joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447fd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], edi
test edi, edi
jne 0x447fe8
mov dword [ebp - 4], edi
jmp 0x447ffc
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447ff0
sub eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00417d50
mov ebx, 8
add esp, 8
cmp dword [eax + 0x18], ebx
jb 0x44801b
mov eax, dword [eax + 4]
jmp 0x44801e
add eax, 4
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp dword [ebp - 0x28], ebx
jb 0x44803c
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0042305c
add esp, 4
test esi, esi
jne 0x44804b
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
je 0x44812f
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422677
add esp, 4
mov ebx, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x44807e
mov dword [ebp - 4], edi
jmp 0x44808f
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448083
sub eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00417d50
mov edi, 8
add esp, 8
cmp dword [eax + 0x18], edi
jb 0x4480ae
mov eax, dword [eax + 4]
jmp 0x4480b1
add eax, 4
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 0x28], edi
jb 0x4480cb
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0042305c
add esp, 4
push ebx
lea ecx, [ebp - 0x40]
call fcn.00402950
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00417d90
mov ecx, dword [ebp + 0xc]
add esp, 8
push 0xffffffffffffffff
push 0
push eax
call fcn.00402010
cmp dword [ebp - 0xc], 0x10
jb 0x448103
mov edx, dword [ebp - 0x20]
push edx
call fcn.0042305c
add esp, 4
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], edi
jb 0x448126
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042305c
add esp, 4
push ebx
call fcn.004233dd
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448680
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x4d2714]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
mov edi, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
cmp dword [0x4d4874], edi
jne 0x4486e9
call fcn.0040f180
cmp eax, 3
jg 0x4486e9
test esi, esi
jne 0x4486e9
push 3
push 0x58
push str..wini18n.cc
lea ecx, [ebp - 0xb8]
mov ebx, edi
call fcn.00410e90
add eax, 4
push str.Check_failed:_language.
push eax
call fcn.00403c40
add esp, 8
test bl, 1
je 0x4486fc
lea ecx, [ebp - 0xb8]
and ebx, 0xfffffffe
call fcn.004108d0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov ecx, 0x1400
cmp cx, si
je 0x44885d
push 9
lea edx, [ebp - 0x18]
push edx
movzx edi, si
push 0x59
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [0x4d4874], 1
mov dword [ebp - 0x1c], eax
jne 0x44877d
call fcn.0040f180
cmp eax, 3
jg 0x44877d
cmp dword [ebp - 0x1c], 0
jne 0x44877d
or ebx, 2
call sub.KERNEL32.dll_GetLastError
push eax
push 3
push 0x62
push str..wini18n.cc
lea ecx, [ebp - 0xc0]
call fcn.00411020
push str.Failed_getting_language_id
add eax, 0xc
push str.Check_failed:_0___result_length.
push eax
call fcn.00403c40
add esp, 8
push eax
call fcn.00403c40
add esp, 8
test bl, 2
je 0x448790
lea ecx, [ebp - 0xc0]
and ebx, 0xfffffffd
call fcn.00411080
mov eax, dword [ebp - 0x1c]
cmp eax, 1
jle 0x4488b5
mov ecx, dword [ebp - 0x24]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00402470
mov ecx, dword [ebp - 0x20]
call fcn.00414390
and esi, 0xfc00
xor ecx, ecx
cmp cx, si
je 0x44884a
push 9
lea edx, [ebp - 0x18]
push edx
push 0x5a
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [0x4d4874], 1
mov esi, eax
jne 0x448827
call fcn.0040f180
cmp eax, 3
jg 0x448827
test esi, esi
jne 0x448827
or ebx, 4
call sub.KERNEL32.dll_GetLastError
push eax
push 3
push 0x6a
push str..wini18n.cc
lea ecx, [ebp - 0xc0]
call fcn.00411020
push str.Failed_getting_region_id
add eax, 0xc
push str.Check_failed:_0___result_length.
push eax
call fcn.00403c40
add esp, 8
push eax
call fcn.00403c40
add esp, 8
test bl, 4
je 0x448837
lea ecx, [ebp - 0xc0]
call fcn.00411080
cmp esi, 1
jle 0x44884a
mov ecx, dword [ebp - 0x20]
dec esi
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.00402470
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004235d5
mov esp, ebp
pop ebp
ret
cmp dword [0x4d4874], edi
jne 0x4488a5
call fcn.0040f180
cmp eax, 3
jg 0x4488a5
push 3
push 0x73
push str..wini18n.cc
lea ecx, [ebp - 0xb8]
or ebx, 8
call fcn.00410e90
push str.Cannot_determine_language_for_a_supplemental_locale.
add eax, 4
push str.Check_failed:_false.
push eax
call fcn.00403c40
add esp, 8
push eax
call fcn.00403c40
add esp, 8
test bl, 8
je 0x4488b5
lea ecx, [ebp - 0xb8]
call fcn.004108d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004235d5
mov esp, ebp
pop ebp
ret
Function at 0x466ba0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
xor esi, esi
call fcn.004620b0
mov eax, dword [ebp + 0xc]
add esp, 4
push esi
push 0x10000080
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x466c50
push 1
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x466c18
push esi
push esi
push 1
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x466c18
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea esi, [ebp - 0xc]
push 0
push 0
push 0
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
test esi, esi
je 0x466c50
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 4], eax
test eax, eax
jne 0x466c59
push esi
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [ebx + 0x14], esi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi - 4]
mov edx, dword [eax + 0x60]
push edi
lea edi, [esi - 4]
mov ecx, edi
mov dword [ebp - 8], esi
call edx
xor ebx, ebx
mov dword [ebp - 4], eax
test eax, eax
jle 0x46e72c
mov eax, dword [edi]
mov edx, dword [eax + 0x64]
push ebx
mov ecx, edi
call edx
mov esi, eax
mov eax, dword [edi]
mov edx, dword [eax + 0x68]
push ebx
mov ecx, edi
call edx
mov ecx, eax
xor ecx, esi
and esi, 0xff
test ecx, 0xffffff00
movzx ecx, byte [ebp + 8]
jne 0x46e716
cmp esi, ecx
jg 0x46e723
jmp 0x46e71a
cmp esi, ecx
jle 0x46e766
and eax, 0xff
cmp ecx, eax
jle 0x46e766
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x46e6e4
mov esi, dword [ebp - 8]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
je 0x46e7d6
xor edi, edi
test eax, eax
jle 0x46e7d6
push edi
call fcn.0047a150
mov cl, byte [eax + 4]
movsx edx, cl
test cl, cl
jge 0x46e757
mov edx, dword [eax + 0xc]
test edx, edx
jbe 0x46e7b7
test byte [eax + 5], 2
je 0x46e771
add eax, 8
jmp 0x46e774
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [eax + 0x10]
movzx ecx, word [eax]
mov ebx, ecx
and ebx, 0xfffff800
cmp ebx, 0xd800
jne 0x46e7b3
test ecx, 0x400
jne 0x46e7b3
cmp edx, 1
jle 0x46e7b3
movzx eax, word [eax + 2]
mov edx, eax
and edx, 0xfffffc00
cmp edx, 0xdc00
jne 0x46e7b3
add ecx, 0xffff2809
shl ecx, 0xa
add ecx, eax
mov eax, ecx
jmp 0x46e7bc
mov eax, 0xffff
movzx ecx, byte [ebp + 8]
and eax, 0xff
cmp eax, ecx
je 0x46e766
mov ecx, dword [esi + 0x24]
inc edi
cmp edi, dword [ecx + 4]
jl 0x46e744
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401348
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x60
xor esi, esi
mov ecx, 0x85
push esi
dec ecx
jne 0x401358
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
and esi, esi
je 0x401464
mov edi, dword [ebp + 0x10]
and edi, edi
je 0x401464
mov edx, dword [ebp + 0xc]
and edx, edx
je 0x401464
push esi
push edi
push edx
xor eax, eax
lea esi, [ebp - 0x17c]
lea edi, [ebp - 0x27c]
mov byte [esi + eax], al
mov bl, byte [edx]
cmp bl, 0
je 0x4013b4
mov byte [edi + eax], bl
inc edx
inc eax
cmp eax, 0x100
jl 0x401391
jmp 0x4013c8
pop edx
push edx
mov bl, byte [edx]
mov byte [edi + eax], bl
inc edx
inc eax
cmp eax, 0x100
jl 0x401391
xor ecx, ecx
xor edx, edx
mov al, byte [esi + ecx]
mov ah, byte [edi + ecx]
add al, ah
mov ah, dl
add al, ah
mov edx, eax
and edx, 0xff
mov bl, byte [esi + ecx]
mov al, byte [esi + edx]
mov byte [esi + ecx], al
mov byte [esi + edx], bl
inc ecx
cmp ecx, 0x100
jl 0x4013cc
pop edx
pop edi
pop esi
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov eax, 0x4d2
cmp edx, dword [ebp + 0x14]
jge 0x401464
mov al, byte [esi + edx]
inc ch
and ch, 0xff
push esi
lea esi, [ebp - 0x17c]
push eax
push ebx
xor eax, eax
mov ah, ch
shr eax, 8
mov ebx, eax
mov al, byte [esi + ebx]
add cl, al
and cl, 0xff
pop ebx
xor eax, eax
mov al, cl
mov bl, byte [esi + eax]
mov al, ch
mov bh, byte [esi + eax]
mov byte [esi + eax], bl
mov al, cl
mov byte [esi + eax], bh
pop eax
add bl, bh
and ebx, 0xff
mov bh, byte [esi + ebx]
shr ebx, 8
xor al, bl
mov byte [edi + edx], al
pop esi
inc edx
jmp 0x401404
cmp eax, 0x4d2
je 0x401476
mov eax, 1
mov esi, eax
pop edi
pop esi
pop ebx
mov dword [ebp - 0x7c], esi
mov eax, dword [ebp - 0x7c]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4018fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x60
xor esi, esi
xor edi, edi
mov ecx, 0x11
push esi
dec ecx
jne 0x40190c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp + 8]
add eax, ecx
mov dword [ebp - 0x80], eax
mov ebx, dword [ebp - 0x80]
xor eax, eax
add ebx, eax
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x84]
add eax, ecx
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x84]
mov ecx, dword [ebx + 0x24]
add eax, ecx
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x84]
mov ecx, dword [ebx + 0x20]
add eax, ecx
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x84]
mov ecx, dword [ebx + 0x1c]
add eax, ecx
mov dword [ebp - 0x8c], eax
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
shr eax, 0x10
test eax, eax
je 0x401a99
mov eax, 1
mov ebx, dword [ebp - 0x84]
mov ecx, dword [ebx + 0x14]
neg eax
add eax, ecx
mov dword [ebp - 0xa8], eax
mov esi, 0
jmp 0x401a86
mov ebx, dword [ebp - 0x8c]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x401a84
mov eax, 1
mov ebx, dword [ebp - 0x84]
mov ecx, dword [ebx + 0x18]
neg eax
add eax, ecx
mov dword [ebp - 0xb0], eax
mov edi, 0
jmp 0x401a76
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0
fild qword [ebp - 0x58]
mov ebx, dword [ebp - 0x88]
mov eax, edi
shl eax, 1
add ebx, eax
mov ax, word [ebx]
call fcn.00404677
fcompp
fnstsw ax
sahf
jne 0x401a74
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x90]
mov ecx, edi
shl ecx, 2
add ebx, ecx
mov ecx, dword [ebx]
add eax, ecx
mov dword [ebp - 0x94], eax
mov ebx, dword [ebp - 0x94]
call fcn.00404e31
mov ebx, dword [ebp + 0xc]
call fcn.00404e31
call fcn.00404c3e
jne 0x401a74
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x8c]
mov ecx, esi
shl ecx, 2
add ebx, ecx
mov ecx, dword [ebx]
add eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x401b2e
inc edi
mov eax, edi
cmp eax, dword [ebp - 0xb0]
jbe 0x4019f4
inc esi
mov eax, esi
cmp eax, dword [ebp - 0xa8]
jbe 0x4019ba
jmp 0x401b2e
mov eax, 1
mov ebx, dword [ebp - 0x84]
mov ecx, dword [ebx + 0x14]
neg eax
add eax, ecx
mov dword [ebp - 0xa8], eax
mov esi, 0
jmp 0x401b24
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0
fild qword [ebp - 0x58]
mov ebx, dword [ebp - 0x84]
mov eax, dword [ebx + 0x10]
call fcn.00404681
faddp st(1)
mov eax, dword [ebp - 0xa0]
call fcn.00404681
fcompp
fnstsw ax
sahf
jne 0x401b22
mov ebx, dword [ebp - 0x8c]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x401b1d
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x8c]
mov ecx, esi
shl ecx, 2
add ebx, ecx
mov ecx, dword [ebx]
add eax, ecx
mov dword [ebp - 0x7c], eax
jmp 0x401b2e
inc esi
mov eax, esi
cmp eax, dword [ebp - 0xa8]
jbe 0x401abc
mov eax, dword [ebp - 0x7c]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x402fe0
Capabilities:
Accept command line arguments
Allocate thread local storage
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..rdata__
test word cs:[0x40366e], 4
jne 0x4030d6
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.004032a4
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x294]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x40304c
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0xfe], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00403481
mov dword [ebx + 0xf4], eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [ebx + 0xf0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x104], eax
call fcn.0040318c
mov eax, 0xff
jb 0x4030c2
call fcn.004032ef
call fcn.004034d1
mov eax, 0xff
jb 0x4030a4
push ebx
call fcn.004031fa
pop ebx
push eax
call fcn.004031ff
call fcn.004031e6
push dword [ebx + 0xf0]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
dec dword [ebx + 0x1c]
dec dword [ebx + 0x10]
pop eax
push eax
call dword [sym.imp.OLE32.DLL_CoUninitialize]
pop eax
pop edi
pop esi
pop ebx
pop ebp
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
cmp dword [ebp + 0xc], 1
jne 0x403137
call fcn.004032a4
lea eax, [ebx + 0x294]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00403481
mov dword [ebx + 0xf4], eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [ebx + 0xf0], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x104], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10c], eax
call fcn.004032ef
call fcn.004034d1
jb 0x403172
call fcn.0040318c
jb 0x403172
inc word [ebx + 0x102]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x108], eax
cmp eax, 2
jne 0x40314a
call fcn.00403539
push ebx
call fcn.004031fa
pop ebx
cmp dword [ebx + 0x108], 3
jne 0x40315f
call fcn.00403573
cmp dword [ebx + 0x108], 0
jne 0x40317e
call fcn.004031ff
call fcn.004031e6
push dword [ebx + 0xf0]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
movzx eax, word [ebx + 0x102]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40318c
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x4031e5
mov dword [ebx + 0xe4], eax
mov dword [ebx + 0xec], 0
mov dword [ebx + 0xe8], 0
call fcn.00403539
jb 0x4031e5
mov dword [ebx + 0xe8], eax
mov dword [eax + 0x4c], 8
call 0x4031d9
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x4031f3
push ebx
jb 0x403240
add byte [esi - 4], bl
mov ecx, 0xe
lea edi, [eax + 0x2c]
rep movsb byte es:[edi], byte [esi]
ret
call dword [sym.imp.KERNEL32.DLL_TlsFree]
ret
mov edi, 0x8d02e6c1
dec esp
xor eax, 0x15ff5100
cld
jno 0x40328e
add bl, ch
scasd eax, dword es:[edi]
add byte [edx], cl
add byte [esi], cl
add byte [eax + eax - 0x1f], ah
call [edi - 0x75]
pop edi
mov esp, ebp
pop ebp
add byte [edx + 0x33], bl
invalid

Function at 0x4032ef
Capabilities:
Get system information on windows

Disassembly:
mov word [ebx + 0xf8], 0
mov ah, byte [ebx + 0x298]
mov al, byte [ebx + 0x29c]
mov word [ebx + 0xfa], ax
mov eax, dword [ebx + 0x2a4]
test al, 1
jne 0x40331f
test al, 2
je 0x403347
mov ax, 0x400
jmp 0x403340
mov dx, word [ebx + 0x2a0]
cmp dx, 0x3b6
mov ax, pe_nt_image_headers32
je 0x403340
cmp dx, 0x457
mov ax, 0x100
je 0x403340
mov ax, 0x200
or word [ebx + 0xf8], ax
sub esp, 0x24
push esp
cld
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov byte [ebx + 0xfc], 3
test word [ebx + 0xf8], 0x380
jne 0x403386
test word [ebx + 0xf8], 0x400
je 0x4033bf
cmp word [esp], 0
jne 0x4033bf
mov al, byte [esp + 0x20]
cmp al, 3
jb 0x4033bf
cmp al, 5
jbe 0x40339c
mov al, 5
jmp 0x40339c
mov eax, dword [esp + 0x18]
cmp eax, 0x182
jbe 0x4033bf
cmp eax, 0x24a
mov al, 5
jae 0x40339c
mov al, 4
mov byte [ebx + 0xfc], al
cmp al, 5
jb 0x4033bf
mov eax, 1
push ebx
cpuid
pop ebx
test edx, 0x800000
je 0x4033bf
or word [ebx + 0xf8], 0x40
add esp, 0x24
push esp
push esp
push 0x20019
push 0
call 0x403403
dec eax
inc ecx
push edx
inc esp
push edi
inc ecx
push edx
inc ebp
pop esp
inc esp
inc ebp
push ebx
inc ebx
push edx
dec ecx
push eax
push esp
dec ecx
dec edi
dec esi
pop esp
push ebx
jns 0x40345b
je 0x40344f
insd dword es:[edi], dx
pop esp
inc esi
insb byte es:[edi], dx
outsd dx, dword [esi]
popal
je 0x40345b
outsb dx, byte [esi]
push eax
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x636f7250
jae 0x403473
outsd dx, dword [esi]
jb 0x403403
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
pop edx
jne 0x403425
mov ax, 2
or word [0x4060f8], ax
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
ret
add byte [ebx], dh
sar byte [ecx + 0xcc], 0x8d
jnp 0x40346a
stosb byte es:[edi], al
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
or al, al
jne 0x40346b
ret
Function at 0x401000
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [esp], 0xfffffff5
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
call edi
xor ecx, ecx
sub esp, 4
mov dword [esp + 0x10], ecx
lea ecx, [ebp - 0x1c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401060
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], esi
xor eax, eax
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [ebp - 0x34], ecx
call ecx
xor edx, edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
sub esp, 0x20
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov edx, eax
je 0x40104a
mov dword [esp + 8], ebx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp], 0
mov dword [ebp - 0x38], edx
call ecx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call edi
mov edi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
sub esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub esp, 0x14
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
sub esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x401890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x401900
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x4018f8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x406084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x4018bd
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x401f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x402118
mov edx, dword [0x406084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x402108
test byte [0x403018], 8
jne 0x4020b0
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x403028], 8
jne 0x402070
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401fcb
cmp dword [ebp + 8], 3
jbe 0x402030
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x401fda
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x40417c]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x401fcb
mov dword [esp], 0x403028
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x401fa0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x401fa0
mov dword [esp], 0x403018
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x401f8d
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x401f93
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x402028