joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d5c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x402dce
push edi
push esi
call fcn.00401cf1
mov edi, eax
pop ecx
cmp edi, ebx
je 0x402dc6
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402dc6
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x40718c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402dc6
cmp dword [ebp + 8], ebx
je 0x402dc6
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
pop ebx
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push edi
call fcn.00401cfc
pop ecx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x402dd4
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.00401ecd
test eax, eax
pop ecx
je 0x402e30
cmp byte [esi + 1], 0x3a
jne 0x402e30
cmp byte [esi + 2], 0x5c
jne 0x402e30
push 4
lea eax, [ebp - 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x402e18
cmp eax, 4
jne 0x402e30
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402e30
and eax, 0x10
cmp al, 0x10
je 0x402e30
push 1
pop eax
jmp 0x402e32
xor eax, eax
pop esi
leave
ret

Function at 0x40309c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
je 0x403171
xor ecx, ecx
cmp byte [eax], 0x22
mov byte [ebp - 0xa18], 0x22
sete cl
mov edi, ecx
cmp edi, ebx
je 0x4030cb
inc eax
lea ecx, [ebp - 0xa17]
push 0x9ba
push ecx
push eax
call fcn.00402842
add esp, 0xc
test eax, eax
je 0x403171
cmp dword [ebp + 0xc], ebx
jne 0x40316c
cmp byte [ebp - 0xa17], 0x22
je 0x40316c
xor esi, esi
cmp edi, ebx
jne 0x40310e
lea eax, [ebp - 0xa18]
push 0x407214
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
cmp esi, ebx
lea eax, [ebp - 0xa17]
jne 0x403132
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403171
cmp dword [ebp - 0xc], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40315d
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x10], ebx
je 0x403167
push dword [ebp - 0x10]
call esi
push 1
pop eax
jmp 0x403173
push 1
pop esi
jmp 0x40310e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4045dd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x40a5ec], 0
push esi
je 0x40470a
cmp byte [0x40a5fc], 0
je 0x40464d
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 8]
push eax
push 0x40a578
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x404717
and byte [0x40a5fc], 0
call fcn.004048af
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040471a
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x40a5ec]
mov edx, dword [0x40a5f0]
mov dword [ecx + edx*4], eax
jmp 0x404717
cmp byte [0x40a5f4], 0
je 0x40469a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4071fc]
mov esi, eax
sub eax, dword [0x40a5f8]
imul ecx, ecx, 0xea60
cmp eax, ecx
jb 0x404717
call fcn.004048af
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040471a
mov eax, dword [0x40a5ec]
pop ecx
pop ecx
mov ecx, dword [0x40a5f0]
mov dword [eax + ecx*4], esi
jmp 0x404717
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x40a5f0]
mov esi, eax
mov eax, dword [0x40a5ec]
mov eax, dword [eax + ecx*4]
cmp eax, 0xffffffff
je 0x4046da
mov ecx, esi
sub ecx, eax
mov eax, dword [0x4071f4]
imul eax, eax, 0xea60
cmp ecx, eax
ja 0x4046da
call fcn.00404898
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004047d9
jmp 0x404715
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040471a
mov eax, dword [0x40a5f0]
pop ecx
pop ecx
mov ecx, dword [0x40a5ec]
mov dword [ecx + eax*4], esi
mov eax, dword [0x40a5f0]
inc eax
cdq
idiv dword [0x4071f8]
mov dword [0x40a5f0], edx
jmp 0x404717
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040471a
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x404898
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x40a5f8], eax
mov byte [0x40a5f4], 1
jmp fcn.00403fbf

Function at 0x405134
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
test eax, eax
mov dword [esi], eax
je 0x40516c
mov ecx, dword [esp + 0xc]
push 0
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xf001b
push 0
add ecx, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 4], eax
je 0x40516c
push 1
pop eax
jmp 0x405175
mov ecx, esi
call fcn.00405179
xor eax, eax
pop esi
ret 8
Function at 0x401d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x409633
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [0x40a178]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x40a17c]
push eax
mov ecx, esi
call dword [0x40a178]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [0x40a170]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4037f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x40d078]
xor eax, ebp
push edi
xor edx, edx
mov dword [esp + 0x214], eax
call fcn.00403680
test eax, eax
jne 0x4038aa
mov byte [esp + 8], al
mov ecx, 0x81
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x208
lea eax, [esp + 0xc]
push eax
push 0
call dword [0x40a048]
lea ecx, [esp + 8]
push 0x5c
push ecx
call dword [0x40a208]
add esp, 8
test eax, eax
je 0x40386d
mov edx, dword [str.rsrp.exe]
inc eax
mov dword [eax], edx
mov ecx, dword [0x40acfc]
mov dword [eax + 4], ecx
mov dl, byte [0x40ad00]
mov byte [eax + 8], dl
lea eax, [esp + 8]
push eax
call dword [0x40a078]
cmp eax, 0xffffffff
je 0x403892
push 5
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
call dword [0x40a2b0]
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, ebp
call fcn.004092bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x214]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.004092bc
mov esp, ebp
pop ebp
ret
Function at 0x403c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x40d078]
xor eax, ebp
mov dword [esp + 0x120], eax
xor eax, eax
cmp edx, eax
push edi
je 0x403d91
cmp esi, eax
je 0x403d91
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push str.SOFTWARERising_s
mov eax, 0x104
lea edi, [esp + 0x20]
mov dword [esp + 0x18], 1
call fcn.00407080
add esp, 8
lea eax, [esp + 8]
push eax
push 0x20019
push 0
mov ecx, edi
push ecx
push 0x80000002
call dword [0x40a004]
test eax, eax
jne 0x403d70
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push 0
push str.datapath
push ecx
mov dword [esp + 0x24], ebx
call dword [section..rdata]
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403d40
sub eax, edx
mov dword [esp + 0x14], eax
je 0x403d65
cmp ebx, 0x7fffffff
ja 0x403d65
push 0x40a65c
mov ecx, ebx
mov edi, esi
call fcn.004070e0
mov edx, dword [esp + 8]
push edx
call dword [0x40a010]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403d75
sub eax, edx
pop edi
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.004092bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.004092bc
mov esp, ebp
pop ebp
ret
Function at 0x4041c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x40d078]
xor eax, ebp
mov dword [esp + 0x11c], eax
xor eax, eax
push esi
mov esi, ecx
mov byte [esi], al
mov ecx, dword [0x40ac2c]
mov edx, dword [0x40ac30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [str.SOFTWARERising_]
mov dword [esp + 0x14], eax
mov eax, dword [0x40ac34]
mov dword [esp + 0x18], ecx
mov cl, byte [0x40ac38]
push edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], cl
mov dword [esp + 0x20], edx
xor eax, eax
mov ecx, 0x3d
lea edi, [esp + 0x29]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [0x40a13c]
push edx
call edi
mov ecx, 0x105
sub ecx, eax
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
call edi
lea eax, [esp + eax + 0x20]
push eax
call dword [0x40a09c]
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [0x40a004]
test eax, eax
jne 0x4042fd
mov edx, dword [esp + 0xc]
lea eax, [ebp + 8]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.installpath
push edx
mov dword [esp + 0x2c], 1
call dword [section..rdata]
test eax, eax
jne 0x4042d8
push 0x5c
push esi
call dword [0x40a208]
add esp, 8
test eax, eax
je 0x4042b2
mov cl, byte [eax + 1]
test cl, cl
jne 0x4042b2
mov byte [eax], 0
mov eax, dword [esp + 0xc]
push eax
mov esi, 1
call dword [0x40a010]
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.004092bc
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
push eax
call dword [0x40a010]
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.004092bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004092bc
mov esp, ebp
pop ebp
ret
Function at 0x6fb442b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44310
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44336
mov edx, 1
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_1_0_n
mov dword [esp + 8], str.create_vs10_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb442c3
test byte [0x6fb5e028], 2
jne 0x6fb4434b
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs10_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb4433f

Function at 0x6fb44380
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb443e0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44406
mov edx, 0x101
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_1_1_n
mov dword [esp + 8], str.create_vs11_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44393
test byte [0x6fb5e028], 2
jne 0x6fb4441b
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs11_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb4440f
Function at 0x6fb44450
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb444b0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb444d6
mov edx, 2
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_2_0_n
mov dword [esp + 8], str.create_vs20_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44463
test byte [0x6fb5e028], 2
jne 0x6fb444eb
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs20_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb444df

Function at 0x6fb44520
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44580
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb445a6
mov edx, 0x102
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_2_x_n
mov dword [esp + 8], str.create_vs2x_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44533
test byte [0x6fb5e028], 2
jne 0x6fb445bb
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs2x_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb445af

Function at 0x6fb445f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44650
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44676
mov edx, 3
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.vs_3_0_n
mov dword [esp + 8], str.create_vs30_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44603
test byte [0x6fb5e028], 2
jne 0x6fb44688
mov dword [ebx + 0xc], 2
jmp 0x6fb44647
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs30_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb4467f
Function at 0x6fb446b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44718
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb4473e
mov edx, 1
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_0_n
mov dword [esp + 8], str.create_ps10_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb446c3
test byte [0x6fb5e028], 2
jne 0x6fb44753
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps10_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb44747

Function at 0x6fb44780
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb447e8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb4480e
mov edx, 0x101
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_1_n
mov dword [esp + 8], str.create_ps11_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44793
test byte [0x6fb5e028], 2
jne 0x6fb44823
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps11_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb44817
Function at 0x6fb44850
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb448b8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb448de
mov edx, 0x201
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_2_n
mov dword [esp + 8], str.create_ps12_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44863
test byte [0x6fb5e028], 2
jne 0x6fb448f3
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps12_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb448e7

Function at 0x6fb44920
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44988
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb449ae
mov edx, 0x301
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_3_n
mov dword [esp + 8], str.create_ps13_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44933
test byte [0x6fb5e028], 2
jne 0x6fb449c3
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps13_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb449b7
Function at 0x6fb449f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44a58
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44a7e
mov edx, 0x401
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 6
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_4_n
mov dword [esp + 8], str.create_ps14_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44a03
test byte [0x6fb5e028], 2
jne 0x6fb44a93
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps14_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb44a87

Function at 0x6fb44ac0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44b28
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44b4e
mov edx, 2
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 8
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_2_0_n
mov dword [esp + 8], str.create_ps20_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44ad3
test byte [0x6fb5e028], 2
jne 0x6fb44b63
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps20_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb44b57