joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62247b90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x44c
call fcn.6224f790
mov dword [ebx], eax
lea eax, [edi + 0xc]
mov dword [ebp - 0x42c], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edi, dword [0x6226d004]
sub esp, 4
test edi, edi
jne 0x62247d20
test esi, esi
je 0x62247d28
mov dword [esp], esi
call fcn.622539a0
mov esi, eax
test eax, eax
je 0x62247d88
lea edx, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x220]
sub esp, 0xc
mov dword [esp], edx
call fcn.622539a0
test eax, eax
je 0x62247d92
mov dword [esp + 4], 0x5c
mov dword [esp], eax
mov dword [ebp - 0x430], eax
call dword [sym.imp.ucrtbase.dll_strrchr]
mov edx, dword [ebp - 0x430]
test eax, eax
je 0x62247c43
mov byte [eax + 1], 0
test byte [0x62258078], 8
jne 0x62247ce0
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword [ebx]
mov dword [ebp - 0x430], edx
mov dword [esp], eax
mov ebx, dword fs:[0x18]
call dword [0x6226d05c]
mov dword [esp + 8], esi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x430]
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov eax, dword [ebp - 0x42c]
mov dword [0x6226d004], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], str.setting_base_dir:__s__config_path:__s_n
mov dword [esp + 8], str.RuntimeHost_GetDefaultDomain
mov dword [esp + 4], 0x62258078
mov dword [esp], 3
mov dword [ebp - 0x430], edx
call fcn.62246f10
mov edx, dword [ebp - 0x430]
jmp 0x62247c50
xor edi, edi
jmp 0x62247cb0
lea esi, [ebp - 0x428]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov edx, esi
sub esp, 0xc
cmp word [ebp - 0x428], 0
je 0x62247d69
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x62247d60
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x6225b15c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x62247d70
jmp 0x62247bd4
mov edi, 0x8007000e
jmp 0x62247cb0
mov dword [esp + 8], esi
mov edi, 0x8007000e
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x62247cb0
Function at 0x62248cc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x62248da0
call dword [0x6226d068]
mov ebx, eax
cmp eax, esi
je 0x62248ec0
mov dword [esp], esi
call dword [0x6226d020]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.622539a0
mov esi, eax
test eax, eax
je 0x62248dc0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [0x6226d034]
test eax, eax
je 0x62248dd0
mov dword [esp], eax
call dword [0x6226d074]
test eax, eax
je 0x62248e70
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dword [0x6226d03c]
test eax, eax
je 0x62248e20
mov dword [esp], eax
mov dword [ebp - 0x1c], eax
call dword [0x6226d02c]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
test ebx, ebx
je 0x62248d6f
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [0x6226d060]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0x10]
xor edx, edx
call fcn.62247b90
mov edi, eax
test eax, eax
js 0x62248d93
mov esi, dword [ebp + 0x10]
jmp 0x62248cd6
mov edi, 0x8007000e
jmp 0x62248d5a
mov edi, 0x80004005
test byte [0x62258078], 2
je 0x62248d5a
mov eax, dword [ebp + 0xc]
call fcn.62246c90
mov dword [esp + 0xc], str.Cannot_find_type__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.RuntimeHost_CreateManagedInstance
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
jmp 0x62248d5a
mov edi, 0x80004005
test byte [0x62258078], 2
je 0x62248d5a
mov eax, dword [ebp + 0xc]
call fcn.62246c90
mov dword [esp + 0xc], str.Cannot_allocate_object_of_type__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.RuntimeHost_CreateManagedInstance
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
jmp 0x62248d5a
mov edi, 0x80004005
test byte [0x62258078], 2
je 0x62248d5a
mov eax, dword [ebp + 0xc]
call fcn.62246c90
mov dword [esp + 0xc], str.Cannot_convert_type__s_to_a_class_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.RuntimeHost_CreateManagedInstance
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
jmp 0x62248d5a
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp], eax
call fcn.622539a0
mov esi, eax
test eax, eax
jne 0x62248d04
mov edi, 0x8007000e
jmp 0x62248d6f
Function at 0x6224a180
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6224a1f4
mov ebx, eax
mov dword [eax], 0x6225bee0
mov dword [eax + 4], 0x6225bea0
mov dword [eax + 0x24], 1
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebx + 0xc]
sub esp, 4
mov dword [eax + 0x18], str..._ValveSoftware_winegit_dlls_mscoree_corruntimehost.c:_RuntimeHost.lock
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
mov eax, 0x8007000e
jmp 0x6224a1ef

Function at 0x6224c5a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6224c5e8
mov edx, dword [ebp + 8]
mov dword [eax], 0x6225c2a0
mov dword [eax + 4], 1
mov dword [edx], eax
xor eax, eax
leave
ret
leave
mov eax, 0x8007000e
ret
Function at 0x6224c9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x15c
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6224d460
mov dword [esp], 0x6226d0a0
call dword [sym.imp.kernel32.dll_InitOnceExecuteOnce]
mov eax, dword [0x622580c0]
sub esp, 0x10
cmp eax, 0x622580c0
je 0x6224ca30
mov ebx, dword [sym.imp.ucrtbase.dll_strcmp]
lea edi, [eax - 8]
jmp 0x6224ca0d
mov eax, dword [edi + 8]
lea edi, [eax - 8]
cmp eax, 0x622580c0
je 0x6224ca30
mov eax, dword [edi]
mov dword [esp], esi
mov dword [esp + 4], eax
call ebx
test eax, eax
jne 0x6224ca00
mov eax, dword [edi + 4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x12c], 0x100
mov eax, dword [ebp + 8]
test eax, eax
je 0x6224ca80
lea eax, [ebp - 0x12c]
lea ebx, [ebp - 0x118]
mov dword [esp + 4], esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
je 0x6224cb20
mov dword [ebp - 0x12c], 0x100
mov edx, dword [ebp - 0x13c]
test edx, edx
je 0x6224cacc
lea eax, [ebp - 0x12c]
lea ebx, [ebp - 0x118]
mov dword [esp + 4], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
je 0x6224cb20
mov edi, str.Microsoft.Xna.Framework.
mov ecx, 0x1a
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
jne 0x6224cb0e
mov eax, dword [ebp - 0x140]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [0x6226d080]
cmp ax, 4
je 0x6224cb6e
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, ebx
mov ecx, eax
lea eax, [ebp - 0x128]
call fcn.6224c720
mov eax, dword [ebp - 0x124]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 8
jmp 0x6224ca1f

Function at 0x6224d260
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx + 4]
test byte [0x62258170], 8
jne 0x6224d2cd
mov dword [esp], 0x62258100
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6226d094]
sub esp, 4
test eax, eax
je 0x6224d2c4
cmp dword [0x6226d0e8], 0
jne 0x6224d2c4
mov ebx, 0x62258120
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6224d2b9
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.62248bd0
add ebx, 0x14
cmp ebx, 0x62258170
jne 0x6224d2a6
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6225c329
mov dword [esp + 8], str.CLRMetaHost_ExitProcess
mov dword [esp + 4], 0x62258170
mov dword [esp], 3
call fcn.6224d210
jmp 0x6224d27f
Function at 0x6224da70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [esp], eax
call fcn.622539a0
test eax, eax
je 0x6224db20
mov ebx, eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [0x6226d07c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test edi, edi
je 0x6224db20
test byte [0x62258170], 8
jne 0x6224dae0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call fcn.6224cc90
mov dword [esp + 0xc], str.found:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.mono_assembly_try_load
mov dword [esp + 4], 0x62258170
mov dword [esp], 3
call fcn.6224d210
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret

Function at 0x6224e710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
xor eax, eax
sub esp, 0x1c
nop
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x6224e720
cmp word [esi], 0
mov edx, esi
je 0x6224e749
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x6224e740
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str._binlibmono_2.0_x86.dll]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6224e750
mov dword [esp], esi
mov edi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
call edi
sub esp, 4
cmp eax, 0xffffffff
je 0x6224e790
cmp eax, 0xffffffff
setne al
lea esp, [ebp - 0xc]
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x6224e798
cmp word [esi], 0
mov edx, esi
je 0x6224e7b9
add edx, 2
cmp word [edx], 0
jne 0x6224e7b0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str._binmono_2.0.dll]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6224e7c0
mov dword [esp], esi
call edi
sub esp, 4
cmp eax, 0xffffffff
jne 0x6224e776
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x6224e7e8
cmp word [esi], 0
mov edx, esi
je 0x6224e809
add edx, 2
cmp word [edx], 0
jne 0x6224e800
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str._binlibmono_2.0.dll]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6224e810
mov dword [esp], esi
call edi
sub esp, 4
jmp 0x6224e776
Function at 0x6224e830
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x22c
cmp word [eax], 0
je 0x6224e950
mov edx, eax
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x6224e850
sub edx, edi
sar edx, 1
mov eax, str.wine_mono_8.1.0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6224e868
sub eax, str.wine_mono_8.1.0
mov dword [esp + 4], 0
sar eax, 1
lea eax, [edx + eax + 1]
add eax, eax
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6224e957
xor eax, eax
nop
movzx edx, word [edi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x6224e8b0
cmp word [ebx], 0
mov edx, ebx
je 0x6224e8d9
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x6224e8d0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.wine_mono_8.1.0]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6224e8e0
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.6224e710
mov edi, eax
test eax, eax
je 0x6224e920
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x6224e910
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
jmp 0x6224e85d
xor edi, edi
jmp 0x6224e944

Function at 0x6224e960
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x1c
mov eax, dword [0x6226d09c]
test eax, eax
je 0x6224e9e0
mov dword [esp], ebx
call eax
mov ebx, eax
test eax, eax
je 0x6224ea11
mov dword [esp + 8], 0x12
mov dword [esp + 4], str._unix_
mov dword [esp], eax
call sub.ucrtbase.dll_memcmp
mov edi, eax
test eax, eax
je 0x6224e9ae
mov edx, esi
mov eax, ebx
call fcn.6224e830
mov edi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.kernel32
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 4], str.wine_get_dos_file_name
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6226d09c], eax
sub esp, 8
test eax, eax
jne 0x6224e976
lea esp, [ebp - 0xc]
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
Function at 0x6224ea20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
lea ebx, [ebp - 0x418]
sub esp, 0x420
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov edx, ebx
sub esp, 8
cmp word [ebp - 0x418], 0
je 0x6224ea61
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x6224ea58
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.monomono_2.0]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6224ea68
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.6224e710
test eax, eax
jne 0x6224ea98
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x6224eaa0
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret

Function at 0x6224eac0
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
lea eax, [ebp - 0x430]
push ebx
xor ebx, ebx
sub esp, 0x44c
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineMono
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x6224eb00
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
lea eax, [ebp - 0x42c]
lea edi, [ebp - 0x428]
mov dword [ebp - 0x42c], 0x208
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x430]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.RuntimePath
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegGetValueW]
sub esp, 0x1c
test eax, eax
je 0x6224eb78
mov eax, dword [ebp - 0x430]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x220]
mov eax, edi
call fcn.6224e710
test eax, eax
je 0x6224eb56
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [edi + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x6224eb90
mov ebx, 1
jmp 0x6224eb56

Function at 0x6224f790
Capabilities:
Get process heap flags

Disassembly:
mov eax, dword [0x6226d0a4]
test eax, eax
je 0x6224f7a0
ret
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], 0x62258100
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6226d0a4]
sub esp, 4
test eax, eax
je 0x6224f7e0
mov dword [esp], 0x62258100
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [0x6226d0a4]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
call fcn.6224c660
mov dword [esp + 4], str.v4.0.30319
mov dword [esp], eax
mov ebx, eax
call dword [0x6226d04c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [0x6226d0a4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [0x6226d094], 1
sub esp, 0xc
jmp 0x6224f7c0
Function at 0x6224f890
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x6224f8c0
mov eax, dword [ebp + 8]
call fcn.6224ea20
test eax, eax
je 0x6224f8c0
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
call fcn.6224eac0
mov ebx, eax
test eax, eax
jne 0x6224f8ac
mov ecx, dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [esp], str.WINEDATADIR
mov edi, str.mono
mov dword [ebp - 0x1c], ecx
call ecx
mov ecx, dword [ebp - 0x1c]
test eax, eax
mov esi, eax
je 0x6224fa68
mov dword [esp], str.__unix_
call dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp + 4], str.__unix_
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
je 0x6224fa20
cmp word [esi + 8], 0
lea ecx, [esi + 8]
je 0x6224f93d
mov ebx, ecx
lea esi, [esi]
nop
add ebx, 2
cmp word [ebx], 0
jne 0x6224f930
sub ebx, ecx
sar ebx, 1
cmp word [edi], 0
je 0x6224f957
mov eax, edi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6224f948
sub eax, edi
sar eax, 1
add ebx, eax
lea ecx, [ebx + ebx + 2]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
sub esp, 0xc
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [esi + eax + 8]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x6224f988
cmp word [ebx], 0
mov edx, ebx
je 0x6224f9b1
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x6224f9a8
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6224f9b8
mov dword [esp + 8], 0x12
mov dword [esp + 4], str._unix_
mov dword [esp], ebx
call sub.ucrtbase.dll_memcmp
test eax, eax
je 0x6224fa88
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.6224e830
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test edi, edi
jne 0x6224f8ac
mov edx, dword [ebp + 8]
mov eax, str._home_runner_work_wine_tkg_git_wine_tkg_git_wine_tkg_git_experimental.wine.8.0.20231114c.r0.g0ebbd573f30_share_wine_mono
call fcn.6224e960
test eax, eax
jne 0x6224f8ac
mov edx, dword [ebp + 8]
mov eax, str._usr_share_wine_mono
call fcn.6224e960
test eax, eax
jne 0x6224f8ac
mov edx, dword [ebp + 8]
mov eax, str._opt_wine_mono
call fcn.6224e960
test eax, eax
setne al
movzx eax, al
jmp 0x6224f8b1
mov dword [esp], str.WINEBUILDDIR
mov edi, str...mono
call ecx
mov esi, eax
test eax, eax
jne 0x6224f8f2
jmp 0x6224fa20
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6224fa20
Function at 0x62250700
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [ebx], 0x6225d9c0
je 0x62250733
mov dword [esp + 8], 0x2bd
mov dword [esp + 4], str..._ValveSoftware_winegit_dlls_mscoree_metahost.c
mov dword [esp], str.This__ICLRRuntimeInfo_iface.lpVtbl__CLRRuntimeInfoVtbl
call dword [sym.imp.ucrtbase.dll__assert]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x62250748
mov dword [esi], eax
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
add esp, 0x10
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.6224fac0
Function at 0x622539a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call esi
sub esp, 0x20
mov edi, eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x62253a59
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call esi
sub esp, 0x20
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret