joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421200
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42cdd0]
push ebx
mov ebx, dword [0x2bd224c]
push edi
mov edi, dword [0x2bd46cc]
call fcn.00421180
cmp dword [0x2bd46cc], 0x2f
jne 0x42126d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004211b0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x4214e0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x4214f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x421541
mov dword [0x2bd4334], 0x8e46a6f0
cmp dword [0x2bd46cc], 0x3dc
jne 0x42153f
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4214ef
mov dword [ebp - 0x10], 0
jmp 0x421553
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x4215ee
cmp dword [0x2bd46cc], 0xa5f
jne 0x421574
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x10], 0x84620b
jne 0x421599
mov eax, dword [0x42dbf0]
mov dword [0x2bd46cc], eax
mov ecx, dword [0x2bd46cc]
add ecx, 0xa231
mov dword [0x2bd46cc], ecx
cmp dword [0x2bd46cc], 0x141
jne 0x4215e9
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x42f1b8], 0xec58acac
mov dword [0x42f1bc], 0xffffffff
jmp 0x42154a
call fcn.00421290
jmp dword [0x2bd224c]
Function at 0x42b9fc
Capabilities:
Encode data using xor

Disassembly:
retf
enter 0x44f4, 0xffffffffffffffc2
adc dword [esi], 0x5aa8913e
scasd eax, dword es:[edi]
loop 0x42b9d8
aam 0xb1
sbb al, 0x13
leave
pushal
call eax
fsub dword [edx]
mov bl, 0x7f
xchg esp, eax
jo 0x42ba06
loop 0x42ba46
ficom dword [ebx]
mov bl, 0xc2
mov esi, 0xe8583a8a
mov eax, dword [0x90c49a70]
pop eax
call 0xc4dd2aca
nop
cmp al, 0xe2
push cs
invalid
cld
push 0xdc0869f9
sti
mov ebx, dword [eax + 0x62]
dec esi
jecxz 0x42ba23
ror byte [ebx + 0x4bb0879], 1
dec esp
push 0xffffffffffffff91
mov edi, dword [ecx + 8]
mov ebx, 0x6a4cf304
xchg ecx, eax
xchg esi, eax
fisubr word [esi]
mov edi, 0x20a4e45f
mov ss, word [edi]
inc edx
call 0xe942d57
pop ecx
dec ebp
cld
xor edi, dword [ebx - 0x26103410]
jecxz 0x42ba52
shr byte [0xd46d80d9], cl
invalid

Function at 0x437d0b
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x18d122f5], bh
add byte [edi], bh
adc dword [ebx - 0x613df4d8], edi
sar byte [edi], 1
mov byte [ebx - 0x5f], cl
invalid
imul ebp, dword [ebx], 0x4b
xchg esp, eax
mov ch, 0xa1
das
scasb al, byte es:[edi]
or byte [ebx], bl
div esp
jne 0x437c9d
add al, 0x64
insb byte es:[edi], dx
je 0x437d3d
invalid
inc esi
fdivr st(5)
test eax, 0x442b281c
ja 0x437dac
sub eax, 0x978b5b01
mov esp, 0xda6dabeb
and al, 0x91
sub al, 0x57
xchg esp, eax
mov ch, 0x84
sbb eax, 0xa36bf7bb
push ds
in eax, dx
pop ebp
not dword [ebx]
les edi, [esi]
xor eax, 0xe29aaa24
mov byte [0x5e4eaf86], al
dec edx
ret 0x8e9f
and byte [ebp - 0x52], al
xor eax, 0x42f6a41a
Function at 0x43ac5b
Capabilities:
Encode data using xor

Disassembly:
xor byte [ebx], dh
xor dword [eax], ebx
sbb dh, bl
fisubr word [ebp + 0x66]
push eax
fisubr word [ebp + 0x66]
push eax
test eax, 0xa289a707
shl esp, 1
jb 0x43acb4
cmc
or eax, 0x738bd4b5
mov ebx, fs
popal
inc dword [ebx]
adc dl, al
jp 0x43ac56
mov bh, 0xf6
adc dword [ebx], edi
wait
push 0x52
adc dword cs:[eax], esp
mov ebp, 0xfd0fb482
mov ah, 0xf
std
mov edi, dword [ecx + 0x1dfa3ea]
adc byte [ecx - 0x6f], dl
leave
pop dword [esi + esi*2]
in al, 0xf5
stc
xlatb
adc eax, dword [ecx]
sbb eax, 0x855110c4
sar ebx, cl
inc edx
fst dword [ebx]
pop ss
jge 0x43ac65
mov bl, 0x60
dec edi
pop ebp
jb 0x43acc9
outsb dx, byte [esi]
jle 0x43ac85
das
fsub dword [ecx + 0x23fbd163]
xchg ebp, eax
xchg edi, eax
push edx
adc dword [eax + esi*4 + 0x1e32e62], eax
jnp 0x43ace7
sbb ecx, dword [ebx + esi*2 + 0x64]
loopne 0x43ad3e
loopne 0x43ad3e
mov byte [0xfd74b760], al
scasb al, byte es:[edi]
mov ebx, 0xe9accf84
ret
adc dword [ecx - 0x21d3dbc8], eax
fdiv qword [ebx]
push ecx
int 0xe5
ret
push esp
pop ecx
adc byte [ecx + 0x2eb621f7], dl
rcl dword [ecx + 0x1f3bcf63]
xchg esp, eax
push ds
aas
push eax
mov esi, ebx
xor ah, byte [0xdae4c1c2]
xor eax, 0x37b8ec52
jo 0x43ad8e
ret 0xe4c1
adc ebp, ebp
jne 0x43ad54
cld
jo 0x43adb9
invalid
add esp, ecx
cli
push ecx
xor dword [eax + 0x4b0010e2], edx
sbb al, 0xe9
mov byte [ecx - 0x23df7393], 0xd6
xchg ecx, eax
loop 0x43aded
fimul dword [edx]
dec ebx
add edi, dword [ecx + 0x6b5e97a6]
xchg edx, eax
lodsb al, byte [esi]
push ebp
sub edx, esp
loope 0x43adc4
inc edx
pop edi
pop edi
jp 0x43adf0
cmp dh, dh
adc eax, 0x18eb0057
aas
dec ebx
push edx
sti
lds esp, [ebp - 0x52be9c20]
add byte [ebx + 0x661b898b], al
aas
and ebp, dword [ecx + 0xf]
invalid
mov ch, ah
mov ah, 0xa8
or eax, 0xaf3d3036
push edx
ret
test al, 0xd
xor byte ss:[0x32c352af], bh
cmp eax, 0x32c352af
dec esi
test byte [ebx + edi*4], al
jg 0x43adf4
fstp xword [eax]
push eax
int 0xc2
mov byte [0x14213ad9], 0x4a
fnstcw word [edx]
and dword [edx + ecx*2], edx
push edx
inc esp
pushal
rcr dword [edi], cl
jl 0x43ae06
ret 0xd6a

Function at 0x44eabb
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc dword [ecx - 0x28], 0x3f76c4ce
adc al, 0x87
mov eax, dword [0x620da4e7]
pop es
arpl word [edi], sp
cmc
shl ah, cl
test eax, 0x65e7d8d2
in al, 0xa9
rcr al, cl
out 0x65, eax
xlatb
mov al, 0xcc
insd dword es:[edi], dx
mov dword [0x43a11d77], eax
mov byte [ecx + ebp - 0x197e4ab1], bh
jo 0x44eace
pop ebx
pop es
and dh, byte [esi + 0x56626603]
sub ebp, dword [0x7c3c8d3]
xor edx, dword [esi - 0x18376064]
dec eax
out 0x76, al
xchg esi, eax
add eax, 0x53
aaa
adc ch, byte [edi]
mov bl, 0x77
outsd dx, dword [esi]
adc ebx, 0xffffff80
fsubr qword [esi + 0x3f]
pop ebx
push eax
test dword [ebp + 0x67], esp
invalid
Function at 0x480b41
Capabilities:
Encode data using xor

Disassembly:
ja 0x480ad4
push esp
in al, 0xb2
add edx, dword [ebx + 0x22]
jno 0x480ad7
and dh, byte [ecx]
pop esi
outsd dx, dword [esi]
push cs
push cs
pop edi
pop ss
inc esi
pop es
push ebx
jmp 0x249d106b
cmp al, 0x37
pop ss
jne 0x480af3
push ebp
in al, 0xb5
add al, 0x55
mov ch, 4
push ebp
and al, 0x70
add byte [ecx + 0x6f], dl
aas
or ebx, dword [ebx + 0x29]
jns 0x480b36
aaa
push esi
out 0xb7, eax
push es
push edi
ja 0x480b0d
push esp
xor eax, 0x70215303
or al, 0x5d
add edx, dword [ebx + 0x21]
jo 0x480b1b
pop ebp
jmp 0x480acd
mov ebx, 0x7929580a
or bl, byte [eax + 0x29]
jns 0x480b1f
or byte [esi + 0x67], ah
add eax, 0xb7c2252
add ax, 0x2252
jl 0x480b2a
add eax, 0xb7c2252
push edx
and bh, byte [ebx + ecx + 0x5a]
pop edx
ljmp 0x746:0x285909bb
add dword [ecx + 0x2f], edx
jge 0x480b3a
dec ebx
mov edx, 0x72b4b261
mov ah, 0x72
xchg esp, eax
jb 0x480af1
fnstsw word ds:[edx]
fnstsw word [edx]
cmp bh, byte [edi - 0x4f885e88]
mov edi, 0xb077a178
js 0x480adf
ja 0x480af0
xchg dword [eax - 0x4a], edx
mov bl, 0x73
xchg esp, eax
push eax
mov dh, 0xb3
jae 0x480ada
jno 0x480afe
xor cl, bl
aas
mov eax, 0xba7d9b7e
jle 0x480ae9
jge 0x480b0a
mov esp, 0x7abcbb5a
lahf
jns 0x480b16
cmp cl, ah
aaa
mov cl, 0x76
nop
jne 0x480b12
mov ah, 0x52
push edx
mov bl, 0xb5
jb 0x480afa
jb 0x480b1c
xor edi, edx
xor dword [esi - 0x44826781], esi
mov ebp, 0x7cbbbd5b
lcall 0xb335, 0xd335b337
jne 0x480b11
jne 0x480b33
mov ch, 0x53
mov ah, 0xb2
je 0x480b18
je 0x480b3a
xor al, 0xd2
xor esi, dword [ebp - 0x4a8c6a8d]
mov bl, 0x55
mov dl, 0xb4
jb 0x480b2a
jb 0x480b4c
xor dl, bh
xor dword [edi - 0x488e688f], esi
mov cl, 0x56
mov al, 0xb6
jo 0x480b3c
jo 0x480b5e
xchg ecx, edx
aaa
mov cl, 0x77
xchg ecx, eax
ja 0x480b61
mov bh, 0x51
mov bh, 0x89
jbe 0x480b3b
test dword [esi - 0x7f], esi
jbe 0x480b39
adc dword [edi - 0x30], 0x90dfb07b
mov al, 0x87
xor dword [esi + 0x75f1757d], 0xe3e135ed
mov bl, 0x47
push edi
sar byte [ebx - 0x50], 1
fist word [eax - 0x7e784f0d]
mov dh, 0x7d
jne 0x480bb7
jne 0x480bb5
xor eax, 0x47b3e3e1
xchg edx, eax
pop ebx
mov dl, 0xbf
push edx
xchg ebp, esp
dec edi
sub dword [edi + 0x31], ecx
ret 0xe239

Function at 0x4ab94b
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [edi - 0x7b41727d]
jp 0x4ab990
invalid
inc eax
xor al, 0xe3
mov edx, 0xfc13ed4f
cmc
xor edx, dword [edx - 0x35936096]
xor byte [ebx + 0x436e2075], dh
loopne 0x4ab9b6
pop edx
mov dword [0x577072c9], eax
sub byte [eax + 0x6cc98dbf], cl
or eax, 0x3fdeed9b
fidivr word [edi]
mov edx, 0x5b106055
adc ebx, dword [edx + 0x33622984]
xor ebx, ebp
popal
jp 0x4ab9c3
ret
Function at 0x4ba270
Capabilities:
Accept command line arguments
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x1b0], 1
lea ecx, [ebp - 0x19c]
push ecx
mov edx, dword [ebp - 0x1a8]
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x1a0]
push eax
push 0x2000000
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba356
cmp dword [ebp - 0x1b4], 0
je 0x4ba30a
lea edx, [ebp - 0x1ac]
push edx
mov eax, dword [0x4c7a7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 4
lea ecx, [ebp - 0x1b0]
push ecx
push 0x18
mov edx, dword [ebp - 0x1a0]
push edx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba349
mov eax, dword [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1b8], 0
je 0x4ba347
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4ba356
mov ecx, dword [ebp - 0x1a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x72fb05

Function at 0x4bb865
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4338
cmp edx, dword [eax]
je 0x4bb887
add eax, 8
inc ecx
cmp eax, 0x4c43c8
jl 0x4bb878
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4338]
jne 0x4bb9b5
mov eax, dword [0x4c8cbc]
cmp eax, 1
je 0x4bb98f
test eax, eax
jne 0x4bb8b8
cmp dword [0x4c4264], 1
je 0x4bb98f
cmp edx, 0xfc
je 0x4bb9b5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb8ef
lea eax, [ebp - 0x1a4]
push 0x4c0b60
push eax
call fcn.004bc250
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc6e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb932
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc6e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b5c
push edi
call fcn.004be5b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0b40
push eax
call fcn.004bc250
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc260
lea eax, [ebp - 0xa0]
push 0x4c0b3c
push eax
call fcn.004bc260
push dword [esi + 0x4c433c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc260
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0b14
push eax
call fcn.004be524
add esp, 0x2c
pop edi
jmp 0x4bb9b5
lea eax, [ebp + 8]
lea esi, [esi + 0x4c433c]
push 0
push eax
push dword [esi]
call fcn.004bc6e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6d701bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov edx, dword [ecx + 8]
test eax, eax
je 0x6d701c38
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov edx, dword [ebp - 0x2c]
sub esp, 8
test edx, edx
je 0x6d701c46
lea ebx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov edx, dword [ebp - 0x1c]
sub esp, 8
test byte [0x6d704048], 1
jne 0x6d701c59
mov dword [esp], esi
mov esi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
call esi
sub esp, 4
mov dword [esp], ebx
call esi
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [ebp - 0x24], 0
lea esi, [ebp - 0x28]
test edx, edx
jne 0x6d701bed
mov dword [ebp - 0x1c], 0
lea ebx, [ebp - 0x20]
test byte [0x6d704048], 1
je 0x6d701c0c
mov ecx, dword [ebp - 0x24]
mov eax, edx
mov dword [ebp - 0x30], ecx
call sym._wine_dbgstr_wn.constprop.0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, ecx
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str._x__s__s_n
mov dword [esp + 8], str.SCardAddReaderToGroupW
mov dword [esp + 4], 0x6d704048
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6d701c0c

Function at 0x6d701cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x6d704048], 1
jne 0x6d701cc0
xor eax, eax
ret 0xc
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0x10]
call sym._wine_dbgstr_wn.constprop.0
mov ebx, eax
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str._x__s__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SCardAddReaderToGroupW
mov dword [esp + 4], 0x6d704048
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret 0xc

Function at 0x6d701d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
test byte [0x6d704048], 1
jne 0x6d701d50
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
mov eax, 0x80100001
leave
ret 4
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.__Ix__stub_n
mov dword [esp + 8], str.SCardCancel
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x6d704048
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6d701d32
Function at 0x6d701d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
test byte [0x6d704048], 1
jne 0x6d701db0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
mov eax, 0x80100001
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], str.__lx__p__p__p__stub_n
mov dword [esp + 8], str.SCardEstablishContext
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], 0x6d704048
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0
jmp 0x6d701d92

Function at 0x6d701f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x6d704048], 1
jne 0x6d701f48
mov eax, 0x8010002e
ret 0x10
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], str.__Ix___s___p___p__stub_n
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
mov dword [esp + 8], str.SCardListReadersW
mov dword [esp + 4], 0x6d704048
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov eax, 0x8010002e
leave
ret 0x10
Function at 0x6d702ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6d702b3b
cmp byte [esi + ebx - 1], 0xa
je 0x6d702b0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6d704118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x10019550
Capabilities:
Encode data using xor

Disassembly:
jbe 0x100195bd
xchg esp, eax
mov al, byte [ecx + esi - 0x5c15abea]
pop esp
push eax
adc al, 0x3b
add eax, 0xc26adc1d
salc
sti
xlatb
in eax, 0xb7
xor cl, bh
push eax
stosd dword es:[edi], eax
fisttp qword [eax + ecx + 0x1bc3f7b9]
in eax, dx
in eax, dx
pushal
fsub qword [eax + 0x6a26de7]
jb 0x10019555
xor dword [esi], edx
push esp
ljmp 0x53b
imul edx, dword [ebp + 0x50], 0x983e038
sti
pop ss
out 0x45, eax
daa
loope 0x10019594
mov word [ebx], ss
mov dword [esp + edi*8 + 0x645f5137], 0x767be60b
or esp, esi
jnp 0x1001960f
adc dword gs:[ebx + 0x315f561], ebx
lcall 0xc05c, 0xbfc70e12
add eax, 0x5c119e12
test al, 0xd9
xor esp, dword [edi]
aaa
adc ebp, dword [ecx - 0x19]
dec esp
or byte [edx - 7], bl
inc eax
fidiv dword [esi + 0x50818414]
adc ebx, esi
fnstenv [0xfb6213a7]
test byte [ecx - 0x260ceeb0], al
xor eax, 0xfb6213a7
adc eax, 0xc27a952f
loope 0x10019644
enter 0x11dc, 0x77
or al, 0x80
hlt
xchg edx, eax
pop eax
int3
wait
dec edi
mov al, byte [0x4a980d7b]
xor al, 1
sahf
adc dword [0xabf4a403], ecx
rcr byte [ebx - 0x32573a4d], cl
cwde
push es
imul ebp, dword [eax + 0x5d21e23b], 1
imul edi, dword [edi + 0x7b], 0xffffffe0
imul edx, eax, 0x13
cmpsb byte [esi], byte es:[edi]
sub bh, ah
test byte [ebx - 0x5a], ah
dec esi
xchg dword [edi - 0x6119389a], edx
inc esp
lahf
add bh, 0x7a
mov ebx, eax
stc
sbb byte [esi], dl
or eax, 0x55181106
pop edi
or byte [ebx + 0x77d78038], ch
into
xchg byte [ebp - 0x6ad1ab8e], ch
test dword [0xbed45696], esi
mov ch, al
cmp eax, 0x10dc4f67
push edx
cld
invalid
Function at 0x4010cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46c004]
jne 0x4010d6
repz ret
jmp fcn.004016e5

Function at 0x4056ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004044d5
and dword [ebp - 0x14], 0
cmp dword [0x46eb38], 0
mov dword [ebp - 0x18], eax
jne 0x40575e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405806
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405806
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46eb38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46eb3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46eb40], eax
call edi
push eax
call esi
mov dword [0x46eb48], eax
test eax, eax
je 0x40575e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46eb44], eax
mov eax, dword [0x46eb44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4057b7
cmp dword [0x46eb48], ecx
je 0x4057b7
push eax
call esi
push dword [0x46eb48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4057b7
test ebx, ebx
je 0x4057b7
call edi
test eax, eax
je 0x4057ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4057ae
test byte [ebp - 8], 1
jne 0x4057b7
or dword [ebp + 0x10], 0x200000
jmp 0x4057ea
mov eax, dword [0x46eb3c]
cmp eax, dword [ebp - 0x18]
je 0x4057ea
push eax
call esi
test eax, eax
je 0x4057ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4057ea
mov eax, dword [0x46eb40]
cmp eax, dword [ebp - 0x18]
je 0x4057ea
push eax
call esi
test eax, eax
je 0x4057ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46eb38]
call esi
test eax, eax
je 0x405806
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405808
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010cc
leave
ret
Function at 0x461990
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x4619a4
call fcn.00461910
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x461997
pop esi
cmp ebx, 0x2d
jne 0x4619be
mov dword [0x85fb98], 0xa62e7790
mov dword [0x85fb9c], 0xffffffff
ret

Function at 0x4619c0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x46cdb8]
push ebx
mov ebx, dword [0x85fb8c]
push edi
mov edi, dword [0x85d70c]
call fcn.00461960
cmp dword [0x85fb8c], 0x2f
jne 0x461a2d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00461990
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010cc
add esp, 0x24
ret