8
jne 0x100073b0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1000814c], 8
jne 0x10007370
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100072b9
cmp esi, 3
jbe 0x10007328
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100072ca
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1000aa28]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100072b9
mov dword [esp], 0x1000814c
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10007290
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10007290
mov dword [esp], 0x1000813c
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000727b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10007283
mov eax, 0xffffffff
jmp 0x10007317
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40d089
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40d098
pop dword [ebp - 0x28]
mov eax, 0x40d098
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x38673
push 0
mov eax, 0x809f73
add eax, 0xffc041ad
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x931c5501
add ecx, 0x6ce3ef4e
xor edx, edx
add edx, eax
mov esi, 0x417800
add esi, dword [ebp - 0x28]
mov ebx, 0xb3e19744
xor dword [ebp - 0x20], 0x594b5c22
mov edi, dword [esi]
xor dword [ebp - 0x10], 0x44a80b40
sub edi, ebx
add dword [ebp - 0x1c], esi
mov dword [edx], edi
mov dword [ebp - 0x10], 0x2e98b62
add edx, 0xab8eb59a
sub edx, 0xab8eb596
add esi, 4
loop 0x40d0e8
add eax, 0x1040f
xor ebx, ebx
add ebx, eax
add eax, 0xe0d2d83
sub eax, 0xe0d2d7e
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10001b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x100de5dc]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
push 0x44
lea eax, [esp + 0x24]
mov esi, edx
xorps xmm0, xmm0
mov dword [esp + 0xc], esi
push 0
push eax
mov edi, ecx
movaps xmmword [esp + 0x1c], xmm0
call fcn.10041210
add esp, 0xc
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [esp + 0x4c], 1
xor eax, eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x44
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10001c09
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1003f6d6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [esp + 0xc]
mov ecx, str._null_
test edi, edi
mov eax, ecx
cmovne eax, edi
push esi
push eax
mov eax, dword [esp + 0x14]
test eax, eax
cmovne ecx, eax
push ecx
push str.cimg::system___:_Command__s__module_name__s__failed_with_error__lu:__s
call fcn.10001ac0
mov ecx, dword [esp + 0x80]
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.1003f6d6
mov esp, ebp
pop ebp
ret
Function at 0x100049f0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x100de5dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
push esi
mov esi, 0x1009a4c8
cmovne esi, eax
mov eax, esi
push edi
mov edi, ecx
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004a20
sub eax, edx
push ebx
lea ebx, [eax + 1]
test ebx, ebx
je 0x10004a4a
push ebx
call fcn.1003fc44
push ebx
push esi
push eax
mov dword [ebp - 0xe4], eax
call fcn.10041370
add esp, 0x10
jmp 0x10004a54
mov dword [ebp - 0xe4], 0
cmp dword [edi + 0x18], 0
lea ebx, [edi + 0x1c]
je 0x10004a69
cmp dword [ebx], 0
je 0x10004a69
mov ecx, edi
call fcn.10004b80
mov esi, dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
lea eax, [ebp - 0xe0]
push eax
push 0xffffffffffffffff
push 0
mov dword [ebp - 0x9c], 0xdc
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xe0]
cmp dword [ebp - 0x34], ecx
push eax
cmovb ecx, dword [ebp - 0x34]
push 0xffffffffffffffff
push 0
mov dword [edi + 0x18], ecx
mov dword [ebp - 0x9c], 0xdc
call esi
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0x30], ecx
mov al, byte [ebp + 0x18]
cmovb ecx, dword [ebp - 0x30]
cmp dword [ebp + 0x14], 4
mov dword [ebx], ecx
mov ecx, 3
cmovb ecx, dword [ebp + 0x14]
mov byte [edi + 0x30], al
mov al, byte [ebp + 0x1c]
mov dword [edi + 0x20], ecx
mov ecx, edi
mov byte [edi + 0x60], al
mov eax, dword [ebp - 0xe4]
mov dword [edi + 0x50], 0x80000000
mov dword [edi + 0x4c], 0x80000000
mov word [edi + 0xbc], 0x100
mov dword [edi + 0x34], eax
call fcn.10003790
cmp byte [edi + 0x30], 0
pop ebx
je 0x10004b07
mov ecx, edi
call fcn.100048f0
push 8
call fcn.1003fc44
add esp, 4
mov esi, eax
push 0
push 0
mov dword [esi], edi
mov eax, dword [edi + 0x34]
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
push 0
push 0
mov dword [edi + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x10004400
push 0
push 0
mov dword [edi + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [edi + 0xc4]
mov dword [edi + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1003f6d6
mov esp, ebp
pop ebp
ret 0x18