joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106195b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x106195d3
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.106191a0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.106191f0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10619290
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.105f7600
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x105eab54
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1061967e
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10619480
test ax, ax
je 0x1061967e
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x1061967e
cmp byte [esp + eax + 0xa], 0x3a
jne 0x1061967e
lea edx, [esp + eax + 0xb]
push esi
push edx
call fcn.105f7670
test al, al
je 0x10619679
mov ax, word [esi]
cmp ax, 1
jl 0x10619679
cmp ax, 7
jle 0x1061967e
mov word [esi], 0
xor eax, eax
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x40
ret 8

Function at 0x10619690
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.106191a0
lea ecx, [esp + 0x24]
push 0x10
push ecx
call fcn.106191f0
lea edx, [esp + 0x14]
push 0x10
push edx
call fcn.10619350
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.10619310
lea ecx, [esp + 4]
lea edx, [esp + 0x34]
push ecx
push 0x10
push edx
lea eax, [esp + 0x20]
push 0x105eab54
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x10619700
lea edx, [esp + 0x34]
lea eax, [esp + 0x44]
push edx
push eax
call fcn.105f74b0
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x50
ret 8

Function at 0x10619710
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.106191a0
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.106191f0
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.106192d0
lea eax, [esp]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
mov ecx, dword [esp + 0x34]
test eax, eax
setne dl
mov word [ecx], ax
mov al, dl
add esp, 0x30
ret 4
Function at 0x10619770
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.105f7620
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.106191a0
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.106191f0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.10619240
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.106193a0
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.10619430
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.106193f0
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x105eab54
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1061985e
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.105f74b0
test al, al
je 0x1061981f
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push esp
and al, 4
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x825030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x827b68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x827b68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x827b6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x827b70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x827b78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x827b74], eax
mov eax, dword [0x827b74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x827b78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x827b78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x827b6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x827b70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x827b68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x825030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x300555c]
push ebx
mov ebx, dword [0x3005280]
push esi
mov esi, dword [0x825f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x300555c]
mov dword [0x827d0c], esi
cmp eax, 0x114e
jne 0x40afbb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x300555c]
cmp eax, 0x2f
jne 0x40afdb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x401bd7
pop dword [ebp - 4]
mov eax, 0x401bd7
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x3d589b08
add dword [ebp - 0x14], 0x10f9aa43
mov dword [ebp - 0x10], 0x50f1f8a2
sub dword [ebp - 0x10], 0x1ebeac5d
mov dword [ebp - 0xc], 0xa53f0dba
sub dword [ebp - 0xc], 0x58f2c98c
mov dword [ebp - 8], 0xb5f618f0
add dword [ebp - 8], 0x4a09e710
lea eax, [ebp - 0x14]
push eax
mov eax, 0xbe4e3d35
add eax, 0x41f2332b
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x39305732
sub dword [ebp - 0x14], 0xc4bdeddc
mov dword [ebp - 0x10], 0x3377dbd7
add dword [ebp - 0x10], 0xdf4859e
mov dword [ebp - 0xc], 0x2077a13c
sub dword [ebp - 0xc], 0xbd0834d0
mov dword [ebp - 8], 0x737139b8
add dword [ebp - 8], 0x8c8ec648
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x278da375
sub eax, 0x274d3275
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x35a6f
push 0
call eax
mov ecx, 0x444f
xor edi, edi
add edi, eax
mov ebx, 0xcf059fa5
add ebx, 0x313b605b
add ebx, dword [ebp - 4]
mov edx, 0xd91903a3
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
add edi, 0xcd2d5e3b
add edi, 0x32d2a1c9
add ebx, 0xbcb5b008
add ebx, 0x434a4ffc
loop 0x401cea
add eax, 0xb6aca9c6
add eax, 0x49545a49
mov ebx, eax
add eax, 0x95c131dd
sub eax, 0x95c131d8
mov ecx, 0xc9a8ecb1
add ecx, 0x3697134f
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x51bf20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8c000]
lea eax, [edi + 0xcf740]
push dword [eax]
mov dword [eax], 0x430c48cc
push eax
push edi
jmp 0x51bf4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51bf51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bf40
mov eax, 1
add ebx, ebx
jne 0x51bf63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51bf74
jne 0x51bf93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bf93
dec eax
add ebx, ebx
jne 0x51bf80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51bf58
add ebx, ebx
jne 0x51bf8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51bfe5
xor ecx, ecx
sub eax, 3
jb 0x51bfab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51c01a
sar eax, 1
mov ebp, eax
jmp 0x51bfb6
add ebx, ebx
jne 0x51bfb6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bf84
inc ecx
add ebx, ebx
jne 0x51bfc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bf84
add ebx, ebx
jne 0x51bfd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51bfc6
jne 0x51bfe2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51bfc6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51c004
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51bff6
jmp 0x51bf46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51c004
add edi, ecx
jmp 0x51bf46
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51c026
cmp byte [edi], 0x11
jne 0x51c026
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51c02b
lea edi, [esi + 0x114000]
mov eax, dword [edi]
or eax, eax
je 0x51c0a3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x125d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x125f08]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51c058
mov ecx, edi
jns 0x51c087
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x125f10]
or eax, eax
je 0x51c09d
mov dword [ebx], eax
add ebx, 4
jmp 0x51c075
call dword [esi + 0x125f0c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x51c0d4
cmp al, 0xef
ja 0x51c0c7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51c0a9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x51c0b6
mov ebp, dword [esi + 0x125f14]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51c108
sub esp, 0xffffff80
jmp 0x420577
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x408d1e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408d2d
pop dword [ebp - 0x14]
mov eax, 0x408d2d
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3a66c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x4c3e
xor edx, edx
add edx, eax
mov ebx, 0x1b01b418
sub ebx, 0x1ac03c18
add ebx, dword [ebp - 0x14]
mov esi, 0x7821bba3
sub dword [ebp - 4], ebx
mov edi, dword [ebx]
xor dword [ebp - 4], 0xfae083a4
sub edi, esi
sub dword [ebp - 4], edx
mov dword [edx], edi
xor dword [ebp - 4], edi
add edx, 0x6aaacac3
add edx, 0x95553541
add ebx, 0xf92312ad
add ebx, 0x6dced57
loop 0x408d78
add eax, 0x123cb
xor ebx, ebx
add ebx, eax
add eax, 0xf993a5c0
add eax, 0x66c5a45
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4022e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402338
cmp byte [esi + ebx - 1], 0xa
je 0x40230c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4028e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4060b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x402aa0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4060b4]
movzx eax, al
bt eax, esi
jae 0x402b00
mov ecx, dword [0x4060a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x4029a5
test byte [0x4030ac], 8
jne 0x402a40
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x4030bc], 8
jne 0x4029f0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402974
cmp esi, 3
jbe 0x4029b0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4043a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x402974
mov ecx, dword [0x4060b4]
test ecx, ecx
je 0x402ae0
mov dword [esp], 0x4030bc
call dword [0x4060b4]
test al, 8
je 0x40294b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x40294b
mov ebx, dword [0x4060b4]
test ebx, ebx
je 0x402ac0
mov dword [esp], 0x4030ac
call dword [0x4060b4]
test al, 8
je 0x402936
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x40293e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4060b4
call sym._load_func.part.0
jmp 0x4028fd
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4060b4
call sym._load_func.part.0
jmp 0x402a4a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4060b4
call sym._load_func.part.0
jmp 0x4029fe
mov eax, 0xffffffff
jmp 0x4029a5
Function at 0x402e80
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x40113a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x40127b
mov ecx, dword [0x4010b8]
movzx eax, byte [ecx + 0x81]
cmp eax, 0
je 0x40127b
mov eax, dword [ecx + 0x2c]
cmp eax, 1
je 0x40116f
cmp eax, 3
je 0x40116f
jmp 0x40127b
push 0x401012
mov eax, dword [ecx + 0x24]
mov esi, dword [eax + 0x4d]
push esi
push dword [ecx + 0x30]
mov ecx, dword [0x4010b4]
cmp dword [0x4010e4], 3
je 0x4011d0
cmp dword [0x4010e4], 2
je 0x401203
cmp dword [0x4010e4], 4
je 0x40122d
mov eax, dword [ecx + 0x3cd]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0x1a]
cmp edx, 0x10
lea esi, [eax + 0xa]
jl 0x4011ba
mov esi, dword [eax + 0xa]
push esi
lea eax, [ecx + 0x121]
push eax
push dword [ecx + 0x225]
lea eax, [ecx + 0x20]
jmp 0x401255
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x2f32]
cmp edx, 0x10
lea esi, [eax + 0x2f22]
jl 0x4011f0
mov esi, dword [eax + 0x2f22]
push esi
lea eax, [ecx + 0x131]
push eax
push dword [ecx + 0x235]
lea eax, [ecx + 0x30]
jmp 0x401255
mov eax, dword [ecx + 0x3c5]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x16]
cmp edx, 0x10
lea esi, [eax + 6]
jl 0x40121a
mov esi, dword [eax + 6]
push esi
lea eax, [ecx + 0x11d]
push eax
push dword [ecx + 0x221]
lea eax, [ecx + 0x1c]
jmp 0x401255
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x22]
cmp edx, 0x10
lea esi, [eax + 0x12]
jl 0x401244
mov esi, dword [eax + 0x12]
push esi
lea eax, [ecx + 0x131]
push eax
push dword [ecx + 0x235]
lea eax, [ecx + 0x30]
push eax
push 0x401048
push 0x401017
push dword [0x4010bc]
call dword [sym.imp.MSVCRT.DLL_sprintf]
push 0
push 0
push 0x4010e8
call dword [sym.imp.MSVCRT.DLL__beginthread]
xor eax, eax
leave
ret 4
Function at 0x401297
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0xffff
je 0x401350
cmp dword [ebp + 8], 0x8ff
jg 0x401479
mov ecx, dword [0x4010b4]
cmp dword [0x4010e4], 3
je 0x4012e9
cmp dword [0x4010e4], 2
je 0x4012f1
cmp dword [0x4010e4], 4
je 0x4012e9
mov eax, dword [ecx + 0x3cd]
mov eax, dword [eax + 0x10]
jmp 0x4012fa
mov eax, dword [ecx + 0x3de]
jmp 0x4012f7
mov eax, dword [ecx + 0x3c5]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp + 8]
mov esi, dword [eax + edx*4]
test esi, esi
je 0x401479
mov esi, dword [eax + edx*4 + 0x2400]
cmp byte [esi], 0
je 0x401479
cmp byte [esi + 1], 0
jne 0x401479
cmp byte [0x4010df], 9
jg 0x401479
mov cl, byte [esi]
mov edi, 0x4010d4
movzx edx, byte [0x4010df]
mov byte [edi + edx], cl
inc edx
mov byte [0x4010df], dl
mov byte [edi + edx], 0
jmp 0x401479
mov edi, 0x4010d4
cmp byte [edi], 0
je 0x401479
push 0x401012
push 0x4010d4
push 0x270f
mov ecx, dword [0x4010b4]
cmp dword [0x4010e4], 3
je 0x4013bf
cmp dword [0x4010e4], 2
je 0x4013f2
cmp dword [0x4010e4], 4
je 0x40141c
mov eax, dword [ecx + 0x3cd]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0x1a]
cmp edx, 0x10
lea esi, [eax + 0xa]
jl 0x4013a9
mov esi, dword [eax + 0xa]
push esi
lea eax, [ecx + 0x121]
push eax
push dword [ecx + 0x225]
lea eax, [ecx + 0x20]
jmp 0x401444
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x2f32]
cmp edx, 0x10
lea esi, [eax + 0x2f22]
jl 0x4013df
mov esi, dword [eax + 0x2f22]
push esi
lea eax, [ecx + 0x131]
push eax
push dword [ecx + 0x235]
lea eax, [ecx + 0x30]
jmp 0x401444
mov eax, dword [ecx + 0x3c5]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x16]
cmp edx, 0x10
lea esi, [eax + 6]
jl 0x401409
mov esi, dword [eax + 6]
push esi
lea eax, [ecx + 0x11d]
push eax
push dword [ecx + 0x221]
lea eax, [ecx + 0x1c]
jmp 0x401444
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x22]
cmp edx, 0x10
lea esi, [eax + 0x12]
jl 0x401433
mov esi, dword [eax + 0x12]
push esi
lea eax, [ecx + 0x131]
push eax
push dword [ecx + 0x235]
lea eax, [ecx + 0x30]
push eax
push 0x401048
push 0x401030
push dword [0x4010bc]
call dword [sym.imp.MSVCRT.DLL_sprintf]
push 0
push 0
push 0x4010e8
call dword [sym.imp.MSVCRT.DLL__beginthread]
mov edi, 0x4010d4
mov byte [edi], 0
mov byte [0x4010df], 0
xor eax, eax
leave
ret 4

Function at 0x4016d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x4016f0
cmp dword [ebp + 0xc], 1
jne 0x4016fc
push 0
push 0
push 0x401494
call dword [sym.imp.MSVCRT.DLL__beginthread]
jmp 0x4016fc
push dword [0x4010bc]
call dword [sym.imp.MSVCRT.DLL_free]
mov eax, 1
leave
ret 0xc