joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3b52f20
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x3b52fc0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x3b58270
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x3b61850
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.03b29820
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.03b29820
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x3b87748]
test eax, eax
je 0x3b58328
cmp ebp, eax
jne 0x3b58328
mov eax, dword [0x3b8774c]
test eax, eax
je 0x3b58328
cmp ebx, eax
jb 0x3b58328
add eax, 0x493e0
cmp eax, ebx
jb 0x3b58328
mov ebp, dword [0x3b87750]
push 1
inc ebp
push 0x3b87668
lea ecx, [esp + 0x18]
mov dword [0x3b87750], ebp
call fcn.03b2a6e0
push 0x3b87698
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.03b29a00
push 0x3b87688
mov ecx, edi
call fcn.03b29a00
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x3b5839e
push edi
push esi
mov dword [0x3b87750], 0
call fcn.03b583c0
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x3b87668
call fcn.03b2a6e0
push 0xffffffffffffffff
push 0
mov ecx, 0x3b87698
mov dword [esp + 0x38], 1
mov dword [0x3b87748], ebp
mov dword [0x3b8774c], ebx
call fcn.03b29820
push esi
mov ecx, 0x3b87698
call fcn.03b29a00
push 0xffffffffffffffff
push 0
mov ecx, 0x3b87688
call fcn.03b29820
push edi
mov ecx, 0x3b87688
call fcn.03b29a00
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.03b2a710
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x3b583c0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x3b61876
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.03b29820
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.03b29820
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x3b584f9
mov edx, dword [0x3b83368]
mov cx, word [0x3b8336c]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.03b27510
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.03b29d60
mov edx, dword [0x3b63300]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.03b27b50
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.03b29d60
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.03b27960
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.03b27960
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x3b5841b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x3b5cd20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.03b2d0e0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x3b5ce74
cmp ebx, 0x80
jg 0x3b5ce74
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.03b5d630
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x3b5cdb7
test ebp, ebp
jle 0x3b5ce05
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x3b5cda4
jmp 0x3b5ce01
xor esi, esi
test ebp, ebp
jle 0x3b5ce05
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x3b5cde7
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x3b5cde3
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x3b5ce14
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x3b5ce45
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x3b5ce5c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x3b5ce58
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40c470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c488
mov eax, 1
add ebx, ebx
jne 0x40c4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4a0
jne 0x40c4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4a0
xor ecx, ecx
sub eax, 3
jb 0x40c4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c542
mov ebp, eax
add ebx, ebx
jne 0x40c4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c50c
inc ecx
add ebx, ebx
jne 0x40c4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c4ed
jne 0x40c509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c51d
jmp 0x40c48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c52c
add edi, ecx
jmp 0x40c48e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c54a
cmp byte [edi], 1
jne 0x40c54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c54f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd70c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c57c
mov ecx, edi
jns 0x40c5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd74c]
or eax, eax
je 0x40c5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c599
call dword [esi + 0xd750]
popal
jmp 0x401128

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10001e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov esi, dword [0x10009004]
test esi, esi
je 0x10001e98
mov ecx, dword [section..bss]
test ecx, ecx
je 0x10001f09
mov eax, esi
xor edx, edx
jmp 0x10001e50
inc edx
add eax, 0xc
cmp edx, ecx
je 0x10001e60
cmp ebx, dword [eax + 2]
jne 0x10001e48
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
cmp edx, 0x154
ja 0x10001ed8
lea eax, [edx + edx*2]
inc edx
lea esi, [esi + eax*4]
mov eax, 0x100014e4
mov word [esi], 0x6858
sub eax, esi
mov dword [esi + 2], ebx
mov dword [esi + 8], eax
mov word [esi + 6], 0xe950
mov dword [section..bss], edx
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x1000
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov esi, eax
mov dword [0x10009004], eax
test eax, eax
jne 0x10001e34
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [0x10005430], 1
je 0x10001ecf
mov dword [esp + 0xc], str.all_hooks_are_in_use_n
mov dword [esp + 8], str.alloc_hook
mov dword [esp + 4], 0x10005430
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x10001ed1
mov edx, 1
jmp 0x10001e6f
Function at 0x10003b10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x58
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10003cc8
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x4a], 0x42
and eax, 0xfffc0fff
mov dword [ebp - 0x36], eax
xor eax, eax
mov ax, word [ebx + 4]
mov dword [ebp - 0x46], eax
xor eax, eax
mov ax, word [ebx + 6]
call dbg.global_handle_from_16
mov dword [ebp - 0x42], eax
xor eax, eax
mov ax, word [ebx + 8]
call dbg.global_handle_from_16
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x3e], eax
mov ax, word [ebx + 0x18]
mov dword [ebp - 0x32], edx
mov word [ebp - 0x2a], ax
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x2e], edx
test eax, 0x3c000
je 0x10003c3f
test byte [0x10005450], 1
jne 0x10003c18
test ah, 0x10
je 0x10003c7f
lea esi, [esi]
cmp dword [ebx], 0x34
je 0x10003ba4
mov esi, dword [ebp - 0x4a]
dec esi
mov dword [ebp - 0x4a], esi
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call dword [sym.imp.comdlg32.dll_PrintDlgA]
mov esi, eax
test eax, eax
push ecx
je 0x10003bf0
mov eax, dword [ebp - 0x3a]
mov edx, dword [ebp - 0x3e]
mov word [ebx + 0xa], ax
test edx, edx
je 0x10003bcd
lea eax, [ebx + 8]
call sym._global_handle_to_16.part.0
mov edx, dword [ebp - 0x42]
test edx, edx
je 0x10003bdc
lea eax, [ebx + 6]
call sym._global_handle_to_16.part.0
mov eax, dword [ebp - 0x32]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x2e]
mov dword [ebx + 0x14], eax
mov ax, word [ebp - 0x2a]
mov word [ebx + 0x18], ax
mov eax, dword [ebp - 0x3e]
mov ebx, dword [sym.imp.kernel32.dll_GlobalFree]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0x42]
mov dword [esp], eax
call ebx
mov eax, esi
push edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0xc], str.custom_templates_no_longer_supported__using_default_n
mov dword [esp + 8], str.PrintDlg16
mov dword [esp + 4], 0x10005450
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_3
mov eax, dword [ebx + 0xc]
test ah, 0x10
je 0x10003c7f
test byte [0x10005450], 1
je 0x10003b98
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], str.custom_print_hook__p_no_longer_supported_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.PrintDlg16
mov dword [esp + 4], 0x10005450
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_3
mov eax, dword [ebx + 0xc]
test ah, 0x20
je 0x10003b98
test byte [0x10005450], 1
je 0x10003b98
mov eax, dword [ebx + 0x24]
mov dword [esp + 0xc], str.custom_setup_hook__p_no_longer_supported_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.PrintDlg16
mov dword [esp + 4], 0x10005450
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_3
jmp 0x10003b98
mov dword [esp], 0
call dword [sym.imp.comdlg32.dll_PrintDlgA]
push edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x10003ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x10003f08
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x10003f00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x10003eca
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x10004480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x100090b4]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x10004668
mov dword [esp], esi
call dword [0x100090b4]
mov cl, byte [ebp + 8]
and eax, 0xff
sar eax, cl
test al, 1
je 0x100046c8
mov edi, dword [0x100090a4]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edi
je 0x10004658
test byte [0x10005468], 8
jne 0x100045e0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10005478], 8
jne 0x10004598
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
mov dword [esp], edi
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10004519
cmp dword [ebp + 8], 3
jbe 0x10004558
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
add eax, edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 8]
inc esi
mov dword [esp + 8], str._s:_s:_s
mov edx, dword [ecx*4 + 0x100076e0]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
mov dword [esp], eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10004519
mov ecx, dword [0x100090b4]
test ecx, ecx
je 0x100046a8
mov dword [esp], 0x10005478
call dword [0x100090b4]
test al, 8
je 0x100044ef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str._04x:
call dbg.sprintf
add edi, eax
jmp 0x100044ef
mov ebx, dword [0x100090b4]
test ebx, ebx
je 0x10004688
mov dword [esp], 0x10005468
call dword [0x100090b4]
test al, 8
je 0x100044da
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ebx, 0x10624dd3
mov ecx, eax
mov dword [esp + 4], str._3u._03u:
mul ebx
mov eax, edx
mov edx, ecx
shr eax, 6
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
sub edx, eax
mov eax, ecx
mov dword [esp + 0xc], edx
mul ebx
shr edx, 6
lea ebx, [ebp - 0xd4]
mov dword [esp + 8], edx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x100044e2
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100090b4
call sym._load_func.part.0
jmp 0x1000449d
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100090b4
call sym._load_func.part.0
jmp 0x100045ee
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100090b4
call sym._load_func.part.0
jmp 0x100045a6
or eax, 0xffffffff
jmp 0x1000454a
Function at 0x796c90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x249000]
push edi
or ebp, 0xffffffff
jmp 0x796cb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x796cb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x796ca8
mov eax, 1
add ebx, ebx
jne 0x796ccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x796cdc
jne 0x796cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x796cfb
dec eax
add ebx, ebx
jne 0x796ce8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x796cc0
add ebx, ebx
jne 0x796cf7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x796d4d
xor ecx, ecx
sub eax, 3
jb 0x796d13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x796d82
sar eax, 1
mov ebp, eax
jmp 0x796d1e
add ebx, ebx
jne 0x796d1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x796cec
inc ecx
add ebx, ebx
jne 0x796d2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x796cec
add ebx, ebx
jne 0x796d39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x796d2e
jne 0x796d4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x796d2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x796d6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x796d5e
jmp 0x796cae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x796d6c
add edi, ecx
jmp 0x796cae
pop esi
mov edi, esi
mov ecx, 0xd77c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x796d8a
cmp byte [edi], 0x8c
jne 0x796d8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x796d8f
lea edi, [esi + 0x392000]
mov eax, dword [edi]
or eax, eax
je 0x796e07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3af754]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3af8a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x796dbc
mov ecx, edi
jns 0x796deb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3af8ac]
or eax, eax
je 0x796e01
mov dword [ebx], eax
add ebx, 4
jmp 0x796dd9
call dword [esi + 0x3af8b4]
mov ebp, dword [esi + 0x3af8b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x796e3b
sub esp, 0xffffff80
jmp 0x584dfd
Function at 0x1000ffd3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010012
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010012
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010012
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10010012
cmp dword [ecx + 0x74], 0xe
jbe 0x10010012
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10012c8f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10012d2c
push ebx
push esi
call fcn.10012c58
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10012bec
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012cd9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012d2b
push edi
push eax
call fcn.10013c4a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012cf9
call fcn.10011734
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012d2a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10012bec
add esp, 0x20
test eax, eax
jne 0x10012d18
push edi
call fcn.10011734
jmp 0x10012d20
push ebx
call fcn.10011734
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012f99
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a888
push 0x1001a880
push str.FlsAlloc
push 0x1f
call fcn.10012eb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012fcd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019150]
call esi
jmp 0x10012fd3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10013017
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a898
push 0x1001a890
push str.FlsGetValue
push 0x21
call fcn.10012eb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001304e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10013056
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a8a0
push 0x1001a898
push str.FlsSetValue
push 0x22
call fcn.10012eb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013090
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10019150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10018720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001874d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001874d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret