joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404032
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push SysReAllocString
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x404d93
push 0
push dword [ebp - 0x66c]
call dword [ebp - 0x33c]
mov dword [ebp - 0x378], eax
push dword [ebp - 0x378]
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
call fcn.00402c00
pop ebx
sbb dl, byte [edi + 0x62]
and byte [ebp - 0x6dc], 0
and byte [ebp - 0x6db], 0
mov byte [ebp - 0x6da], 0x2c
and byte [ebp - 0x6d9], 0
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.00402c00
sbb dword [edx + ebx*2 + 0x64], ecx
pop edx
lea eax, fs:[ebp - 0x6dc]
push eax
call fcn.00402c10
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402bc5
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x404d93
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00402b71
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x40400d
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x404056
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
or eax, 0xfffffc6c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x404000
call fcn.00402c00
imul ebp, dword [edi + 0x38], 0x30
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00402c00
sbb byte [edx - 0x50], bl
invalid

Function at 0x404dae
Capabilities:
Access peb ldr_data

Disassembly:
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x404dc4
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00402c00
mov fs, eax
mov eax, 0x8bf88b8b
inc edi
cmp al, 0x8b
push esp
pop es
js 0x404dde
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00402c00
invalid
Function at 0x8de17c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de182
pop ebp
sub ebp, 6
sub ebp, 0x4de17c
jmp 0x8de1e0
jmp 0x8de1e9
mov eax, 0x4de17c
add eax, ebp
add eax, 0x93
mov ecx, 0x63b
mov edx, 0x70c75fa8
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de200
jmp 0x8de213
ret 0xc0e8

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x427035
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1000
mov eax, 0x400000
mov ecx, 0x1000
mov edx, 0x400000
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x84], edx
call 0x427035
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 0xac], eax
mov eax, dword [eax]
test eax, eax
je 0x427045
leave
jmp eax
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 0x15]
add eax, dword [ebp - 0x7c]
mov dword [ebp - 0xa8], eax
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
mov dword [edx], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 0x41]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 0x45]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xa4], 0x6e72656b
mov dword [ebp - 0xa0], 0x32336c65
mov dword [ebp - 0x9c], 0x6c6c642e
and dword [ebp - 0x98], 0
lea eax, [ebp - 0xa4]
push eax
call dword [ebp - 0xcc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa4], 0x74726956
mov dword [ebp - 0xa0], 0x416c6175
mov dword [ebp - 0x9c], 0x636f6c6c
and dword [ebp - 0x98], 0
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x20]
call dword [ebp - 0xc8]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xa4], 0x74726956
mov dword [ebp - 0xa0], 0x506c6175
mov dword [ebp - 0x9c], 0x65746f72
mov dword [ebp - 0x98], 0x7463
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x20]
call dword [ebp - 0xc8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xa4], 0x74726956
mov dword [ebp - 0xa0], 0x466c6175
mov dword [ebp - 0x9c], 0x656572
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x20]
call dword [ebp - 0xc8]
mov dword [ebp - 0xc0], eax
push 0x4d
push dword [ebp - 0xb8]
lea eax, [ebp - 0x78]
push eax
call fcn.00427a0d
add esp, 0xc
push 4
push 0x1000
mov eax, dword [ebp - 0xb8]
push dword [eax + 5]
push 0
call dword [ebp - 0xc4]
mov dword [ebp - 8], eax
and dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xb8]
jmp 0x428277
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x407140
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x28
mov ecx, dword [0x412120]
nop
push ebx
push esi
push edi
push ebp
push 0xf1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
push eax
mov ecx, dword [0x412120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov dword [esp + 0x14], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edi, eax
test edi, edi
jne 0x407188
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 4]
mov ebx, dword [esp + 0x3c]
shl eax, 0x10
mov cx, word [edi + 2]
or eax, ecx
push eax
push 0
push 0x420
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
push 0x160018
push 0
push 0x41f
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
push 0
push 0
push 0x418
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
lea esi, [eax - 1]
test eax, eax
je 0x4071ed
push 0
push 0
push 0x416
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
mov eax, esi
dec esi
test eax, eax
jne 0x4071d6
xor ebp, ebp
push 0x415630
push 1
mov dword [0x415634], ebp
mov byte [0x415638], 4
mov byte [0x415639], 1
mov dword [0x415630], 4
push 0x414
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
cmp word [edi + 6], bp
mov dword [esp + 0x10], ebp
jbe 0x40729d
lea esi, [edi + 8]
xor eax, eax
mov ecx, dword [0x415634]
mov byte [0x415638], 4
mov ax, word [esi]
cmp eax, ecx
jne 0x407246
inc ebp
jmp 0x407283
mov dword [0x415634], eax
test eax, eax
je 0x40725f
mov byte [0x415639], 0
mov dword [0x415630], ebp
inc ebp
jmp 0x407270
mov byte [0x415639], 1
mov dword [0x415630], 4
push 0x415630
push 1
push 0x414
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
add esi, 2
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
xor eax, eax
mov ax, word [edi + 6]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jg 0x40722d
mov eax, 4
push 0x415630
push 1
mov byte [0x415638], al
push 0x414
mov dword [0x415630], eax
mov byte [0x415639], 1
mov dword [0x415634], 0
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
push 0
push 0
push 0x418
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
mov eax, dword [esp + 0x40]
mov ecx, dword [0x412120]
push eax
mov ebp, dword [sym.imp.USER32.dll_Ordinal_409]
push ecx
call ebp
mov esi, eax
mov ebp, dword [sym.imp.GDI32.dll_Ordinal_282]
lea eax, [esp + 0x20]
push eax
push 0x18
push esi
call ebp
mov ecx, dword [0x412120]
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
push ecx
xor ecx, ecx
cdq
mov cx, word [edi + 2]
idiv ecx
push eax
push 0x413
push ebx
call dword [sym.imp.USER32.dll_Ordinal_513]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x65142570
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov eax, dword [ecx + 0x828]
and eax, 0x10
je 0x65142600
lea esi, [ecx + 0x410]
cmp word [ecx + 0x410], 0
mov edx, esi
je 0x651425a9
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x651425a0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x651425b0
test byte [0x65157028], 8
jne 0x65142690
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
sub esp, 0xc
test byte [0x65157028], 8
jne 0x65142650
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [ecx], 0
mov ebx, ecx
mov edx, ecx
je 0x65142620
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x65142610
lea esi, [esi]
movzx esi, word [edi + eax]
mov word [edx + eax], si
add eax, 2
test si, si
je 0x65142588
movzx esi, word [edi + eax]
mov word [edx + eax], si
add eax, 2
test si, si
jne 0x65142620
jmp 0x65142588
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.got__d_with__lu_n
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.apd_copyfile
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
shr eax, 0x10
je 0x65142738
mov dword [esp + 4], 0xffffffff
mov edi, str._invalid_
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x651426c6
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn.part.0
mov edi, eax
test ebx, ebx
je 0x6514276d
mov eax, ebx
shr eax, 0x10
je 0x65142758
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65142704
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s____s_n
mov dword [esp + 8], str.apd_copyfile
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x651425cd
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov edi, eax
jmp 0x651426c6
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65142704
mov eax, str._null_
jmp 0x65142704
Function at 0x65142780
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
lea ebx, [eax + 4]
sub esp, 0x6c
mov dword [ebp - 0x4c], edx
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x65142920
sub eax, ebx
sar eax, 1
mov edx, eax
test edx, edx
je 0x651428cf
test byte [0x65157028], 8
jne 0x65142838
mov eax, edx
neg eax
cmp edx, 0xf
ja 0x6514282a
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x651427f8
lea eax, [edx + edx]
cmp eax, 4
jae 0x651428e0
test eax, eax
je 0x651427ef
movzx ecx, byte [esi + 4]
mov byte [edi], cl
test al, 2
jne 0x65142930
mov ecx, dword [ebp - 0x4c]
xor esi, esi
mov word [ecx + eax], si
lea eax, [ebp - 0x3c]
lea esi, [ebp - 0x38]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x3c], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
mov edx, dword [ebp - 0x4c]
sub esp, 8
test eax, eax
je 0x65142828
cmp edx, dword [ebp - 0x3c]
je 0x651428b0
mov eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
shr eax, 0x10
je 0x65142900
mov dword [esp + 4], edx
mov dword [ebp - 0x50], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x50]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x6514286e
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
mov edx, dword [ebp - 0x50]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.found__s_n
mov dword [esp + 8], str.copy_servername_from_name
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
mov dword [ebp - 0x50], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x50]
mov eax, edx
neg eax
cmp edx, 0xf
jbe 0x651427ca
jmp 0x6514282a
mov dword [esp + 8], edx
mov dword [ebp - 0x4c], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov edx, dword [ebp - 0x4c]
test eax, eax
jne 0x65142828
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + eax - 4]
mov edi, dword [ebp - 0x4c]
mov esi, ebx
mov dword [edi + eax - 4], ecx
lea ecx, [eax - 1]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x651427ef
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
mov dword [ebp - 0x50], edx
call sym._wine_dbg_sprintf.constprop.0_1
mov edx, dword [ebp - 0x50]
jmp 0x6514286e
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edx, eax
jmp 0x651427b0
movzx ecx, word [ebx + eax - 2]
mov edi, dword [ebp - 0x4c]
mov word [edi + eax - 2], cx
jmp 0x651427ef
Function at 0x65143310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6514336b
cmp byte [esi + ebx - 1], 0xa
je 0x6514333f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x65157238], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6514a0c0
Capabilities:
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
test byte [0x65157028], 8
jne 0x6514a110
test ebx, ebx
je 0x6514a0f1
cmp dword [ebx], 4
je 0x6514a150
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._p__p__lu__p_n
mov dword [esp + 8], str.fpReadPrinter
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
mov dword [ebp - 0x1c], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x1c]
jmp 0x6514a0e8
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
Function at 0x6514bf90
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
test byte [0x65157028], 8
jne 0x6514c030
test ebx, ebx
je 0x6514bfcc
mov eax, dword [ebx]
cmp eax, 3
je 0x6514c090
cmp eax, 1
je 0x6514bff0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6514c070
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___p___ld___p__n
mov dword [esp + 8], str.fpWritePrinter
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
mov dword [ebp - 0x1c], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x1c]
jmp 0x6514bfb8
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xbbb
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebx + 4]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 8]
mov dword [esp], edx
call dword [eax + 0x28]
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
Function at 0x6514dda0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov edi, dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
add eax, 0x1a
sub esp, 8
cmp eax, esi
jbe 0x6514dde0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
mov esi, eax
lea eax, [eax + 0x7fffffff]
sub esp, 8
cmp word [ebx + eax*2], 0x5c
lea edx, [eax + eax]
je 0x6514de09
mov eax, 0x5c
inc esi
mov word [ebx + edx + 2], ax
lea edx, [esi + esi]
lea eax, [ebx + edx]
mov dword [eax], 0x700073
mov dword [eax + 4], 0x6f006f
mov dword [eax + 8], 0x5c006c
mov dword [eax + 0xc], 0x520050
mov dword [eax + 0x10], 0x4e0049
mov dword [eax + 0x14], 0x450054
mov dword [eax + 0x18], 0x530052
mov dword [eax + 0x1c], 0x5c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str._05d.SPL
mov dword [esp + 0xc], eax
lea eax, [ebx + edx + 0x1e]
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sym._swprintf
lea esp, [ebp - 0xc]
lea eax, [esi + 0x19]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6514eba0
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x30], eax
test byte [0x65157018], 8
jne 0x6514ecf0
mov eax, dword [ebx + 8]
cmp eax, 4
jbe 0x6514ecb0
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
mov edi, edx
or edi, ecx
je 0x6514ec30
cmp eax, 7
jne 0x6514ec50
mov edi, dword [ebx + 0x10]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edi
je 0x6514ec50
test byte [0x65157018], 1
jne 0x6514ed30
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x2c]
mov ebx, dword [0x65157074]
mov dword [ebp - 0x28], ecx
mov ecx, dword [0x65157070]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], edx
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
call dword [0x65157068]
mov ecx, 0
mov edi, dword [ebp - 0x30]
sub esp, 0x10
test eax, eax
cmove esi, ecx
mov dword [edi], esi
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__lu__p__n
mov dword [esp + 8], str.localmon_WritePort
mov dword [esp + 4], 0x65157018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6514ebd2
mov dword [esp + 0xc], str.used_from_other_thread_n
mov dword [esp + 8], str.localmon_WritePort
mov dword [esp + 4], 0x65157018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6514ec0a