joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ee69
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push edi
xor edi, 0x8b68
sub edi, 0x56df
pop edi
push edx
or edx, 0xe4fa
or edx, 0x550
xor edx, 0x166dd
call fcn.0041ecac
add byte [esi], bh
cmp cl, byte [eax + edx*2 + 0x46]
push eax
add esp, 4
pop edx
lea eax, [ebp - 0xc50]
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6d4], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x34], cx
push edi
and edi, 0xe948
sub edi, 0x7c8a
and edi, 0xb673
jmp 0x41ecf4
pop edi
push edi
push edi
add esp, 4
or edi, 0xa03e
sub edi, 0x10c12
jmp 0x41ed0b
pop edi
mov edx, dword [ebp - 0x6d4]
mov ax, word [edx]
mov word [ebp - 0x88e], ax
mov ecx, dword [ebp - 0x6d4]
add ecx, 2
mov dword [ebp - 0x6d4], ecx
mov dx, word [ebp - 0x88e]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6d8]
mov cx, word [eax]
mov word [ebp - 0x890], cx
mov edx, dword [ebp - 0x6d8]
add edx, 2
mov dword [ebp - 0x6d8], edx
mov ax, word [ebp - 0x890]
mov word [ebp - 0x34], ax
push edi
push edx
add esp, 4
or edi, 0x104ea
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xbe6d
pop ecx
push edx
and edx, 0xa84f
sub edx, 0x213c
xor edx, 0xa583
add edx, 0x12526
pop edx
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x41edb2
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0xb98], edx
jmp 0x41ee0c
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x41ecda
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x41ecda
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x41edf6
mov dword [ebp - 0xb94], 0xffffffff
jmp 0x41ee00
mov dword [ebp - 0xb94], 1
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], ecx
cmp dword [ebp - 0xb98], 0
jne 0x41ee55
push edx
or edx, 0x23dd
add edx, 0xe652
add edx, 0xdeea
xor edx, 0x181cf
pop edx
push eax
or eax, 0x11f09
add eax, 0xd80d
pop eax
push esi
jmp 0x41ee46
pop esi
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x18c], edx
jmp 0x41eebd
push ebx
push ebx
add esp, 4
call 0x41ee69
add byte [esi + 0x41], al
xor eax, 0x3c324845
cmp byte [esi - 0x7d], cl
les eax, [ebx + ebx*2]
push edx
push esi
add esp, 4
and edx, 0x8fce
and edx, 0x98c6
jmp 0x41ee86
pop edx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x41eeb3
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x41ec7e
mov dword [ebp - 0x18c], 0
Function at 0x6de867a0
Capabilities:
Check if process is running under wine
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
sub esp, 0x4c
mov dword [ebp - 0x2c], edx
mov ebx, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp], str.SoftwareWineDirectInputMappings_s_s_s
call ebx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [esp], ecx
call ebx
mov ecx, dword [ebp - 0x30]
mov dword [esp], esi
add ecx, eax
mov dword [ebp - 0x30], ecx
call ebx
mov dword [esp], edi
mov dword [ebp - 0x34], eax
call ebx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
lea edx, [ecx + edx + 1]
add edx, eax
lea eax, [edx + edx]
mov dword [ebp - 0x30], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x6de86886
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x14], edi
mov ebx, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], str.SoftwareWineDirectInputMappings_s_s_s
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._swprintf
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6de86870
lea eax, [ebp - 0x1c]
mov dword [esp + 4], ebx
mov esi, 0
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
cmove esi, dword [ebp - 0x1c]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
sub esp, 8
jmp 0x6de86831
xor esi, esi
jmp 0x6de86860
Function at 0x6de8aff0
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyA]
mov dword [eax], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x6dea3870
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
test eax, eax
je 0x6de8b030
mov dword [ebx], 0
lea edi, [ebp - 0x12c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
dec eax
sub esp, 0xc
cmp eax, 0x102
jbe 0x6de8b078
mov edx, dword [ebx]
mov eax, 1
test edx, edx
je 0x6de8b13f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x130]
mov dword [esp + 4], str.SoftwareWineAppDefaults
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call esi
sub esp, 0xc
test eax, eax
jne 0x6de8b05a
mov edx, dword [sym.imp.ucrtbase.dll_strrchr]
mov dword [esp], edi
mov dword [esp + 4], 0x2f
mov dword [ebp - 0x13c], edx
call edx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 4], 0x5c
lea ecx, [eax + 1]
test eax, eax
cmovne edi, ecx
mov dword [esp], edi
call edx
test eax, eax
lea edx, [eax + 1]
cmovne edi, edx
mov dword [esp], edi
call sym._strlen
add eax, edi
mov dword [eax], 0x7269445c
mov dword [eax + 4], 0x49746365
mov dword [eax + 8], 0x7475706e
mov byte [eax + 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6de8b11e
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebx]
mov eax, 1
sub esp, 4
test edx, edx
jne 0x6de8b069
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
setne al
lea esp, [ebp - 0xc]
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret

Function at 0x6de8b160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x6de8b1a8
lea edx, [ebp + 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x6de8b1f0
test ebx, ebx
je 0x6de8b1db
lea eax, [ebp + 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x6de8b1f0
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6de8d0d0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x5c]
push ecx
mov edi, ebx
sub esp, 0xb8
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x74], 0x6f0063
mov edx, dword [ecx + 8]
mov ecx, 0x11
mov dword [ebp - 0x70], 0x74006e
mov dword [ebp - 0x8c], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6c], 0x6f0072
mov dword [ebp - 0x68], 0x2e006c
mov dword [ebp - 0x64], 0x780065
mov dword [ebp - 0x60], 0x65
test byte [0x6dea003c], 8
jne 0x6de8d200
test esi, esi
je 0x6de8d15e
mov dword [ebp - 0x90], edx
mov dword [esp], esi
call dword [sym.imp.user32.dll_IsWindow]
mov edx, dword [ebp - 0x90]
sub esp, 4
test eax, eax
je 0x6de8d267
test edx, edx
jne 0x6de8d260
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x6de8d250
lea eax, [ebp - 0x84]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x74]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
jne 0x6de8d1eb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovg eax, edx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, dword [ebp - 0x8c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.iface__p__owner__p__flags__lx._n
mov dword [esp + 8], str.dinput7_RunControlPanel
mov dword [esp + 4], 0x6dea003c
mov dword [esp], 3
mov dword [ebp - 0x90], edx
call sym._wine_dbg_log.constprop.0_2
mov edx, dword [ebp - 0x90]
jmp 0x6de8d13a
mov eax, 0x80070015
jmp 0x6de8d1eb
mov eax, 0x80070057
jmp 0x6de8d1eb
mov eax, 0x80070006
jmp 0x6de8d1eb
Function at 0x6de93a40
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov edi, dword [ecx]
mov ebx, dword [edi + 0x18]
mov eax, dword [ebx + 0x954]
movzx esi, word [ebx + 0xb72]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x93c]
mov dword [ebp - 0x30], eax
mov eax, ebx
test byte [0x6dea0114], 8
jne 0x6de93b38
add eax, 0x20
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x18]
mov eax, 0x80040205
sub esp, 4
cmp dword [ecx + 0x4c8], 1
je 0x6de93ac8
add ecx, 0x20
mov dword [ebp - 0x2c], eax
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [ecx + 0x4c0], 1
je 0x6de93aa1
mov edx, dword [edi + 0xc]
test edx, edx
je 0x6de93c99
mov eax, 0x7b
mov dword [esp + 0x10], esi
mov word [ebp - 0x1e], ax
mov eax, dword [edi + 0x150]
mov dword [ebp - 0x1c], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcd4]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de93b70
and dword [edi + 0x14c], 0xfffffffe
mov ecx, dword [edi + 0x18]
jmp 0x6de93aa1
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.iface__p._n
mov dword [esp + 8], str.hid_joystick_effect_Stop
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov eax, dword [edi + 0x18]
jmp 0x6de93a81
mov dword [esp + 0x1c], esi
mov eax, dword [edi + 0x150]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], 0x22
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf
mov dword [esp], 1
call sym._HidP_SetUsageValue_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de93b22
mov dword [esp + 0x1c], esi
mov eax, dword [edi + 0x150]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcdc]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de93b22
mov dword [esp + 0x1c], esi
mov eax, dword [edi + 0x150]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0x7c
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf
mov dword [esp], 1
call sym._HidP_SetUsageValue_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de93b22
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov eax, dword [edi + 0x150]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
cmp eax, 1
sbb eax, eax
and eax, 0x8007001e
jmp 0x6de93b22
mov eax, 0x80040203
jmp 0x6de93aa1
Function at 0x6de93d90
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov ebx, dword [ecx]
mov esi, dword [ebx + 0x18]
movzx edi, word [esi + 0xb72]
test byte [0x6dea0114], 8
jne 0x6de93e70
lea eax, [esi + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [ebx + 0xc]
mov eax, 1
sub esp, 4
test edx, edx
je 0x6de93e45
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x20]
sub esp, 4
test eax, eax
js 0x6de93e45
mov ecx, dword [esi + 0xdc4]
test ecx, ecx
je 0x6de93f80
movzx ecx, byte [esi + 0xdc8]
test cl, cl
jne 0x6de93ea0
mov dword [ebx + 0x144], 0xffffffff
lea edi, [esi + 0xcc0]
mov dword [ebx + 0xc], 0
mov ebx, dword [esi + 0xcc0]
lea ecx, [ebx - 0x10]
cmp edi, ebx
jne 0x6de93e3e
jmp 0x6de93f70
mov ebx, dword [ecx + 0x10]
lea ecx, [ebx - 0x10]
cmp edi, ebx
je 0x6de93f70
mov edx, dword [ecx + 0xc]
test edx, edx
je 0x6de93e30
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x20]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p_n
mov dword [esp + 8], str.hid_joystick_effect_Unload
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de93dbd
mov dword [esp + 0x10], edi
mov eax, dword [esi + 0xbb0]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x954]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
jne 0x6de93e07
mov dword [esp + 0x1c], edi
mov eax, dword [esi + 0xbb0]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x954]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0xc], 0x22
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf
mov dword [esp], 1
call sym._HidP_SetUsageValue_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de93e07
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov eax, dword [esi + 0xbb0]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
cmp eax, 1
sbb eax, eax
and eax, 0x8007001e
jmp 0x6de93e07
or dword [esi + 0x930], 1
jmp 0x6de93e45
mov ecx, dword [ebx + 0xc]
mov byte [esi + ecx + 0xbbf], 0
jmp 0x6de93e07
Function at 0x6de940a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
movzx esi, word [ebx + 0xb72]
mov edi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94158
movzx eax, byte [ebx + 0xdb0]
test al, al
je 0x6de9414a
mov edx, dword [ebx + 0xdb8]
test edx, edx
je 0x6de9414a
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov edx, dword [ebx + 0x954]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 1
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
jne 0x6de9414c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xdb8]
mov edx, edi
mov dword [esp], eax
mov eax, ebx
call sym._set_report_value
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94185
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p._n
mov dword [esp + 8], str.hid_joystick_send_device_gain
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de940c6
mov eax, 0x8007001e
jmp 0x6de9414c
Function at 0x6de94190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de941d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de94210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a