joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61e8bf
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
xor eax, dword [esp]
xor eax, dword [esp]
inc esi
dec esi
jbe 0x61e8e0
cmp edi, 0x3dc
jnp 0x61e8ee
jno 0x61e8ea
jp 0x61e8ee
mov edi, 0xfc7d8332
add byte [edx - 0x73], dh
adc bh, cl
cmp dword [ebp - 4], 0
je 0x61e916
lea edx, [edx]
stc
xor edx, 0x687b
xor edx, 0x687b
jns 0x61e90f
lea esi, [esi]
mov edx, edx
mov edi, edi
js 0x61e90f
add eax, 0xfb8f0
add byte [eax], al
mov eax, 0xf
jmp 0x61e92b
add edx, 0
jbe 0x61e926
pushf
jge 0x61e91f
popf
jmp 0x61e923
ja 0x61e926
mov ebp, 0x14b8
add byte [edi + 0x5e], bl
mov eax, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61ec6f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0061511f
add esp, 0xc
lea ebx, [ebx]
jo 0x61ec94
nop
xchg ebx, ebx
js 0x61ec91
jno 0x61ec94
call 0x494a325e
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
sub edi, 0
ror esp, 0
jne 0x61ece1
lea edi, [edi + 0x60d0]
lea edi, [edi - 0x60d0]
je 0x61ece1
mov edx, 0x4d8a52d1
call 0x8863d668
dec ebp
call 0x814f4278
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
and esi, 0xffffffff
jl 0x61ed61
pushf
xchg ebx, ecx
xchg ebx, ecx
or esp, 0
or esp, 0
popf
lea ebx, [ebx]
jge 0x61ed61
mov esp, 0xff3df4e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.00612b5a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x61ed73
xor eax, eax
jmp 0x61edd9
nop
jae 0x61ed7c
jo 0x61ed78
jb 0x61ed7c
xor eax, 0xe84d8d7e
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0060bf28
mov dword [ebp - 4], eax
nop
jne 0x61ed8f
jb 0x61ed97
xchg edi, edi
nop
jae 0x61ed97
sub eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0061511f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x61edb1
xor eax, eax
jmp 0x61edd9
lea ecx, [ecx]
not ebx
not ebx
jle 0x61edbf
jle 0x61edbb
jg 0x61edbf
add eax, 0xfc4d8b9a
mov ecx, dword [ebp - 4]
push ecx
call fcn.0061266b
add esp, 4
or esp, 0
js 0x61edd6
jg 0x61edd2
jns 0x61edd6
xor eax, 0xfc55ff0a
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6235a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0061511f
add esp, 0xc
cmp edi, ebx
jne 0x6235c1
or eax, 0
jo 0x6235d2
lea ebx, [ebx]
jb 0x6235ca
jb 0x6235cc
je 0x6235ce
jno 0x6235d2
xor dword [ebx + 0x48e845c6], 0x73ed45c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
mov edx, edx
stc
je 0x62361f
ror esp, 0
jg 0x623650
pushf
lea edx, [edx + 0x2d23]
sub edx, 0x2d23
push edx
add edx, 0x95
ror edx, 0x19
pop edx
lea esi, [esi + 0x3072]
sub esi, 0x3072
popf
ja 0x62364d
jle 0x623650
call 0x814a83de
jmp 0xe8afbe5a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.00612b5a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6236f9
xor eax, eax
jmp 0x623793
lea edi, [edi]
cld
cld
jb 0x623704
mov ebx, ebx
jae 0x623704
jmp 0x514a7c95
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060bf28
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0061511f
add esp, 0xc
rol esp, 0
jle 0x623744
pushf
push ecx
add ecx, 0x5f95
ror ecx, 0xb
pop ecx
cmp esi, ebx
cmc
popf
jp 0x62373d
jl 0x62373f
jbe 0x623741
jg 0x623744
mov ebp, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x62374e
xor eax, eax
jmp 0x623793
jmp 0x623750
add esp, 0
ror eax, 0x10
ror eax, 0x10
cmp esp, 0x5457
jbe 0x623772
pushf
add eax, 0
popf
lea esp, [esp]
lea edx, [edx]
js 0x62376f
ja 0x623772
jmp 0x51467d01
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0061266b
add esp, 4
ror esp, 0
js 0x623790
jae 0x623785
jge 0x623787
jle 0x623789
jnp 0x62378b
jns 0x623790
add eax, 0x55ffed6a
in al, 0x5f
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x626cfd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x603fe4], 1
jne 0x626e5b
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0061511f
add esp, 0xc
jmp 0x626d25
call 0x626d2a
lea esp, [esp + 4]
je 0x626d4a
pushf
lea edx, [edx + 0x33be]
lea edx, [edx - 0x33be]
add ebx, 0
popf
mov edx, edx
jge 0x626d47
jne 0x626d4a
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
cmc
test ecx, 0x53f2
cmp ebx, dword [esp + 4]
ja 0x626d90
lea edi, [edi]
xchg edi, edi
jbe 0x626d90
mov esi, 0x4d8ad5cf
call 0x88645717
dec ebp
call 0x814fc327
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00612b5a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x626e05
xor eax, eax
jmp 0x626eae
rol esi, 0xf
rol esi, 0x11
ja 0x626e17
jle 0x626e0f
jno 0x626e11
xchg esp, esp
jbe 0x626e17
jmp 0xe8a7fb9b
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0060bf28
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0061511f
add esp, 0xc
xor eax, dword [esp]
xor eax, dword [esp]
jg 0x626e45
js 0x626e41
jle 0x626e45
add eax, 0xf87d8368
add byte [edx + ecx - 0x75], dh
inc ebp
clc
cmp dword [ebp - 8], 0
je 0x626e55
mov eax, dword [ebp - 8]
mov dword [0x603fe4], eax
jmp 0x626e59
xor eax, eax
jmp 0x626eae
jmp 0x626e64
mov ecx, dword [0x603fe4]
mov dword [ebp - 8], ecx
jno 0x626e66
rol esi, 0x16
ror esi, 0x16
xchg esp, esp
jo 0x626e7f
lea eax, [eax + 0x4e8e]
lea eax, [eax - 0x4e8e]
jno 0x626e7f
add eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
push eax
pop eax
jno 0x626e97
pushf
clc
jb 0x626e8e
mov ecx, ecx
popf
mov ebx, ebx
jo 0x626e97
ljmp 0xcbe8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0061266b
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x62a123
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x604064
call fcn.006243d6
add esp, 0xc
mov byte [0x604064], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x62ccfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0061511f
add esp, 0xc
cmp esp, 0x474d
jae 0x62cd1d
ja 0x62cd2e
pushf
ror ebx, 8
rol ebx, 8
popf
jge 0x62cd2b
jbe 0x62cd2e
add eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
rol edi, 0
js 0x62cd7f
pushf
ror esp, 0
test dword [esp + 4], edi
xchg ebx, edx
xchg ebx, edx
popf
ja 0x62cd7c
jns 0x62cd7f
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xchg esi, esi
ror esp, 0
jg 0x62cdf7
and esi, esi
jbe 0x62ce13
pushf
xor ecx, edx
xor ecx, edx
not edi
not edi
add edx, 0
popf
jl 0x62ce0c
jne 0x62ce0e
ja 0x62ce10
ja 0x62ce13
xor eax, 0xfe5d42e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
call fcn.00612b5a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x62ce26
jmp 0x62cedf
xchg esp, esp
add esp, 0
or esp, 0
xor ebx, dword [esp]
xor ebx, dword [esp]
jge 0x62ce4c
pushf
jbe 0x62ce3a
mov eax, eax
rol ecx, 0xa
rol ecx, 0x16
popf
nop
xchg esp, esp
xchg edx, edx
jl 0x62ce4c
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0060bf28
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0061511f
add esp, 0xc
xor ebx, 0xe14
xor ebx, 0xe14
xor ebx, 0
jl 0x62ce8e
lea ebx, [ebx + 0x4f3f]
lea ebx, [ebx - 0x4f3f]
jae 0x62ce8b
jge 0x62ce8e
mov edx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x62ce96
jmp 0x62cedf
and ecx, 0xffffffff
jne 0x62ce9b
cld
je 0x62ce9e
jle 0x62ceb4
jnp 0x62cea2
jb 0x62cea4
lea ecx, [ecx + 0x5f4b]
lea ecx, [ecx - 0x5f4b]
nop
jg 0x62ceb4
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0061266b
add esp, 4
shr esp, 0
not edx
not edx
jg 0x62ced8
pushf
jp 0x62cecd
mov ebx, ebx
popf
jbe 0x62ced3
mov ecx, ecx
jle 0x62ced8
mov esi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
je 0x40101a
adc dword [edx], esp
xor esi, dword [ebx]
sal byte [ebx + eax + 0x11], 0x22
xor eax, eax
je 0x401021
adc dword [edx], esp
xor esp, dword [ecx + 0x411cc4]
mov eax, dword [0x411cc4]
movq xmm0, qword [0x411cbc]
mov dword [ebp - 0x2c], eax
mov ax, word [0x411cc8]
mov word [ebp - 0x28], ax
mov al, byte [0x411cca]
movq qword [ebp - 0x34], xmm0
mov bl, byte [ebp - 0x34]
mov byte [ebp - 0x26], al
xor bl, 0x90
mov eax, dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
nop
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x74726956
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x10], 0x416c6175
mov dword [ebp - 0xc], 0x636f6c6c
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 4
push 0x1000
push 0xe
push 0
call eax
lea edi, [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov ecx, eax
sub edi, eax
mov esi, 0xe
mov dl, byte [edi + ecx]
lea ecx, [ecx + 1]
xor dl, bl
mov byte [ecx - 1], dl
sub esi, 1
jne 0x4010b6
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x74726956
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x506c6175
mov dword [ebp - 0x1c], 0x65746f72
mov word [ebp - 0x18], 0x7463
mov byte [ebp - 0x16], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push 0xe
push esi
call eax
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
push 0
push esi
push 0
call dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401128
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401958
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401997
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401997
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401997
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401997
cmp dword [ecx + 0x74], 0xe
jbe 0x401997
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x406209
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406254
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406426
test al, al
jne 0x40624e
sub edx, 2
cmp edx, edi
jne 0x406234
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406276
lea eax, [edi + 2]
cmp edx, eax
je 0x406276
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406155
add esp, 0x10
jmp 0x406370
push esi
lea ecx, [ebp - 0x255]
call fcn.00406426
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4062b9
push dword [ebp - 0x25c]
jmp 0x406266
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4062f6
cmp word [ebp - 0x226], 0
je 0x406317
cmp word [ebp - 0x226], ax
jne 0x4062f6
cmp word [ebp - 0x224], 0
je 0x406317
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406155
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406363
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4062d0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40634b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x406370
push 0x405f85
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00408fd0
add esp, 0x10
jmp 0x406340
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401128
leave
ret

Function at 0x407ea3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40efac
push 0x40efa4
push str.FlsAlloc
push 0x1f
call fcn.00407dde
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407ed7
push dword [ebp + 8]
mov ecx, esi
call dword [0x40d10c]
call esi
jmp 0x407edd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407f21
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40efbc
push 0x40efb4
push str.FlsGetValue
push 0x21
call fcn.00407dde
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407f58
push dword [ebp + 8]
mov ecx, esi
call dword [0x40d10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x407f60
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40efc4
push 0x40efbc
push str.FlsSetValue
push 0x22
call fcn.00407dde
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407f9a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40d10c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40ccf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40cd1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40cd1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401840
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
sub esp, 0x20
mov esi, dword [ebp + 8]
lock xadd dword [esi + 0x18], ebx
dec ebx
test byte [section..data], 8
jne 0x4018a8
test ebx, ebx
jne 0x401899
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x401875
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p____lu_n
mov dword [esp + 8], str.factory_Release
mov dword [esp + 4], 0x404000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x40185f
Function at 0x4020c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402118
cmp byte [esi + ebx - 1], 0xa
je 0x4020ec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402a10
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 0xc]
test byte [section..data], 8
jne 0x402b50
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x402c1f
mov dword [eax], sym._factory_QueryInterface_12
mov dword [eax + 4], 0x40b920
mov eax, dword [edi]
mov dword [ebx + 0x18], 1
mov dword [ebx + 8], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], 0x408084
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CoGetClassObject]
sub esp, 0x14
mov esi, eax
test eax, eax
jns 0x402ad8
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 8
mov dword [esp + 8], 4
add eax, 8
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
sub esp, 0x14
mov esi, eax
test eax, eax
js 0x402abe
mov eax, dword [ebp + 8]
mov dword [eax + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov edx, dword [ebp + 8]
sub esp, 0x10
mov dword [edx + 0xc], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
test edi, edi
je 0x402c18
mov eax, edi
shr eax, 0x10
je 0x402c00
movzx eax, byte [edi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.__p__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.surrogate_LoadDllServer
mov dword [esp + 4], 0x404000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x402a29
movzx eax, di
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
jmp 0x402bc5
mov eax, str._null_
jmp 0x402bc5
mov esi, 0x8007000e
jmp 0x402ac9