joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
and esp, 0xfffffff8
sub esp, 0x24
mov dword [esp], edx
mov dword [esp + 4], 0x7258595a
mov dword [esp + 0x20], eax
call sym._cmsReadTag
mov dword [esp], ebx
mov dword [esp + 4], 0x6758595a
mov esi, eax
call sym._cmsReadTag
mov dword [esp], ebx
mov dword [esp + 4], 0x6258595a
mov edi, eax
call sym._cmsReadTag
test esi, esi
sete cl
test edi, edi
mov ebx, eax
sete al
or cl, al
jne 0x10015e80
test ebx, ebx
je 0x10015e80
movsd xmm0, qword [ebx]
mov eax, dword [esp + 0x20]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [edi]
movsd qword [esp + 0xc], xmm1
movsd xmm2, qword [esi]
mov dword [esp], eax
movsd qword [esp + 4], xmm2
call sym.__cmsVEC3init
movsd xmm3, qword [ebx + 8]
mov eax, dword [esp + 0x20]
movsd qword [esp + 0x14], xmm3
movsd xmm4, qword [edi + 8]
add eax, 0x18
movsd qword [esp + 0xc], xmm4
movsd xmm5, qword [esi + 8]
mov dword [esp], eax
movsd qword [esp + 4], xmm5
call sym.__cmsVEC3init
movsd xmm6, qword [ebx + 0x10]
mov eax, dword [esp + 0x20]
movsd qword [esp + 0x14], xmm6
movsd xmm7, qword [edi + 0x10]
lea edi, [eax + 0x30]
movsd qword [esp + 0xc], xmm7
movsd xmm0, qword [esi + 0x10]
mov dword [esp], edi
movsd qword [esp + 4], xmm0
call sym.__cmsVEC3init
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1001fc40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 0xc]
test byte [0x100407a0], 8
jne 0x1001fc88
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x1001fc78
test ebx, ebx
je 0x1001fc78
mov edx, dword [ebp + 0x10]
mov eax, 1
test edx, edx
jne 0x1001fcc0
mov ebx, dword [ebp - 4]
leave
ret 0xc
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret 0xc
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], str.___s___x___n
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.UninstallColorProfileW
mov dword [esp + 4], 0x100407a0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x1001fc53
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret 0xc

Function at 0x10020a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, eax
mov esi, eax
mov edi, eax
mov ecx, eax
shr edx, 3
shr esi, 0xa
shr eax, 0xe
and edx, 0xf
shr edi, 0xb
mov dword [ebp - 0x10], edx
mov edx, esi
and edi, 1
shr ecx, 0xd
xor edx, eax
mov dword [ebp - 0x14], edi
mov edi, esi
and ecx, 1
mov eax, edx
and edi, 1
mov dword [ebp - 0x1c], ecx
and eax, 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], eax
je 0x10020b30
movzx ecx, byte [ebx]
mov edx, 0x80008001
lea edi, [ebx + 2]
mov esi, ecx
shl esi, 8
or ecx, esi
movzx ecx, cx
lea esi, [ecx + 0x7fff]
mov eax, esi
mul edx
mov eax, dword [ebp - 0x10]
shr edx, 0xf
lea esi, [edx + ecx]
test eax, eax
je 0x10020b1d
mov eax, dword [ebp - 0x10]
xor ecx, ecx
dec eax
mov dword [ebp - 0x20], eax
lea esi, [esi]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
sub ebx, ecx
test eax, eax
movzx eax, word [edi + ecx*2]
cmove ebx, ecx
mov edx, eax
rol dx, 8
cmp dword [ebp - 0x14], 0
cmovne eax, edx
movzx eax, ax
test esi, esi
je 0x10020ae9
shl eax, 0x10
xor edx, edx
div esi
mov edx, 0xffff
cmp eax, 0xffff
cmova eax, edx
mov edx, eax
cmp dword [ebp - 0x1c], 0
not edx
cmovne eax, edx
mov edx, dword [ebp + 0xc]
inc ecx
mov word [edx + ebx*2], ax
cmp dword [ebp - 0x10], ecx
ja 0x10020ab0
mov esi, dword [ebp - 0x10]
mov edx, 2
test esi, esi
lea eax, [esi + esi]
cmove eax, edx
add edi, eax
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x10020b1d
add edi, 2
add esp, 0x18
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp - 0x10]
mov edx, 0x80008001
movzx ecx, byte [ebx + edi - 1]
mov esi, ecx
shl esi, 8
or ecx, esi
movzx ecx, cx
lea esi, [ecx + 0x7fff]
mov eax, esi
mul edx
shr edx, 0xf
test edi, edi
mov edi, ebx
lea esi, [edx + ecx]
jne 0x10020aa0
jmp 0x10020b1a
Function at 0x10020b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, eax
mov ecx, eax
mov ebx, eax
shr edx, 3
shr ecx, 0xd
and ecx, 1
mov edi, edx
mov edx, eax
shr ebx, 0xe
shr edx, 0xa
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr eax, 0x17
mov esi, edx
mov dword [ebp - 0x28], ebx
xor edx, ebx
shr ecx, 7
mov ebx, eax
and edi, 0xf
and esi, 1
and ebx, 1
and ecx, 7
mov dword [ebp - 0x20], ecx
setne cl
and eax, ecx
and edx, 1
mov dword [ebp - 0x24], edx
je 0x10020cd0
test al, al
je 0x10020d20
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
mov edx, eax
shl edx, 8
mov ecx, edx
mov edx, 0x80008001
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov ecx, dword [ebp - 0x20]
add dword [ebp + 0x10], ecx
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x10020d3c
mov eax, dword [ebp - 0x1c]
test eax, eax
setne al
xor ecx, ecx
and eax, ebx
mov byte [ebp - 0x11], al
lea eax, [edi - 1]
mov dword [ebp - 0x18], eax
nop
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x18]
movzx eax, byte [eax + ecx]
sub ebx, ecx
test esi, esi
cmove ebx, ecx
mov edx, eax
shl edx, 8
or edx, eax
cmp dword [ebp - 0x10], 0
mov eax, edx
not eax
cmovne edx, eax
cmp byte [ebp - 0x11], 0
movzx eax, dx
je 0x10020c61
shl eax, 0x10
xor edx, edx
div dword [ebp - 0x1c]
mov edx, 0xffff
cmp eax, 0xffff
cmovbe edx, eax
mov eax, dword [ebp + 0xc]
inc ecx
mov word [eax + ebx*2], dx
cmp edi, ecx
ja 0x10020c20
mov edx, dword [ebp - 0x24]
test edi, edi
mov ebx, 1
cmovne ebx, edi
add ebx, dword [ebp + 0x10]
test edx, edx
je 0x10020d10
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x10020cbe
test byte [ebp - 0x28], 1
je 0x10020cbe
mov eax, dword [ebp + 0xc]
movzx esi, word [eax]
lea eax, [edi + edi - 2]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
add eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [ebp + 0xc]
mov word [eax + edi*2 - 2], si
add esp, 0x28
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x1c], 1
test al, al
je 0x10020d02
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx eax, byte [eax + edi]
mov ecx, eax
shl ecx, 8
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x10020c09
mov ebx, dword [ebp + 0x10]
lea esi, [esi]
add ebx, dword [ebp - 0x20]
jmp 0x10020c85
mov eax, dword [ebp - 0x20]
add dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x10020c09
mov ebx, dword [ebp + 0x10]
jmp 0x10020c85
mov ebx, dword [ebp + 0x10]
jmp 0x10020cbe
Function at 0x10022080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, eax
mov ecx, eax
shr edx, 3
shr ecx, 0xd
mov edi, edx
mov edx, eax
and ecx, 1
shr edx, 0xa
mov dword [ebp - 0x14], ecx
mov ecx, eax
and edi, 0xf
mov esi, edx
shr ecx, 0xe
and esi, 1
xor edx, ecx
mov dword [ebp - 0x10], esi
mov esi, eax
shr eax, 0x17
mov ebx, eax
shr esi, 7
and ebx, 1
and esi, 7
setne cl
and eax, ecx
and edx, 1
mov dword [ebp - 0x1c], edx
je 0x10022168
test al, al
jne 0x100221b0
imul esi, dword [ebp + 0x14]
add esi, dword [ebp + 0x10]
test edi, edi
je 0x10022155
mov eax, dword [ebp - 0x1c]
mov ecx, 1
test eax, eax
setne al
and eax, ebx
mov byte [ebp - 0x15], al
jmp 0x10022102
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, edi
lea ebx, [ecx - 1]
sub eax, ecx
test edx, edx
cmovne ebx, eax
movzx eax, byte [esi]
mov edx, eax
shl edx, 8
or edx, eax
cmp dword [ebp - 0x14], 0
mov eax, edx
not eax
cmovne edx, eax
cmp byte [ebp - 0x15], 0
movzx eax, dx
je 0x10022144
shl eax, 0x10
xor edx, edx
div dword [ebp - 0x1c]
mov edx, 0xffff
cmp eax, 0xffff
cmovbe edx, eax
mov eax, dword [ebp + 0xc]
add esi, dword [ebp + 0x14]
mov word [eax + ebx*2], dx
lea eax, [ecx + 1]
cmp ecx, edi
jne 0x10022100
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop ebx
pop esi
inc eax
pop edi
pop ebp
ret
test al, al
je 0x100221a0
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edx, 0x80008001
imul eax, edi
movzx eax, byte [esi + eax]
mov ecx, eax
shl ecx, 8
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
jmp 0x100220e7
mov dword [ebp - 0x1c], 1
mov esi, dword [ebp + 0x10]
jmp 0x100220e7
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx eax, byte [eax]
mov ecx, eax
shl ecx, 8
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
jmp 0x100220e0
Function at 0x10022290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, eax
mov ecx, eax
shr edx, 3
shr ecx, 0xd
and edx, 0xf
and ecx, 1
mov dword [ebp - 0x10], edx
mov edx, eax
shr edx, 0xa
mov dword [ebp - 0x18], ecx
mov ecx, eax
shr eax, 0xe
mov edi, edx
shr ecx, 0xb
xor edx, eax
and edi, 1
and ecx, 1
and edx, 1
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], ecx
je 0x10022380
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
mov esi, dword [ebp + 0x10]
add esi, dword [ebp + 0x14]
movzx ecx, byte [eax]
mov edi, ecx
shl edi, 8
or ecx, edi
movzx ecx, cx
lea edi, [ecx + 0x7fff]
mov eax, edi
mul edx
shr edx, 0xf
lea edi, [edx + ecx]
mov eax, dword [ebp - 0x10]
mov ecx, 1
test eax, eax
jne 0x1002231a
jmp 0x10022372
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
lea ebx, [ecx - 1]
sub eax, ecx
test edx, edx
cmovne ebx, eax
movzx eax, word [esi]
mov edx, eax
rol dx, 8
cmp dword [ebp - 0x1c], 0
cmovne eax, edx
movzx eax, ax
test edi, edi
je 0x10022355
shl eax, 0x10
xor edx, edx
div edi
mov edx, 0xffff
cmp eax, 0xffff
cmova eax, edx
mov edx, eax
cmp dword [ebp - 0x18], 0
not edx
cmovne eax, edx
mov edx, dword [ebp + 0xc]
add esi, dword [ebp + 0x14]
mov word [edx + ebx*2], ax
lea eax, [ecx + 1]
cmp dword [ebp - 0x10], ecx
jne 0x10022318
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop ebx
pop esi
add eax, 2
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov edx, 0x80008001
dec eax
imul eax, dword [ebp + 0x14]
movzx ecx, byte [esi + eax]
mov edi, ecx
shl edi, 8
or ecx, edi
movzx ecx, cx
lea edi, [ecx + 0x7fff]
mov eax, edi
mul edx
shr edx, 0xf
lea edi, [edx + ecx]
jmp 0x10022305
Function at 0x10023880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x8c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebx + 4]
cmp ecx, 0xf
ja 0x1002397e
cmp dword [ebx + 8], 0xf
ja 0x1002399b
lea esi, [esp + 0xc]
test ecx, ecx
je 0x100238e6
movsd xmm1, qword [0x100448e8]
xor eax, eax
lea esi, [esp + 0xc]
lea esi, [esi]
movzx edx, word [edi + eax*2]
pxor xmm0, xmm0
cvtsi2sd xmm0, edx
divsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
movss dword [esi + eax*4], xmm0
inc eax
cmp ecx, eax
jne 0x100238c8
lea edi, [esp + 0x4c]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._cmsPipelineEvalFloat
mov eax, dword [ebx + 8]
test eax, eax
je 0x10023971
movsd xmm1, qword [0x100448e8]
mov ecx, dword [ebp + 0xc]
xor edx, edx
pxor xmm2, xmm2
movsd xmm3, qword [0x100448f0]
movsd xmm5, qword [0x100448f8]
movsd xmm4, qword [0x10044900]
lea esi, [esi]
pxor xmm0, xmm0
xor eax, eax
cvtss2sd xmm0, dword [edi + edx*4]
mulsd xmm0, xmm1
addsd xmm0, xmm3
comisd xmm2, xmm0
jae 0x10023967
comisd xmm0, xmm1
mov eax, 0xffffffff
jae 0x10023967
subsd xmm0, xmm5
addsd xmm0, xmm4
movd eax, xmm0
sar eax, 0x10
add ax, 0x7fff
mov word [ecx + edx*2], ax
inc edx
cmp dword [ebx + 8], edx
ja 0x10023930
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x1ae
mov dword [esp + 4], str..._src_wine_libs_lcms2_src_cmsopt.c
mov dword [esp], str._Lut____InputChannels___16_
call dword [sym.imp.ucrtbase.dll__assert]
mov dword [esp + 8], 0x1af
mov dword [esp + 4], str..._src_wine_libs_lcms2_src_cmsopt.c
mov dword [esp], str._Lut____OutputChannels___16_
call dword [sym.imp.ucrtbase.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x10023a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x410
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x410], eax
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
test esi, esi
je 0x10023b08
xor edi, edi
nop
mov eax, edi
xor edi, 1
lea edx, [ebp - 0x40c]
mov dword [esp + 8], esi
mov ebx, edi
shl eax, 9
shl ebx, 9
add eax, edx
add ebx, edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [esi + 0x14]
mov esi, dword [esi + 0x24]
test esi, esi
jne 0x10023ab0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [esp + 4], ebx
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._memcpy
add esp, 0x410
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x40c]
jmp 0x10023adc
Function at 0x100276b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 4], 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.__cmsContextGetClientChunk
test byte [esi], 2
mov dword [ebp - 0x20], eax
mov eax, dword [ebx]
jne 0x100277b0
mov ecx, dword [eax]
test ecx, ecx
je 0x100277e0
mov dword [esp], eax
call sym._cmsPipelineGetPtrToFirstStage
mov edi, eax
test eax, eax
jne 0x1002771e
jmp 0x10027740
mov dword [esp], edi
call sym._cmsStageNext
mov edi, eax
test eax, eax
je 0x10027740
mov dword [esp], edi
call sym._cmsStageType
cmp eax, 0x6e636c20
jne 0x10027710
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
call sym._PreOptimize
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx]
mov edx, dword [eax]
test edx, edx
je 0x100277e0
test dword [esi], 0x100
jne 0x1002772d
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
test edi, edi
jne 0x1002777b
jmp 0x10027820
mov edi, dword [edi + 4]
test edi, edi
je 0x10027820
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
call dword [edi]
test eax, eax
je 0x10027770
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._PreOptimize
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x18], esi
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
jmp sym._OptimizeByResampling
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], sym._FastIdentity16
call sym.__cmsPipelineSetOptimizationParameters
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x1003ecc0
mov edi, edx
jmp 0x1002783b
mov edi, dword [edi + 4]
test edi, edi
je 0x10027734
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
call dword [edi]
test eax, eax
je 0x10027830
jmp 0x1002779d
Function at 0x1002bab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x1002bad4
test byte [ebx + 0x10], 2
jne 0x1002baf8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x1002bae3
mov dword [esp], eax
call sym._cmsCloseProfile
mov eax, dword [ebx + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
leave
jmp dword [sym.imp.ucrtbase.dll_free]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
test eax, eax
je 0x1002bb30
test byte [0x100407a0], 2
jne 0x1002bb70
mov eax, dword [ebx + 0xc]
jmp 0x1002bac8
lea eax, [ebp - 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x1002bb20
mov eax, dword [ebp - 8]
cmp dword [ebx + 0x18], eax
jne 0x1002bb20
jmp 0x1002bb29
mov dword [esp + 0xc], str.Unable_to_write_color_profile_n
mov dword [esp + 8], str.close_profile
mov dword [esp + 4], 0x100407a0
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x1002bb29
Function at 0x1002de70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0xc4
movsd xmm1, qword [ebp + 0x10]
movsd xmm2, qword [ebp + 0x18]
movsd xmm3, qword [ebp + 0x20]
movsd xmm4, qword [ebp + 0x28]
mov eax, dword [ebp + 0x30]
mov ebx, dword [ebp + 0x34]
movsd qword [esp + 0x6c], xmm1
mov edi, dword [ebp + 0xc]
movsd qword [esp + 0x74], xmm2
movsd qword [esp + 0x7c], xmm3
movsd qword [esp + 0x84], xmm4
cmp eax, ebx
jne 0x1002e040
mov dword [esp + 0x8c], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._cmsCreateProfilePlaceholder
mov ebx, eax
test eax, eax
je 0x1002e030
mov dword [esp], eax
mov dword [esp + 4], 0x61627374
call sym._cmsSetDeviceClass
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call sym._cmsSetColorSpace
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call sym._cmsSetPCS
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym._cmsSetHeaderRenderingIntent
mov eax, dword [ebp + 8]
mov dword [esp + 8], 3
mov dword [esp + 4], 3
mov dword [esp], eax
call sym._cmsPipelineAlloc
lea edx, [esp + 0x6c]
mov esi, eax
lea eax, [esp + 0x30]
test esi, esi
je 0x1002e028
lea esi, [esi]
mov dword [eax], edi
add eax, 4
cmp edx, eax
jne 0x1002df50
lea eax, [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 3
mov dword [esp], eax
call sym._cmsStageAllocCLut16bitGranular
mov edi, eax
test eax, eax
je 0x1002e020
lea edx, [esp + 0x6c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], sym._bchswSampler
mov dword [esp], eax
call sym._cmsStageSampleCLut16bit
test eax, eax
je 0x1002e020
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._cmsPipelineInsertStage
test eax, eax
je 0x1002e020
mov edx, str.BCHS_built_in
mov eax, ebx
call sym._SetTextTags
test eax, eax
je 0x1002e030
call sym._cmsD50_XYZ
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x77747074
call sym._cmsWriteTag
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], 0x41324230
call sym._cmsWriteTag
mov dword [esp], esi
call sym._cmsPipelineFree
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call sym._cmsPipelineFree
mov dword [esp], ebx
call sym._cmsCloseProfile
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, 0x80000000
pxor xmm0, xmm0
lea esi, [esp + 0x14]
mov dword [esp + 0x8c], 1
cvtsi2sd xmm0, eax
mov dword [esp], esi
add ebx, 0x80000000
addsd xmm0, qword [0x100438a0]
movsd qword [esp + 4], xmm0
call sym._cmsWhitePointFromTemp
lea eax, [esp + 0x94]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._cmsxyY2XYZ
pxor xmm0, xmm0
mov dword [esp], esi
cvtsi2sd xmm0, ebx
addsd xmm0, qword [0x100438a0]
movsd qword [esp + 4], xmm0
call sym._cmsWhitePointFromTemp
lea eax, [esp + 0xac]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._cmsxyY2XYZ
jmp 0x1002deca
Function at 0x10035ec0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 8], 0x10042d83
mov dword [esp + 4], esi
test edi, edi
je 0x10035f50
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._cmsOpenIOhandlerFromFile
mov ebx, eax
test eax, eax
je 0x10035f1b
mov eax, dword [edi + 0xb64]
mov dword [esp + 4], eax
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym.__cmsLockMutex
test eax, eax
jne 0x10035f28
mov dword [esp], ebx
call dword [ebx + 0x118]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_remove]
add esp, 0xc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
mov edx, ebx
call sym._cmsSaveProfileToIOhandler.part.0
mov dword [esp], ebx
test eax, eax
setne al
movzx eax, al
mov edi, eax
call dword [ebx + 0x118]
and eax, edi
je 0x10035f12
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
call sym._cmsOpenIOhandlerFromFile
test eax, eax
je 0x10035f1b
mov dword [esp + 8], 0x59e
mov dword [esp + 4], str..._src_wine_libs_lcms2_src_cmsio0.c
mov dword [esp], str._hProfile_____void_0__
call dword [sym.imp.ucrtbase.dll__assert]
nop
nop
nop
Function at 0x10039fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1003a008
cmp byte [esi + ebx - 1], 0xa
je 0x10039fdc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10040a1c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret