joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f128
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
lea eax, [ebp - 8]
mov edx, dword [0x47dcdc]
call sub.rtl250.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x47f195
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, esi
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x47ef3c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x47f179
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f19c
lea eax, [ebp - 8]
mov edx, dword [0x47dcdc]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
ret

Function at 0x49219c
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x4921d4
test edx, 0x40000000
je 0x4921c0
test edx, 0x80000000
je 0x4921bb
or eax, 0x40
jmp 0x4921fe
or eax, 0x20
jmp 0x4921fe
test edx, 0x80000000
je 0x4921cf
or eax, 0x80
jmp 0x4921fe
or eax, 0x10
jmp 0x4921fe
test edx, 0x40000000
je 0x4921ee
test edx, 0x80000000
je 0x4921e9
or eax, 4
jmp 0x4921fe
or eax, 2
jmp 0x4921fe
test edx, 0x80000000
je 0x4921fb
or eax, 8
jmp 0x4921fe
or eax, 1
test edx, 0x4000000
je 0x49220b
or eax, 0x200
ret

Function at 0x492320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.00403ce8
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x40]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov eax, dword [ebx + 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x4923ac
cmp dword [ebx + 0x44], 0x4550
jne 0x4923ac
cmp word [ebx + 0x48], 0x14c
je 0x4923c2
mov ecx, 0x4923d4
mov dl, 1
mov eax, dword [sym.imp.rtl250.bpl__System_Sysutils_Exception_]
call sub.rtl250.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl250.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret
Function at 0x4938ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4939d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
push 1
mov ecx, esi
mov dl, 1
mov eax, dword [0x48d658]
call fcn.0048da38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4939ad
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x493912
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xc], 0
jne 0x493912
lea eax, [ebp - 4]
mov edx, dword [0x4cd468]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x49393e
mov eax, dword [ebp - 0xc]
call fcn.0048dcd0
test al, al
je 0x49392e
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x14]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x49393e
lea eax, [ebp - 4]
mov edx, dword [sym.imp.rtl250.bpl__System_Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov esi, 0x11
mov ebx, dword [0x4cd468]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x10]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebx]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.AxComponentsRTL.bpl__Axrtl_Utils_Hash_Crc32_HashCRC32_FromString_qqrx27System__AnsiStringT_us_i0__
xor edi, eax
mov eax, edi
xor edx, edx
push edx
push eax
call sub.rtl250.bpl__System_Math_Min_qqrxjxj
mov dword [ebp - 8], eax
add ebx, 8
dec esi
jne 0x493949
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4939b4
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System_Sysutils_FreeAndNil_qqrpv
ret
Function at 0x498598
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4986a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], edx
lea eax, [ebx + 4]
mov edx, esi
call sub.rtl250.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebx + 0xc]
mov edx, dword [0x432004]
call sub.rtl250.bpl__System__FinalizeRecord_qqrpvt1
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System_Variants_Null_qqrv
lea edx, [ebp - 0x10]
lea eax, [ebx + 0x30]
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
jle 0x498674
mov eax, dword [ebp + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
dec eax
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x49820c]
call sub.rtl250.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
mov edi, eax
dec edi
test edi, edi
jl 0x498682
inc edi
xor esi, esi
mov eax, dword [ebx + 8]
call sub.rtl250.bpl__System__DynArrayLength_qqrpxv
sub eax, esi
add eax, eax
mov edx, dword [ebx + 8]
lea eax, [edx + eax*8 - 0x10]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp + 8]
lea eax, [edx + eax*8 + 0x18]
lea edx, [ebp - 0x20]
call sub.rtl250.bpl__System_Rtti_TValue_AsVariant_qqrv
lea edx, [ebp - 0x20]
pop eax
call sub.rtl250.bpl__System_Variants__OleVarFromVar_qqrr8TVarDatarx8TVarData
inc esi
dec edi
jne 0x49863f
jmp 0x498682
lea eax, [ebx + 8]
mov edx, dword [0x49820c]
call sub.rtl250.bpl__System__DynArrayClear_qqrrpvpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4986aa
lea eax, [ebp - 0x20]
mov edx, dword [sym.imp.rtl250.bpl___xp_14System_Variant]
mov ecx, 2
call sub.rtl250.bpl__System__FinalizeArray_qqrpvt1ui
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3fe8683c
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..reloc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x63655d3c
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x84ce40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x429000]
push edi
or ebp, 0xffffffff
jmp 0x84ce62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x84ce69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84ce58
mov eax, 1
add ebx, ebx
jne 0x84ce7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x84ce8c
jne 0x84ceab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84ceab
dec eax
add ebx, ebx
jne 0x84ce98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x84ce70
add ebx, ebx
jne 0x84cea7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x84cefd
xor ecx, ecx
sub eax, 3
jb 0x84cec3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84cf32
sar eax, 1
mov ebp, eax
jmp 0x84cece
add ebx, ebx
jne 0x84cece
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84ce9c
inc ecx
add ebx, ebx
jne 0x84cedc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84ce9c
add ebx, ebx
jne 0x84cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x84cede
jne 0x84cefa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x84cede
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x84cf1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x84cf0e
jmp 0x84ce5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x84cf1c
add edi, ecx
jmp 0x84ce5e
pop esi
mov edi, esi
mov ecx, 0xc2e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x84cf3a
cmp byte [edi], 6
jne 0x84cf3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x84cf3f
lea edi, [esi + 0x44a000]
mov eax, dword [edi]
or eax, eax
je 0x84cfae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x45010c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x450180]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x84cf6c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x450188]
or eax, eax
je 0x84cfa8
mov dword [ebx], eax
add ebx, 4
jmp 0x84cf89
call dword [esi + 0x450184]
mov ebp, dword [esi + 0x45018c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x84cfe2
sub esp, 0xffffff80
jmp 0x40ac20
Function at 0x401040
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x214]
sub esp, 0x21c
mov dword [ebp - 0x218], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
sub esp, 8
test eax, eax
je 0x401104
mov dword [esp], 0xc
mov esi, dword [sym.imp.ucrtbase.dll_malloc]
call esi
mov edi, eax
test eax, eax
je 0x401104
mov dword [esp], 0x230
call esi
mov dword [edi + 8], eax
test eax, eax
je 0x401131
mov esi, dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x4010c6
mov dword [esp + 4], 0
mov eax, dword [edi + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x401110
mov eax, dword [edi + 8]
mov ecx, dword [section..bss]
lea edx, [ecx + 1]
mov dword [section..bss], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0x409000
mov dword [esp], ebx
call esi
sub esp, 0x10
test eax, eax
jne 0x4010a8
mov eax, dword [edi + 8]
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call ebx
mov dword [esp], edi
call ebx
xor eax, eax
jmp 0x401129
mov esi, dword [ebp - 0x218]
lea eax, [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov dword [eax], edi
mov eax, dword [edi + 8]
mov dword [esi + 0xc], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
xor eax, eax
jmp 0x401129

Function at 0x401170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, eax
sub esp, 0x14
mov eax, dword [ebp - 4]
test edx, edx
jne 0x4011ad
xor eax, eax
leave
ret

Function at 0x4011b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, dword [ebp - 4]
test edx, edx
jne 0x4011ed
xor eax, eax
leave
ret
Function at 0x401280
Capabilities:
Extract cabinet on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
lea eax, [ebp - 0x18]
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], sym._cabinet_seek
mov dword [esp + 0x14], sym._cabinet_close
mov dword [esp + 0x10], sym._cabinet_write
mov dword [esp + 0xc], sym._cabinet_read
mov dword [esp + 8], sym._cabinet_open
mov dword [esp + 4], sym._cabinet_free
mov dword [esp], sym._cabinet_alloc
call sym._FDICreate
test eax, eax
je 0x4013e0
mov ebx, eax
test esi, esi
je 0x4013f0
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], ecx
call ecx
sub esp, 0x20
mov dword [esp], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x4013f0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0x20]
mov dword [esp + 8], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x24]
call ecx
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], sym._cabinet_notify
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call sym._FDICopy
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call sym._FDIDestroy
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
xor esi, esi
jmp 0x4013c6
Function at 0x401b30
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Terminate process

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x254]
lea esi, [ebp - 0x258]
push ebx
mov edi, edx
lea ebx, [ebp - 0x214]
sub esp, 0x28c
mov dword [ebp - 0x270], 1
rep stosd dword es:[edi], eax
mov dword [esp], ebx
mov dword [ebp - 0x258], 0x44
mov dword [esp + 4], 0x104
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
sub esp, 8
mov dword [esp + 4], str.wusa.exe
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
lea eax, [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
sub esp, 4
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea edx, [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x401c80
test byte [section..data], 8
jne 0x401cca
mov eax, dword [ebp - 0x268]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push eax
push eax
lea eax, [ebp - 0x270]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x268]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
push edx
push edx
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x264]
push ecx
mov dword [esp], eax
call ebx
push ebx
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
mov eax, dword [ebp - 0x270]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]
test byte [section..data], 2
je 0x401c5f
mov eax, dword fs:[0x18]
or edx, 0xffffffff
mov esi, dword [eax + 0x34]
mov eax, ebx
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Failed_to_restart_64_bit__s__err__lu_n
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.restart_as_x86_64
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401c5f
or edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.Restarting__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.restart_as_x86_64
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401c0d
Function at 0x401d10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401d40
test al, 0x10
je 0x401d40
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x401d2e
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
mov ebx, dword [ebp - 4]
leave
sete al
movzx eax, al
ret

Function at 0x401d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
test eax, eax
je 0x401e24
mov dword [esp], eax
mov esi, eax
call dword [sym.imp.shlwapi.dll_PathRemoveFileSpecW]
sub esp, 4
test eax, eax
jne 0x401db0
xor ebx, ebx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401dca
mov ebx, 1
test al, 0x10
jne 0x401d9d
movzx eax, word [esi]
test ax, ax
je 0x401e16
mov ebx, esi
jmp 0x401dec
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401e16
cmp ax, 0x5c
jne 0x401de0
xor edx, edx
mov eax, esi
mov word [ebx], dx
call sym._create_directory
test eax, eax
je 0x401d9b
mov eax, 0x5c
add ebx, 2
mov word [ebx - 2], ax
movzx eax, word [ebx]
test ax, ax
jne 0x401dec
mov eax, esi
call sym._create_directory
mov ebx, eax
jmp 0x401d9d
xor ebx, ebx
jmp 0x401da6
Function at 0x401f60
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov edx, 0x40906e
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x264
mov dword [ebp - 0x260], eax
call sym._path_combine
test eax, eax
je 0x40204f
lea edi, [ebp - 0x25c]
mov esi, eax
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov ebx, eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
sub esp, 8
mov dword [esp], esi
mov dword [ebp - 0x264], eax
call eax
cmp ebx, 0xffffffff
je 0x40203d
lea esi, [ebp - 0x230]
mov dword [esp + 4], 0x409072
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40201d
mov dword [esp + 4], 0x409076
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40201d
mov eax, dword [ebp - 0x260]
mov edx, esi
call sym._path_combine
test eax, eax
je 0x40201d
test byte [ebp - 0x25c], 0x10
je 0x402060
mov dword [ebp - 0x268], eax
call sym._delete_directory.isra.0
mov edx, dword [ebp - 0x268]
mov dword [esp], edx
mov eax, dword [ebp - 0x264]
call eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401fbd
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
mov dword [ebp - 0x268], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov edx, dword [ebp - 0x268]
sub esp, 4
jmp 0x402012
Function at 0x402510
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x10]
call sym._expand_expression.isra.0
mov ecx, dword [esi + 0x10]
mov ebx, eax
test ecx, ecx
je 0x402578
test eax, eax
je 0x4025c0
cmp word [ebx], 0
je 0x4025d0
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402548
sub eax, ebx
add eax, 2
mov edx, dword [ebp + 8]
test edx, edx
je 0x402585
mov esi, 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
test ebx, ebx
jne 0x402539
mov edx, dword [ebp + 8]
test edx, edx
jne 0x40255d
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x40255d
test byte [section..data], 2
jne 0x4025da
xor esi, esi
jmp 0x402562
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x402556
mov esi, dword [esi + 8]
test esi, esi
je 0x402654
mov eax, esi
shr eax, 0x10
je 0x402642
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x409015
test edx, edx
jne 0x402613
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0xc], str.Failed_to_set_registry_key__s_n
mov dword [esp + 8], str.install_registry_string
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402562
mov dword [esp + 4], esi
mov dword [esp], 0x409008
call sym._wine_dbg_sprintf.constprop.0
jmp 0x402613
mov eax, 0x40900e
jmp 0x402613
Function at 0x407150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4071a8
cmp byte [esi + ebx - 1], 0xa
je 0x40717c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40c0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret