joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4365e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ecx, 0x743117
call fcn.00442547
lea eax, [ebp - 4]
push eax
call fcn.00436730
add esp, 4
test al, al
je 0x436722
push 0x71c460
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x436629
push 0x71c460
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x436722
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.CreateToolhelp32Snapshot
push ebx
call esi
mov edi, dword [ebp + 8]
push str.Process32First
push ebx
mov dword [edi], eax
call esi
push str.Process32Next
push ebx
mov dword [edi + 4], eax
call esi
push str.Module32First
push ebx
mov dword [edi + 8], eax
call esi
push str.Module32Next
push ebx
mov dword [edi + 0xc], eax
call esi
push str.Thread32First
push ebx
mov dword [edi + 0x10], eax
call esi
push str.Thread32Next
push ebx
mov dword [edi + 0x14], eax
call esi
push 0x71c4ec
push ebx
mov dword [edi + 0x18], eax
call esi
push str.OpenThread
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.VirtualAllocEx
push ebx
mov dword [edi + 0x20], eax
call esi
push str.VirtualFreeEx
push ebx
mov dword [edi + 0x24], eax
call esi
cmp byte [ebp - 4], 0
mov dword [edi + 0x28], eax
je 0x4366bb
mov dword [edi + 0x20], 0x436ea0
jmp 0x4366c1
cmp byte [ebp - 3], 0
je 0x4366cf
mov dword [edi + 0x28], 0x436fa0
mov dword [edi + 0x24], 0x436f50
cmp dword [edi], 0
je 0x436719
cmp dword [edi + 4], 0
je 0x436719
cmp dword [edi + 8], 0
je 0x436719
cmp dword [edi + 0xc], 0
je 0x436719
cmp dword [edi + 0x10], 0
je 0x436719
cmp dword [edi + 0x14], 0
je 0x436719
cmp dword [edi + 0x18], 0
je 0x436719
cmp dword [edi + 0x1c], 0
je 0x436719
cmp dword [edi + 0x20], 0
je 0x436719
cmp dword [edi + 0x24], 0
je 0x436719
cmp dword [edi + 0x28], 0
je 0x436719
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436730
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x73dd74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x743117
call fcn.00442547
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x43677d
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442579
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x94]
cmp eax, 1
jne 0x4367a3
cmp edx, 4
jne 0x4367a3
cmp ecx, 0xa
ja 0x4367a3
mov byte [esi], 1
jmp 0x4367b0
mov byte [esi], 0
cmp eax, 1
jne 0x4367b9
cmp edx, 4
jne 0x4367b9
cmp ecx, 0x5a
jb 0x4367b9
mov cl, 1
jmp 0x4367bb
xor cl, cl
cmp eax, 2
mov byte [esi + 1], cl
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
mov byte [esi + 2], al
mov al, 1
pop esi
call fcn.00442579
mov esp, ebp
pop ebp
ret
Function at 0x438870
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x7401b0], 0
jne 0x438889
push 0
push 0x10001
call fcn.0043c020
add esp, 8
ret
jmp fcn.004399b0

Function at 0x4399b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x73dd74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x50]
push 1
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x439a24
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x4c], 0x12
jne 0x439a02
mov esi, dword [0x740578]
test esi, esi
je 0x439a12
push esi
call fcn.004382d0
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x4399f1
jmp 0x439a12
lea eax, [ebp - 0x50]
push eax
call ebx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
call edi
test eax, eax
jne 0x4399e1
call dword [sym.imp.USER32.dll_GetActiveWindow]
test eax, eax
je 0x439aa2
push str.GLFW
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov ebx, eax
test ebx, ebx
je 0x439aa2
movaps xmm0, xmmword [0x71cae0]
xor esi, esi
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x71caf0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov edi, dword [ebp + esi*8 - 0x20]
push dword [ebp + esi*8 - 0x24]
movsx eax, word [edi*2 + 0x7410cc]
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x439a9c
cmp byte [edi + ebx + 0x70], 1
jne 0x439a9c
call fcn.0043ad80
push eax
push 0
push dword [ebp - 0x28]
push edi
push ebx
call fcn.00438cb0
add esp, 0x14
inc esi
cmp esi, 4
jl 0x439a60
mov esi, dword [0x741a68]
test esi, esi
je 0x439b15
lea eax, [ebp - 0x34]
push eax
push dword [esi + 0x2a4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
cmp dword [esi + 0x2c8], ecx
jne 0x439ae0
mov eax, edi
cdq
sub eax, edx
sar eax, 1
cmp dword [esi + 0x2cc], eax
je 0x439b15
mov eax, edi
mov dword [ebp - 0x2c], ecx
cdq
sub eax, edx
mov dword [esi + 0x2c8], ecx
sar eax, 1
mov dword [ebp - 0x28], eax
mov dword [esi + 0x2cc], eax
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00442579
mov esp, ebp
pop ebp
ret

Function at 0x43a420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
mov ecx, 0x7fffffff
cmp dword [ebp + 8], ebx
jle 0x43a46b
mov edx, dword [ebp + 0x10]
imul edx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x10], edx
nop
mov eax, dword [edi + 4]
mov esi, ecx
imul eax, dword [edi]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, edi
cmp eax, ecx
cmovl ecx, eax
cmp eax, esi
cmovge edx, ebx
add edi, 0xc
sub dword [ebp + 8], 1
mov ebx, edx
mov edx, dword [ebp + 0x10]
jne 0x43a440
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x43aa70
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x73dd74]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov dword [0x741a68], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x43aaca
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x741a58], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x741a60], xmm0
cmp dword [edi + 0x64], 0x34001
jne 0x43aaef
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x43aadf
push dword [eax + 4]
jmp 0x43aaf1
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x43aaf1
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push edi
call fcn.00438ac0
add esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [edi + 0x1e0], 0
je 0x43ab7e
mov eax, dword [edi + 0x2a4]
push 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 1
push eax
mov dword [ebp - 0x10], 0x20001
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x43ab7e
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.00440670
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00442579
mov esp, ebp
pop ebp
ret

Function at 0x43ab90
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1e0], 0
je 0x43abdc
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x43abdc
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.00440670
add esp, 8
push 0
mov dword [0x741a68], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x741a60]
cvttsd2si ecx, qword [0x741a58]
mov dword [ebp - 4], eax
mov dword [esi + 0x2cc], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2a4]
mov dword [ebp - 8], ecx
mov dword [esi + 0x2c8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x64], 0x34001
jne 0x43ac63
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x43ac4a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43ad80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
push 0x11
shr esi, 0xf
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 2
and ax, cx
push 0x12
cmove edi, esi
call ebx
mov ebx, edi
mov ecx, 0x8000
or ebx, 4
and ax, cx
push 0x5c
cmove ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push 0x5b
mov si, ax
call edi
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
call ebx
mov esi, edi
or esi, 0x10
and al, 1
push 0x90
cmove esi, edi
call ebx
mov ecx, esi
or ecx, 0x20
and al, 1
pop edi
cmove ecx, esi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x43d290
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x43d2ba
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.00440670
add esp, 8
xor eax, eax
pop ebp
ret
mov dword [ecx], 1
mov eax, 1
pop ebp
ret
Function at 0x440280
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x73dd74]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x741ba8], 0
mov dword [ebp - 0x10], str.libOSMesa.dll
mov dword [ebp - 0xc], str.OSMesa.dll
mov dword [ebp - 8], 0
je 0x4402c1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442579
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov dword [0x741ba8], eax
test eax, eax
jne 0x440309
mov eax, dword [ebp + esi*4 - 0xc]
inc esi
test eax, eax
jne 0x4402d0
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.0043c020
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442579
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push eax
call esi
push str.OSMesaCreateContextAttribs
push dword [0x741ba8]
mov dword [0x741bac], eax
call esi
push str.OSMesaDestroyContext
push dword [0x741ba8]
mov dword [0x741bb0], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x741ba8]
mov dword [0x741bb4], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x741ba8]
mov dword [0x741bb8], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x741ba8]
mov dword [0x741bbc], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x741ba8]
mov dword [0x741bc0], eax
call esi
cmp dword [0x741bac], 0
mov dword [0x741bc4], eax
je 0x4403ce
cmp dword [0x741bb4], 0
je 0x4403ce
cmp dword [0x741bb8], 0
je 0x4403ce
cmp dword [0x741bbc], 0
je 0x4403ce
cmp dword [0x741bc0], 0
je 0x4403ce
test eax, eax
je 0x4403ce
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442579
mov esp, ebp
pop ebp
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.0043c020
mov eax, dword [0x741ba8]
add esp, 8
test eax, eax
je 0x4403fa
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x741ba8], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00442579
mov esp, ebp
pop ebp
ret
Function at 0x440cd0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x73dd74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x6d1
push 0
push 0x741386
call sub.VCRUNTIME140.dll_memset
mov eax, 0x741426
lea ebx, [ebp - 0x160]
add esp, 0x18
mov dword [ebp - 0x164], eax
mov esi, 0x20
sub ebx, 0x480
nop dword [eax]
movsx edi, word [esi*2 + 0x7410cc]
cmp edi, 0xffffffff
je 0x440e64
cmp esi, 0x140
jb 0x440df3
cmp esi, 0x14e
ja 0x440df3
mov dword [ebp - 0x160], 0x60
mov dword [ebp - 0x15c], 0x61
mov dword [ebp - 0x158], 0x62
mov dword [ebp - 0x154], 0x63
mov dword [ebp - 0x150], 0x64
mov dword [ebp - 0x14c], 0x65
mov dword [ebp - 0x148], 0x66
mov dword [ebp - 0x144], 0x67
mov dword [ebp - 0x140], 0x68
mov dword [ebp - 0x13c], 0x69
mov dword [ebp - 0x138], 0x6e
mov dword [ebp - 0x134], 0x6f
mov dword [ebp - 0x130], 0x6a
mov dword [ebp - 0x12c], 0x6d
mov dword [ebp - 0x128], 0x6b
mov eax, dword [ebx]
jmp 0x440dfc
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x10
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x168], eax
push ecx
lea ecx, [ebp - 0x124]
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x440e3a
push 0
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push dword [ebp - 0x168]
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x440e5e
push 0
push 0
push 5
push dword [ebp - 0x164]
lea eax, [ebp - 0x24]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x164]
inc esi
add eax, 5
add ebx, 4
mov dword [ebp - 0x164], eax
cmp esi, 0x15c
jle 0x440d30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00442579
mov esp, ebp
pop ebp
ret
Function at 0x441140
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x73dd74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x739b84
call ebx
mov dword [0x741a78], eax
test eax, eax
jne 0x44118a
push str.Win32:_Failed_to_load_winmm.dll
push 0x10008
call fcn.00440670
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442579
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push eax
call edi
push str.user32.dll
mov dword [0x741a7c], eax
call ebx
mov dword [0x741a98], eax
test eax, eax
jne 0x4411d2
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.00440670
add esp, 8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442579
mov esp, ebp
pop ebp
ret
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x741a98]
mov dword [0x741a9c], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x741a98]
mov dword [0x741aa0], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x741a98]
mov dword [0x741aa4], eax
call edi
push str.GetDpiForWindow
push dword [0x741a98]
mov dword [0x741aa8], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x741a98]
mov dword [0x741aac], eax
call edi
push str.dinput8.dll
mov dword [0x741ab0], eax
call ebx
mov dword [0x741a80], eax
test eax, eax
je 0x441256
push str.DirectInput8Create
push eax
call edi
mov dword [0x741a84], eax
push esi
mov dword [ebp - 0x1c], str.xinput1_4.dll
xor esi, esi
mov dword [ebp - 0x18], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [ebp - 0x14], str.xinput9_1_0.dll
mov dword [ebp - 0x10], str.xinput1_2.dll
mov dword [ebp - 0xc], str.xinput1_1.dll
mov dword [ebp - 8], 0
push eax
call ebx
mov dword [0x741a8c], eax
test eax, eax
jne 0x44129f
mov eax, dword [ebp + esi*4 - 0x18]
inc esi
test eax, eax
jne 0x441288
jmp 0x4412be
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x741a8c]
mov dword [0x741a90], eax
call edi
mov dword [0x741a94], eax
push str.dwmapi.dll
call ebx
mov dword [0x741ab4], eax
pop esi
test eax, eax
je 0x441300
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x741ab4]
mov dword [0x741ab8], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x741ab4]
mov dword [0x741abc], eax
call edi
mov dword [0x741ac0], eax
push str.shcore.dll
call ebx
mov dword [0x741ac4], eax
test eax, eax
je 0x44132f
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x741ac4]
mov dword [0x741ac8], eax
call edi
mov dword [0x741acc], eax
push str.ntdll.dll
call ebx
mov dword [0x741ad0], eax
test eax, eax
je 0x44134c
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x741ad4], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.00442579
mov esp, ebp
pop ebp
ret
Function at 0x676c1ab0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov edx, 0x4009
mov ebp, esp
sub esp, 0x2e8
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x2bc]
mov ecx, 0x2b4
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._SHGetFileInfoW_20
sub esp, 0x14
test eax, eax
je 0x676c1af5
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebp - 0x2b8]
leave
ret

Function at 0x676c67c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x676c6830
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x676c6828
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x676d40a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x676c67ed
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x676c6e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x676c7048
mov edx, dword [0x676d40a4]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x676c7038
test byte [0x676c8068], 8
jne 0x676c6fe0
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x676c8078], 8
jne 0x676c6fa0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x676c6efb
cmp dword [ebp + 8], 3
jbe 0x676c6f60
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x676c6f0a
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x676d1518]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x676c6efb
mov dword [esp], 0x676c8078
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x676c6ed0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x676c6ed0
mov dword [esp], 0x676c8068
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x676c6ebd
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x676c6ec3
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x676c6f58
Function at 0x676c70d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 8], esi
mov esi, eax
mov eax, dword [0x676d40c0]
mov dword [ebp - 0xc], ebx
mov ebx, edx
mov dword [ebp - 4], edi
test eax, eax
je 0x676c7190
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x676c7118
mov eax, dword [ebx]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
lea edi, [ebp - 0x220]
mov eax, 0x104
mov dword [esp + 4], edi
mov esi, 0x104
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
mov ecx, str.MODULE
mov edx, dword [eax]
sub esp, 0xc
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
mov edx, dword [eax]
sub esp, 0xc
mov dword [esp + 8], edi
mov edi, str.SystemRoot
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x676c7102
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x676c71c6
mov dword [esp], eax
mov edx, 0x676d1528
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x676d40c0], eax
sub esp, 8
test eax, eax
jne 0x676c70f3
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x676c7104