joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3e9c
Capabilities:
Encode data using xor

Disassembly:
rol byte [edx], 0x89
jle 0x5a3f14
pop edi
adc al, 0x46
xor byte [esi + 0x5b], bl
pop ss
ret 8
invalid
xor eax, 0x468b174e
movsd dword es:[edi], dword [esi]
jns 0x5a3f14
dec edi
ror dword [ebx - 0x2fd403b5], 0x8d
dec ebx
cld
sub edx, eax
lea edi, [ebp + 0x34808901]

Function at 0x5b5852
Capabilities:
Encode data using xor

Disassembly:
add dword [esi - 0x75], edx
jno 0x5b579f
add eax, 0x7708d61a
adc al, 0x8b
or eax, ebp
jmp 0x5b5786
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1d]
push esi
mov edx, dword [edi + 0x74fffae6]
pop esi
add byte [ebp + 8], al
sub eax, 0
je 0x5b5822
sub eax, 1
je 0x5b57f8
invalid

Function at 0x5be146
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x10]
mov bl, 0x8d
call 0x29d9dc
or ebx, eax
push 8
push 0x657f88
call 0x7b597190
mov eax, dword [ebp + 8]
push dword [eax]
aad 0xc4
idiv bh
call dword [ebp - 0x7d]
push 0x458b00fc
or al, 0x8b
add byte [ebx + 0x489b8b00], ah
dec eax
test dword [eax + ebx*8 - 0x377ce8], ecx
xor dword [edx + 0x38], esi
add dword [edi + 0x30f8810f], esp
sub esp, dword [ebp]
je 0x5be193
je 0x5be176
xchg edi, eax
add eax, 0xc7590000
inc ebp
invalid
mov dword [ebp - 0xd], 0xffff5afe
call 0x3b54e1b1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0xb100fae6], ecx
pop ecx
cmpsb byte [esi], byte es:[edi]
pop esi
pop ebx
leave
ret 0xc

Function at 0x5be822
Capabilities:
Encode data using xor

Disassembly:
call fcn.0059b090
and dword [ebp - 0x43], 0
mov eax, dword [ebp + 8]
mov dword [0xeff7e80f], eax
stosb byte es:[edi], al
call [ecx + 1]
cld
add byte [edx + 0x8b7645], dh
xor byte [esi], ah
push ds
xlatb
jns fcn.005be822
pop ecx
mov dword [0x7b1658], eax
outsd dx, dword [esi]
add dword [ebx], esi
pop ebx
add bh, bh
adc eax, 0x5e2665
mov esi, eax
mov eax, dword [0x65eb68]
mov dword [0x66d058], eax
outsb dx, byte [esi]
jne 0x5be84c
mov dword [ebp - 4], 0xffff33fe
call 0x92e914
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
mov esp, 0xc2c95b5e
or al, 0
mov esi, dword [ebp - 0x1c]
std
jb fcn.005be8e0
xor esi, dword [ecx]
call 0xffe9d874
pop ecx
ret

Function at 0x5c3670
Capabilities:
Encode data using xor
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call 0xf5be3e8
in eax, dx
jne 0x5c3688
invalid
into

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x408ecc
mov ecx, 0x75680d3c
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3aaf3ced
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7d3873b8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x5d263551
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3c6137b7
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2efb22c1
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x406024
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406048
xor eax, eax
test eax, eax
je 0x40605a
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40605a
xor ecx, ecx
jmp 0x40605d
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406107
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42229c], 0
push esi
jne 0x40613e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406118
mov dword [ecx*4 + 0x422298], eax
inc ecx
cmp ecx, 0x100
jl 0x406113
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40616f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422298]
xor eax, esi
inc ecx
dec edx
jne 0x406151
pop edi
not eax
pop esi
ret 0xc

Function at 0x408938
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
call fcn.0040896a
sub edx, 0x34c42e90
mov edx, esi
xor dword [edi], ebx
add edi, 1
sub edx, edx
cmp edi, eax
jne fcn.00408938
add edx, esi
sub edx, esi
ret
Function at 0x4018a0
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x214]
sub esp, 0x288
mov dword [ebp - 0x270], eax
mov dword [esp], str.msi.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
xor ecx, ecx
sub esp, 4
mov word [ebp - 0x214], cx
mov edi, eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
jne 0x4018fc
test byte [section..data], 2
jne 0x401aa4
lea eax, [ebp - 0x268]
mov dword [esp + 0x10], 0
xor edx, edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x264]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x268], 0x28
mov word [ebp - 0x264], dx
call sym._MsiGetFileVersionW_20
sub esp, 0x14
test eax, eax
je 0x40194f
test byte [section..data], 2
jne 0x401a77
mov edx, dword [sym.imp.user32.dll_LoadStringW]
lea eax, [ebp - 0x26c]
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [ebp - 0x27c], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa
call edx
mov ecx, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x268], eax
add eax, 1
sub esp, 0x10
lea ebx, [eax + eax]
mov dword [ebp - 0x274], ecx
mov dword [esp], ebx
add ebx, 0x50
mov dword [ebp - 0x278], eax
call ecx
mov dword [esp], ebx
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x26c], eax
mov esi, eax
call ecx
mov ebx, eax
test eax, eax
je 0x401a52
test esi, esi
je 0x401a52
xor eax, eax
mov edx, dword [ebp - 0x27c]
mov word [esi], ax
mov eax, dword [ebp - 0x278]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xa
mov dword [esp], edi
call edx
lea eax, [ebp - 0x264]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x268]
add eax, 0x29
mov dword [esp + 4], eax
call sym._swprintf
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov dword [esp + 0x14], 0
movzx eax, ax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sym._MsiMessageBoxW_24
sub esp, 0x18
mov eax, dword [ebp - 0x26c]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call esi
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.MsiGetFileVersion_failed_with__ld_n
mov dword [esp + 8], str.ShowUsage
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x40194f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.GetModuleFileName_failed:__ld_n
mov dword [esp + 8], str.ShowUsage
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4018fc
Function at 0x401bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x10
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 6]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x401c51
mov ecx, eax
xor eax, eax
lea esi, [esi]
movzx edx, word [esi + eax]
mov word [ecx + eax + 4], dx
add eax, 2
test dx, dx
jne 0x401c20
mov eax, dword [ebx]
mov dword [ecx], 0
test eax, eax
je 0x401c48
lea esi, [esi]
mov ebx, eax
mov eax, dword [eax]
test eax, eax
jne 0x401c40
mov dword [ebx], ecx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [section..data], 2
jne 0x401c67
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.StringListAppend
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401c5a
Function at 0x402500
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
lea ebx, [ebp - 0x804]
sub esp, 0x81c
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], ebx
mov dword [esp], 6
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
mov eax, dword [0x40b004]
test eax, eax
je 0x402568
mov dword [esp + 4], ebx
mov dword [esp], 0x408160
call sym._wine_dbg_printf
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov dword [esp + 4], ebx
movzx eax, ax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.MsiExec
mov dword [esp], 0
call sym._MsiMessageBoxA_24
mov ebx, dword [ebp - 4]
sub esp, 0x18
leave
ret

Function at 0x4025b0
Capabilities:
Create service
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x254
mov dword [esp + 8], 2
mov dword [esp + 4], str.ServicesActive
mov dword [esp], 0
call dword [sym.imp.advapi32.dll_OpenSCManagerW]
sub esp, 0xc
test eax, eax
je 0x4026f0
lea esi, [ebp - 0x22c]
mov dword [esp + 4], 0x104
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
lea ecx, [esi + eax*2]
sub esp, 8
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.msiexec__V]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x402608
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], 0x10000000
mov dword [esp + 8], 0x4081d2
mov dword [esp + 4], 0x4081d2
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_CreateServiceW]
sub esp, 0x34
test eax, eax
je 0x4026b0
mov dword [esp], eax
mov esi, dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor edi, edi
call esi
sub esp, 4
mov dword [esp], ebx
call esi
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x431
jne 0x4026d0
mov esi, dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor edi, edi
jmp 0x402697
mov dword [esp], str.Failed_to_create_MSI_service_n
mov edi, 1
call sym._report_error
mov esi, dword [sym.imp.advapi32.dll_CloseServiceHandle]
jmp 0x402697
mov dword [esp], str.Failed_to_open_the_service_control_manager._n
mov edi, 1
call sym._report_error
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402710
Capabilities:
Accept command line arguments
Delete service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x40275d
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x402781
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], str.Unable_to_load_dll__s_n
mov dword [esp + 4], eax
call sym._report_error
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], str.Dll__s_does_not_implement_function__s_n
call sym._report_error
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push eax
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x404890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [esp + 4], sym._ServiceCtrlHandler_4
mov dword [esp], str.MSIServer
call dword [sym.imp.advapi32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x40b010], eax
sub esp, 8
test eax, eax
je 0x4049e8
mov eax, 2
call sym._UpdateSCMStatus.constprop.0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x40b008], eax
sub esp, 0x10
test eax, eax
je 0x4049a8
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._ServiceExecutionThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x40b00c], eax
sub esp, 0x18
test eax, eax
je 0x404970
mov eax, 4
call sym._UpdateSCMStatus.constprop.0
mov eax, dword [0x40b00c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, 1
sub esp, 8
call sym._UpdateSCMStatus.constprop.0
leave
ret 8
mov dword [esp], str.Failed_to_create_thread_n
call sym._report_error
test byte [0x406010], 8
jne 0x4049bd
mov eax, dword [0x40b008]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, 1
sub esp, 4
call sym._UpdateSCMStatus.constprop.0
leave
ret 8
mov dword [esp], str.Failed_to_create_event_n
call sym._report_error
test byte [0x406010], 8
je 0x404985
mov dword [esp + 0xc], str.Killing_service_n
mov dword [esp + 8], str.KillService
mov dword [esp + 4], 0x406010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x404985
mov dword [esp], str.Failed_to_register_service_ctrl_handler_n
call sym._report_error
leave
ret 8

Function at 0x404b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x404b98
cmp byte [esi + ebx - 1], 0xa
je 0x404b6c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x405100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x40b0b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x4052c0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x40b0b4]
movzx eax, al
bt eax, esi
jae 0x405320
mov ecx, dword [0x40b0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x4051c5
test byte [0x406028], 8
jne 0x405260
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x406038], 8
jne 0x405210
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x405194
cmp esi, 3
jbe 0x4051d0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x408ab4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x405194
mov ecx, dword [0x40b0b4]
test ecx, ecx
je 0x405300
mov dword [esp], 0x406038
call dword [0x40b0b4]
test al, 8
je 0x40516b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x40516b
mov ebx, dword [0x40b0b4]
test ebx, ebx
je 0x4052e0
mov dword [esp], 0x406028
call dword [0x40b0b4]
test al, 8
je 0x405156
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x40515e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x40b0b4
call sym._load_func.part.0
jmp 0x40511d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x40b0b4
call sym._load_func.part.0
jmp 0x40526a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x40b0b4
call sym._load_func.part.0
jmp 0x40521e
mov eax, 0xffffffff
jmp 0x4051c5
Function at 0x405480
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x405540
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4055bf
cmp al, 9
je 0x4055b0
cmp al, 0x20
je 0x4055b0
mov dword [ebp - 0x54], 0
xor esi, esi
nop
cmp al, 0x5c
je 0x405618
cmp al, 0x22
je 0x405628
mov dword [ebp - 0x54], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x4055bf
cmp al, 9
sete dl
cmp al, 0x20
sete cl
or dl, cl
je 0x405570
test esi, 1
jne 0x405570
lea esi, [esi]
nop
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x4055b0
cmp al, 0x20
je 0x4055b0
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x24], 1
jne 0x4055da
mov word [ebp - 0x20], 1
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x405587
and dword [ebp - 0x54], 1
jne 0x405580
xor esi, 1
jmp 0x405587
Function at 0x4301e0
Capabilities:
Parse pe header

Disassembly:
add esp, 4
mov ebx, dword [esp - 4]
push edi
pop edi
push esi
push esi
add esp, 4
push ebx
push edx
sub edx, ebx
pop edx
push edi
add esp, 4
pop esi
push esi
sub dword [esp], 0xdb6d87ee
pop esi
push esi
xor ebx, esi
pop ebx
push ebx
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub dword [esp], 0x24927812
add esp, 4
mov ebx, dword [esp - 4]
push edx
push ebx
pop ebx
lea edx, [ebx]
push edx
sub dword [esp], 0x20
pop edx
xchg edx, ebx
mov edx, dword [esp]
add esp, 4
push ebx
push ebx
add esp, 4
mov dword [esp], esi
jmp 0x42ffa3
mov esi, dword [esp]
add esp, 4
push edx
push ebx
pop ebx
push edx
push esi
pop esi
add esp, 4
mov dword [esp], 0x14
mov eax, dword [esp]
add esp, 4
mov dword [ebx], eax
push esp
add esi, 0x25506395
push esp
sub esi, 0x25506395
mov dword [esp], esi
mov ebx, dword [esp + 4]
add esp, 8
add esp, 4
mov ebx, dword [esp - 4]
push esp
mov eax, dword [esp]
add esp, 4
add esp, 4
mov eax, dword [esp - 4]
pushal
call 0x42fff4
pop ebx
mov eax, 0x50031494
sub eax, 0x50031202
add eax, ebx
xor dword [eax], 0x78c9aed2
call 0x4301e0
jmp 0x430144
call fcn.00430011
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add ebx, 0x86abc981
add byte [ecx - 0x17], ah
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
mov ebx, 0x77000000
add ebx, 0x10000
cmp ebx, 0x80000000
jne 0x4301fb
mov ebx, 0xbff00000
call fcn.0043023f
cmp eax, 0
je 0x4301e8
cmp word [ebx], 0x5a4d
jne 0x4301e8
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp word [eax], 0x4550
jne 0x4301e8
test byte [eax + 0x17], 0x20
je 0x4301e8
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, dword [eax + 0xc]
add edx, ebx
cmp dword [edx], 0x4e52454b
jne 0x4301e8
cmp dword [edx + 4], 0x32334c45
jne 0x4301e8
mov eax, ebx
mov esp, ebp
pop ebp
ret