joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x3c]
mov edi, dword [ebp + 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x34], eax
test byte [section..data], 8
jne 0x402302
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x18]
add esp, 0x58
pop ebx
pop esi
pop edi
pop ebp
jmp sym._create_serviceW.isra.9
mov eax, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
call sym._wine_dbgstr_wn.constprop.13
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
call sym._wine_dbgstr_wn.constprop.13
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
call sym._wine_dbgstr_wn.constprop.13
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str.__s___s__0x_lx___s__n
mov dword [esp + 8], global___func__.17
mov dword [esp + 4], 0x417000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.16
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
jmp 0x4022ad
Function at 0x404340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x3c]
mov edi, dword [ebp + 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x34], eax
test byte [section..data], 8
jne 0x4043f2
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x38], 1
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x18]
add esp, 0x58
pop ebx
pop esi
pop edi
pop ebp
jmp sym._create_serviceW.isra.9
mov eax, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
call sym._wine_dbgstr_wn.constprop.13
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
call sym._wine_dbgstr_wn.constprop.13
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
call sym._wine_dbgstr_wn.constprop.13
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str.__s___s__0x_lx___s__n
mov dword [esp + 8], global___func__.56
mov dword [esp + 4], 0x417000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.16
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
jmp 0x40439d
Function at 0x405190
Capabilities:
Contain obfuscated stackstrings
Listen for remote procedure calls

Disassembly:
push ebp
xor eax, eax
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x40
mov dword [ebp - 0x30], 0x63006e
mov dword [ebp - 0x2c], 0x630061
mov dword [ebp - 0x28], 0x5f006e
mov dword [ebp - 0x24], 0x70006e
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], 0x70005c
mov dword [ebp - 0x1a], 0x700069
mov dword [ebp - 0x16], 0x5c0065
mov dword [ebp - 0x12], 0x760073
mov dword [ebp - 0xe], 0x630063
mov dword [ebp - 0xa], 0x6c0074
mov word [ebp - 6], dx
call dword [sym.imp.kernel32.dll_CreateThreadpoolCleanupGroup]
mov dword [section..bss], eax
test eax, eax
je 0x4052a0
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerUseProtseqEpW]
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x405240
test byte [section..data], 2
jne 0x405324
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x417188]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerRegisterIf]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4052c0
test byte [section..data], 2
je 0x405235
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerRegisterIf_failed_with_error__lu_n
mov dword [esp + 8], global___func__
mov dword [esp + 4], 0x417000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.16
jmp 0x405235
test byte [section..data], 2
jne 0x405353
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4d2
mov dword [esp], 1
call dword [sym.imp.rpcrt4.dll_RpcServerListen]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x405390
test byte [section..data], 2
je 0x405235
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerListen_failed_with_error__lu_n
mov dword [esp + 8], global___func__
mov dword [esp + 4], 0x417000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.16
jmp 0x405235
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerUseProtseq_failed_with_error__lu_n
mov dword [esp + 8], global___func__
mov dword [esp + 4], 0x417000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.16
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], 0x4194b8
mov dword [esp + 8], global___func__
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x417000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.16
jmp 0x4052ad
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x41c180
mov dword [esp + 4], 0x3e8
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
sub esp, 0x10
jmp 0x405235
Function at 0x405580
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x1c
test ecx, ecx
je 0x4055f0
cmp word [ecx], 0
mov esi, ecx
mov ebx, 2
je 0x4055c1
lea esi, [esi]
mov ebx, esi
add ebx, 2
cmp word [ebx], 0
jne 0x4055a2
sub ebx, esi
sar ebx, 1
lea esi, [esi + ebx*2 + 2]
cmp word [esi], 0
jne 0x4055a0
sub esi, ecx
sar esi, 1
lea ebx, [esi + esi + 2]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [ebp - 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xc]
sub esp, 8
cmp eax, 2
cmove eax, ecx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4058c0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c
test ecx, ecx
je 0x405911
cmp word [ecx], 0
mov ebx, ecx
je 0x405932
add ebx, 2
cmp word [ebx], 0
jne 0x4058d3
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx + ebx + 2]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov ebx, dword [ebp - 4]
sub esp, 0x18
leave
ret
mov dword [ebp - 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
sub esp, 8
cmp eax, 2
leave
cmove eax, ecx
ret
mov ebx, 2
jmp 0x4058e4
Function at 0x4063b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 8]
lea esi, [edi + 0x18]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lock sub dword [ebx + 0xc], 1
jne 0x4063dc
mov eax, dword [ebx + 0x74]
test eax, eax
jne 0x4063f0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
sub esp, 8
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov dword [ebx + 4], 0
mov dword [ebx], 0
mov dword [esp], ebx
call dbg.free_service_entry
jmp 0x4063dc

Function at 0x406580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, dword [esi + 8]
lea eax, [edi + 0x18]
add edi, 0x10
mov dword [ebp - 0x10], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ebx, dword [edi]
sub esp, 8
cmp edi, ebx
jne 0x4065c9
jmp 0x4065ee
mov ebx, dword [ebx]
cmp ebx, edi
je 0x4065ee
cmp dword [ebx + 0x68], esi
jne 0x4065c3
mov dword [ebx + 0x18], 1
mov dword [ebx + 0x68], 0
sub dword [esi + 0x10], 1
mov dword [esp], esi
call dbg.release_process
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x4065c9
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408120
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x10]
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [eax], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x4081d1
mov edi, eax
cmp eax, 2
je 0x408260
xor ecx, ecx
test byte [0x417080], 2
jne 0x408195
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], global___func__.44
mov dword [esp + 4], 0x417080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
mov ecx, dword [ebp - 0x18]
jmp 0x408182
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x4081f0
cmp eax, 2
jne 0x4081e5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x4081f0
mov edi, 0x70c
jmp 0x408177
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x1c], eax
call eax
mov dword [esp + 0xc], esi
mov ecx, eax
lea eax, [ebp - 0x14]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x18]
sub esp, 0x18
test eax, eax
mov edi, eax
jne 0x408179
mov eax, dword [ebp - 0x14]
xor edx, edx
and eax, 0xfffffffe
cmp dword [ebp - 0x10], 2
mov word [ecx + eax], dx
je 0x408270
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov dword [esp], ecx
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
test eax, eax
mov ebx, eax
mov dword [ebp - 0x14], eax
jne 0x4082b0
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
jmp 0x408179
lea eax, [eax + eax]
mov dword [ebp - 0x18], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [ebp - 0x1c], eax
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x40818b
Function at 0x4082f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x14]
lea esi, [ebp - 0x10]
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [ebp - 0x18], eax
call eax
sub esp, 0x18
test eax, eax
je 0x4083b0
mov ebx, eax
xor edx, edx
cmp eax, 2
je 0x408450
test byte [0x417080], 2
jne 0x408370
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], global___func__.25
mov dword [esp + 4], 0x417080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
mov edx, dword [ebp - 0x18]
jmp 0x408354
mov eax, dword [ebp - 0x10]
cmp eax, 7
je 0x4083e0
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4083c4
cmp eax, 1
je 0x4083e0
mov ebx, 0x70c
xor edx, edx
test byte [0x417080], 2
je 0x408354
jmp 0x408370
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x14], edi
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
call eax
mov edx, dword [ebp - 0x1c]
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x40834b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
xor esi, esi
xor edx, edx
and eax, 0xfffffffe
mov word [ecx + eax], dx
mov word [ecx + eax + 2], si
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 2
xor ebx, ebx
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea edx, [ebp - 0x10]
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 4
mov dword [eax], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x408521
cmp eax, 2
je 0x408542
test byte [0x417080], 2
jne 0x4084e5
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], global___func__.8
mov dword [esp + 4], 0x417080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0xc]
sub eax, 3
cmp eax, 1
ja 0x408532
cmp dword [ebp - 0x10], 4
je 0x4084dc
mov ebx, 0x70c
test byte [0x417080], 2
je 0x4084dc
jmp 0x4084e5
lea esp, [ebp - 8]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x414760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x4147b8
cmp byte [ebx + esi - 1], 0xa
je 0x41478c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x41c164], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x414dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x414f94
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x41c164]
cmp dword [edx + 0x24], edi
je 0x414eb7
test byte [0x4171a8], 8
jne 0x414f40
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x4171b8], 8
jne 0x414f03
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x414e59
cmp esi, 3
jbe 0x414ec2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x414e6a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x41b7a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x414e59
mov dword [esp], 0x4171b8
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x414e30
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x414e30
mov dword [esp], 0x4171a8
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x414e1b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x414e23
mov eax, 0xffffffff
jmp 0x414eb7

Function at 0x415230
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___argv
mov esi, dword [eax]
call sym.__get_initial_narrow_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0xdea4d0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdea4da
pushal
call 0xdea4e0
pop ebp
sub ebp, 0x10
sub ebp, 0x9ea4d0
jmp 0xdea4f6
mov eax, 0x9ea4d0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0x3a3b1d22
xor byte [eax], dl
inc eax
dec ecx
jne 0xdea50d
jmp 0xdea520
test eax, 0x1eaba9ef
and ah, byte [edx]
and ah, byte [ebx + 0x2222dae3]
and ah, byte [ecx]
out dx, eax
lcall 0xa98, 0x22222226
and ah, byte [edx]
and dl, ch
shl byte [ecx], 0xea
test eax, 0x22222ea3
and ah, byte [ecx]
out 0xaf, eax
inc esi
push es
fisubr word [ebx + 0x4a720626]
fisub dword [edi]
add ah, byte [edx]
dec edx
hlt

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx