joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63a05630
Capabilities:
Get process heap flags
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [0x63a08140]
mov edi, dword [ecx]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 4], edi
mov dword [ebp - 0x24], eax
call eax
sub esp, 8
test byte [0x63a08048], 8
jne 0x63a057e9
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [esp], 0x63a08160
lea esi, [edi + 0x14]
mov dword [ebp - 0x20], eax
call eax
lea eax, [edi + 0x1c]
mov ebx, dword [edi]
mov dword [ebp - 0x1c], eax
sub esp, 4
lea esi, [esi]
nop
test ebx, ebx
jne 0x63a056d4
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 0x63a08160
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SleepConditionVariableCS]
sub esp, 0xc
test eax, eax
jne 0x63a05760
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x5b4
mov ebx, dword [edi]
jne 0x63a05690
test ebx, ebx
je 0x63a05770
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x14]
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.__vcomp_fork_call_wrapper
mov eax, dword [ebp - 0x20]
mov dword [esp], 0x63a08160
call eax
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [edi], 0
sub esp, 4
mov dword [edx + 4], eax
mov edx, dword [edi + 0x14]
mov dword [eax], edx
mov eax, dword [0x63a08148]
mov dword [edi + 0x14], 0x63a08144
mov dword [edi + 0x18], eax
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [0x63a08148], esi
inc eax
mov dword [ebx + 8], eax
cmp eax, dword [ebx + 4]
jl 0x63a05694
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WakeAllConditionVariable]
sub esp, 4
jmp 0x63a05694
mov ebx, dword [edi]
jmp 0x63a05690
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test byte [0x63a08048], 8
jne 0x63a05816
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x63a08140]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0
call eax
mov eax, dword [0x63a08150]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibraryAndExitThread]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.starting_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a0566c
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.terminating_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a05797
Function at 0x63a05850
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
test byte [0x63a08048], 8
jne 0x63a05890
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a058c0
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 8]
leave
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x63a0a088
mov dword [esp + 8], str._vcomp_get_thread_num
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a0586a
call sym._vcomp_init_thread_data.part.0
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 8]
leave
lea esp, [ecx - 4]
ret

Function at 0x63a05940
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
test byte [0x63a08048], 8
jne 0x63a05988
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a059b0
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
leave
test eax, eax
lea esp, [ecx - 4]
sete al
movzx eax, al
ret
mov dword [esp + 0xc], 0x63a0a088
mov dword [esp + 8], str._vcomp_master_begin
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a0595a
call sym._vcomp_init_thread_data.part.0
jmp 0x63a0596f

Function at 0x63a05b80
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [0x63a08140]
mov esi, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x63a05c40
mov edi, dword [ebx + 4]
test byte [0x63a08048], 8
jne 0x63a05c10
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x24]
sub esp, 4
inc eax
mov dword [ebx + 0x24], eax
mov edx, eax
sub edx, dword [edi + 4]
test edx, edx
jle 0x63a05bea
mov dword [edi + 4], eax
mov dword [edi + 8], esi
mov dword [edi + 0xc], 0
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__d__n
mov dword [esp + 8], str._vcomp_sections_init
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a05bbd
call sym._vcomp_init_thread_data.part.0
mov ebx, eax
jmp 0x63a05bb1
Function at 0x63a05c50
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x1c
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x63a05d00
mov esi, dword [ebx + 4]
test byte [0x63a08048], 8
jne 0x63a05cd0
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
sub esp, 4
cmp dword [ebx + 0x24], eax
jne 0x63a05d10
mov ebx, dword [esi + 0xc]
cmp ebx, dword [esi + 8]
je 0x63a05d10
lea eax, [ebx + 1]
mov dword [esi + 0xc], eax
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x63a0a088
mov dword [esp + 8], str._vcomp_sections_next
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a05c8a
call sym._vcomp_init_thread_data.part.0
mov ebx, eax
jmp 0x63a05c7e
mov ebx, 0xffffffff
jmp 0x63a05cb0

Function at 0x63a05d20
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x63a08048], 8
jne 0x63a05d78
test ebx, ebx
jg 0x63a05d50
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a05da8
mov dword [eax + 0x10], ebx
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__n
mov dword [esp + 8], str._vcomp_set_num_threads
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a05d3d
call sym._vcomp_init_thread_data.part.0
jmp 0x63a05d65

Function at 0x63a05db0
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [0x63a08140]
mov esi, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x63a05e68
mov edi, dword [ebx + 4]
test byte [0x63a08048], 8
jne 0x63a05e38
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x20]
sub esp, 4
inc eax
mov dword [ebx + 0x20], eax
mov edx, eax
sub edx, dword [edi]
xor ebx, ebx
test edx, edx
jle 0x63a05e15
mov dword [edi], eax
mov ebx, 1
mov dword [esp], 0x63a08160
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__x_:_semi_stub_n
mov dword [esp + 8], str._vcomp_single_begin
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a05ded
call sym._vcomp_init_thread_data.part.0
mov ebx, eax
jmp 0x63a05de1
Function at 0x63a05ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test byte [0x63a08048], 2
jne 0x63a05ee0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_allocate_critical_section_n
mov dword [esp + 8], str.alloc_critsect
mov dword [esp + 4], 0x63a08048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x63a05ecf
Function at 0x63a06ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x63a06bfb
cmp byte [esi + ebx - 1], 0xa
je 0x63a06bcf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x63a08138], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x63a06cc0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x63a08048], 8
jne 0x63a06d30
mov ebx, dword [ebx]
test ebx, ebx
je 0x63a06d1c
mov eax, dword [ebx]
mov dword [eax + 0x18], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_destroy_lock
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a06cdd

Function at 0x63a06ea0
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a06f20
mov ebx, dword [eax]
test byte [0x63a08048], 8
jne 0x63a06ef0
mov eax, 1
test ebx, ebx
je 0x63a06ede
mov eax, dword [ebx + 4]
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x63a0a088
mov dword [esp + 8], str.omp_get_num_threads
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a06ed2
call sym._vcomp_init_thread_data.part.0
jmp 0x63a06ec7

Function at 0x63a06f30
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
test byte [0x63a08048], 8
jne 0x63a06f70
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a06fa0
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 8]
leave
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x63a0a088
mov dword [esp + 8], str.omp_get_thread_num
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a06f4a
call sym._vcomp_init_thread_data.part.0
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 8]
leave
lea esp, [ecx - 4]
ret
Function at 0x63a06ff0
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
test byte [0x63a08048], 8
jne 0x63a07030
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a07060
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
leave
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x63a0a088
mov dword [esp + 8], str.omp_in_parallel
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a0700a
call sym._vcomp_init_thread_data.part.0
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
leave
lea esp, [ecx - 4]
ret

Function at 0x63a07070
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
test byte [0x63a08048], 8
jne 0x63a070e0
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x63a0710a
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebx]
sub esp, 4
mov dword [eax + 0x18], str..._src_wine_dlls_vcomp_main.c:_critsect
mov dword [esi], ebx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_init_lock
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a0708e
call sym._alloc_critsect.part.0
nop

Function at 0x63a07160
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x63a08048], 8
jne 0x63a071b0
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIsCriticalSectionLockedByThread]
sub esp, 4
test eax, eax
jne 0x63a071da
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 4], 0x63a08048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x63a0717d
test byte [0x63a08048], 2
jne 0x63a071f0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [ebx]
mov dword [esp + 0xc], str.omp_set_lock_called_while_holding_lock__p_n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x63a08048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x63a071e3
Function at 0x63a07580
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x63a08140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x63a075d9
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x63a08140]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
leave
ret

Function at 0x63a075e0
Capabilities:
Get process heap flags
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 8], 0x60
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x63a07684
mov dword [eax + 0x38], 0
mov ebx, eax
lea eax, [eax + 0x38]
mov dword [eax + 4], 0
mov dword [eax + 0x10], 0
mov dword [eax - 0x38], 0
mov dword [ebx + 4], eax
mov eax, dword [0x63a08140]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x20], 1
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x28], 1
mov dword [ebx + 0x2c], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
test byte [0x63a08048], 2
jne 0x63a0769a
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_create_thread_data_n
mov dword [esp + 8], str.vcomp_init_thread_data
mov dword [esp + 4], 0x63a08048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x63a0768d
Function at 0x401508
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x401577
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x4015a5
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403064
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015bf
pop esi
ret
push edi
push 0
push 0x16e4df
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015f4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401601
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401652
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40165e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401660
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100022de
pop dword [ebp - 0x30]
mov eax, 0xe1845370
sub eax, 0xd1843092
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x749e7eff
add dword [ebp - 0x40], 0xd9b3c64c
mov dword [ebp - 0x3c], 0x8dd7a0f8
sub dword [ebp - 0x3c], 0x5ba454b3
mov dword [ebp - 0x38], 0xafe734c7
add dword [ebp - 0x38], 0x9c650f67
mov dword [ebp - 0x34], 0xd52b4a40
add dword [ebp - 0x34], 0x2ad4b5c0
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x11b2c05
sub dword [ebp - 0x40], 0x8ca8c2af
mov dword [ebp - 0x3c], 0x74ae5a54
sub dword [ebp - 0x3c], 0x3341f8df
mov dword [ebp - 0x38], 0xef22562d
add dword [ebp - 0x38], 0x744d163f
mov dword [ebp - 0x34], 0x5cd36a21
add dword [ebp - 0x34], 0xa32c95df
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xab44eff4
add eax, 0x64bb4014
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x349a6
push 0
call eax
mov ecx, 0xc6885489
add ecx, 0x3977ebee
xor ebx, ebx
add ebx, eax
mov edx, 0x9688d229
add edx, 0x79778fd7
add edx, dword [ebp - 0x30]
mov edi, 0xa6919f9c
add edi, 0x86622974
add dword [ebp - 8], ebx
mov esi, dword [edx]
add dword [ebp - 0x1c], 0xa7791b2c
sub esi, edi
xor dword [ebp - 8], edx
mov dword [ebx], esi
add ebx, 0x8b71d06c
add ebx, 0x748e2f98
add edx, 4
loop 0x100023fd
add eax, 0xe355ef19
sub eax, 0xe354fa6a
xor ebx, ebx
add ebx, eax
add eax, 0xf8072f4d
add eax, 0x7f8d0b8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10031e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10031e6f
pop dword [ebp - 0x4c]
mov eax, 0xf033a3
sub eax, 0xf0ed1534
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x69e78940
sub dword [ebp - 0x5c], 0x1b9543f5
mov dword [ebp - 0x58], 0xe3e1312e
add dword [ebp - 0x58], 0x4e521b17
mov dword [ebp - 0x54], 0xf153c79c
add dword [ebp - 0x54], 0x5af87c92
mov dword [ebp - 0x50], 0x5103bcb
add dword [ebp - 0x50], 0xfaefc435
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xbc0b9530
add eax, 0x541d5af8
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9c3411b7
add dword [ebp - 0x5c], 0xd83e579f
mov dword [ebp - 0x58], 0x8a9da4d5
add dword [ebp - 0x58], 0xb6cebca0
mov dword [ebp - 0x54], 0xfc12214d
add dword [ebp - 0x54], 0x675d4b1f
mov dword [ebp - 0x50], 0x954e7192
sub dword [ebp - 0x50], 0x954e7192
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xce601101
add eax, 0x41c8df23
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x6ea87
push 0
call eax
mov ecx, 0x5ef9
mov ebx, eax
mov esi, 0x1031ac00
add esi, dword [ebp - 0x4c]
mov edx, 0x1247d89a
add edx, 0x906a3c47
mov dword [ebp - 0x24], 0x521889fc
mov edi, dword [esi]
add dword [ebp - 0x3c], 0xaad82f6c
xor edi, edx
xor dword [ebp - 4], 0xc8f24ade
mov dword [ebx], edi
xor dword [ebp - 0x40], ebx
add ebx, 0x8b4deece
add ebx, 0x74b21136
add esi, 0x480c5715
sub esi, 0x480c5711
loop 0x10031f85
add eax, 0x86b3a837
add eax, 0x794dc680
mov ebx, eax
add eax, 0x900f8bd9
sub eax, 0x900f8bd4
mov ecx, 0xf57521f8
sub ecx, 0xe57521f8
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret