joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016380
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x10
mov ebx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x10], ebx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x100164ba
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x100164c4
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0x20
mov dword [esp + 8], 0x84
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x1001656d
mov dword [esp + 8], 0x108
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x1001651d
mov eax, dword [ebp + 8]
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x18], eax
mov eax, dword [ebx]
mov dword [eax + 4], 1
mov eax, dword [ebx + 4]
mov dword [eax + 8], 0
mov dword [edi], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
mov dword [edi + 4], eax
sub esp, 0xc
test eax, eax
je 0x100164f4
mov eax, dword [ebp + 8]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x20
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], eax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi], 0
mov edx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
sub esp, 0xc
jmp 0x100164ba
mov eax, dword [edi]
call sym.___gl_pqHeapDeletePriorityQ
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x100164ba
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov edx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov edx, dword [ebp - 0x10]
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [edi], 0
mov edx, dword [ebp - 0x10]
sub esp, 0xc
jmp 0x100164d0
mov dword [esp + 8], ebx
mov edx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [edi], 0
mov edx, dword [ebp - 0x10]
sub esp, 0xc
jmp 0x100164d0
Function at 0x100165a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10016624
mov eax, dword [ebx]
test eax, eax
je 0x100165bb
call sym.___gl_pqHeapDeletePriorityQ
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 4]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x12b
mov dword [esp + 4], str._home_runner_build_wine_wine_dlls_glu32_priorityq.c
mov dword [esp], str.pq___NULL
call dword [sym.imp.ucrtbase.dll__assert]
jmp sym.___gl_pqSortInit
Function at 0x10016ac0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x14]
test edx, edx
jne 0x10016b50
mov ebx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
lea edx, [ebx + 1]
mov dword [esi + 0xc], edx
cmp edx, eax
jge 0x10016b08
cmp ebx, 0x7fffffff
je 0x10016ca4
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ebx*4], ecx
not ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esi + 4]
lea edx, [eax + eax]
shl eax, 3
mov dword [esi + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov dword [esi + 4], eax
sub esp, 0x10
test eax, eax
jne 0x10016ae3
mov dword [esi + 4], edi
mov ebx, 0x7fffffff
jmp 0x10016afa
mov esi, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [esi]
lea edi, [eax + 1]
mov eax, dword [esi + 0xc]
lea ecx, [edi + edi]
mov dword [esi + 8], edi
cmp ecx, eax
jg 0x10016bc8
mov ebx, dword [esi + 0x10]
test ebx, ebx
jne 0x10016c58
lea eax, [edi*8]
mov ebx, edi
mov dword [edx + edi*4], ebx
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
mov dword [edx + eax + 4], edi
mov edx, dword [esi + 4]
mov dword [edx + eax], ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x10016c70
cmp ebx, 0x7fffffff
jne 0x10016afa
mov dword [esp + 8], 0xd3
mov dword [esp + 4], str._home_runner_build_wine_wine_dlls_glu32_priorityq.c
mov dword [esp], str.free_handle___LONG_MAX
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]
mov ecx, dword [esi + 4]
add eax, eax
mov ebx, dword [sym.imp.kernel32.dll_HeapReAlloc]
mov dword [ebp - 0x14], edx
mov dword [esi + 0xc], eax
lea eax, [eax*4 + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [ebp - 0x18], ecx
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub esp, 0x10
test eax, eax
mov dword [esi], eax
je 0x10016c98
mov eax, dword [esi + 0xc]
lea eax, [eax*8 + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov dword [esi + 4], eax
sub esp, 0x10
test eax, eax
je 0x10016c81
mov edx, dword [esi]
jmp 0x10016b67
mov ecx, dword [esi + 4]
lea eax, [ebx*8]
mov ecx, dword [ecx + eax + 4]
mov dword [esi + 0x10], ecx
jmp 0x10016b7b
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov ecx, edi
call sym._FloatUp.isra.0
jmp 0x10016b99
mov eax, dword [ebp - 0x18]
mov ebx, 0x7fffffff
mov dword [esi + 4], eax
jmp 0x10016afa
mov dword [esi], edx
mov ebx, 0x7fffffff
jmp 0x10016afa
mov dword [esp + 8], 0x195
mov dword [esp + 4], str._home_runner_build_wine_wine_dlls_glu32_priorityq.c
mov dword [esp], str.curr___LONG_MAX
call dword [sym.imp.ucrtbase.dll__assert]
jmp sym.___gl_pqSortExtractMin
Function at 0x10018410
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0xc
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x10018461
mov dword [eax], 0x186a0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x186b4
mov dword [eax + 0xc], 0x186ac
mov dword [eax + 0x10], 0
leave
ret

Function at 0x10018470
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
leave
ret 4

Function at 0x1001d8c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0xc
jmp 0x1001d8ee
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [esi]
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [ebx]
test eax, eax
jne 0x1001d8f7
mov edi, dword [edi + 8]
mov eax, dword [edi]
test eax, eax
jne 0x1001d8d8
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x1001d937
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov dword [edx + 8], eax
mov dword [eax + 8], edi
mov dword [edi + 4], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1001d940
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x18
movsd qword [ebp - 0x18], xmm0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x1001da63
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym.___gl_meshMakeEdge
mov ebx, eax
test eax, eax
je 0x1001da20
mov eax, dword [ebx + 0x10]
movsd xmm1, qword [ebp - 0x18]
mov dword [eax + 0x28], 0x2e5096af
mov dword [eax + 0x2c], 0x5f338d35
mov eax, dword [ebx + 0x10]
movsd qword [eax + 0x30], xmm1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x28], 0x2e5096af
mov dword [eax + 0x2c], 0xdf338d35
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x10]
movsd qword [eax + 0x30], xmm1
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 0x68]
mov eax, dword [eax + 0x10]
lea edx, [ecx + 0x10]
mov dword [esi], ebx
mov dword [esi + 8], 0
mov dword [edi + 0x70], eax
lea eax, [ecx + 0xc]
mov dword [esp], esi
mov dword [esi + 0xc], 0x100
call sym._dictInsertBefore.isra.0
mov dword [esi + 4], eax
test eax, eax
je 0x1001da40
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea eax, [edi + 0xd38]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_longjmp]
jmp 0x1001d9a2
add edi, 0xd38
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_longjmp]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea eax, [edi + 0xd38]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_longjmp]
jmp 0x1001d98d

Function at 0x1001da80
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x10
mov dword [ebp - 0x10], edx
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x1001db11
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi + 0x68]
mov dword [esp], ebx
mov dword [ebx], esi
mov ecx, dword [ecx]
lea edx, [eax + 0x10]
add eax, 0xc
call sym._dictInsertBefore.isra.0
mov dword [ebx + 4], eax
test eax, eax
je 0x1001daf8
xor eax, eax
mov dword [esi + 0x18], ebx
mov word [ebx + 0xe], ax
mov eax, ebx
mov byte [ebx + 0xd], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add edi, 0xd38
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_longjmp]
jmp 0x1001dadd
lea eax, [edi + 0xd38]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_longjmp]
jmp 0x1001dabe
Function at 0x1001dc90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0xc
cmp byte [ebx + 0xf], 0
mov eax, dword [eax]
je 0x1001dcaa
mov edx, dword [eax + 0x1c]
test edx, edx
jne 0x1001dd0c
mov dword [eax + 0x18], 0
mov eax, dword [ebx + 4]
mov edi, dword fs:[0x18]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ecx + 8], edx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x107
mov dword [esp + 4], str._home_runner_build_wine_wine_dlls_glu32_sweep.c
mov dword [esp], str.reg__eUp__winding__0
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]
Function at 0x1001ff00
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ecx
sub esp, 0x10
mov dword [esp + 8], 0xd80
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x1002000e
pxor xmm0, xmm0
xor edx, edx
mov ecx, sym._noVertex_4
mov dword [eax], 0
mov word [eax + 0x78], dx
mov edx, sym._noEnd_0
movd xmm1, ecx
mov ecx, sym._noBegin_4
movups xmmword [eax + 0x10], xmm0
pxor xmm0, xmm0
movsd qword [eax + 0x20], xmm0
movsd qword [eax + 0x58], xmm0
movd xmm0, edx
mov edx, sym._noEdgeFlag_4
punpckldq xmm1, xmm0
movd xmm2, edx
movd xmm0, ecx
mov edx, sym.___gl_noEndData_4
punpckldq xmm0, xmm2
mov ecx, sym.___gl_noVertexData_8
mov dword [eax + 0x60], 0x18722
punpcklqdq xmm0, xmm1
movd xmm1, ecx
mov ecx, sym.___gl_noBeginData_8
mov dword [eax + 0xc], sym._noError_4
movups xmmword [eax + 0x80], xmm0
movd xmm0, edx
mov edx, sym.___gl_noEdgeFlagData_8
punpckldq xmm1, xmm0
movd xmm2, edx
movd xmm0, ecx
mov dword [eax + 0x74], sym._noCombine_16
mov dword [eax + 0x90], sym._noMesh_4
punpckldq xmm0, xmm2
mov dword [eax + 0xd30], 0x1001fec0
punpcklqdq xmm0, xmm1
mov dword [eax + 0xd34], 0x1001fcf0
mov dword [eax + 0xd78], 0
movups xmmword [eax + 0xd20], xmm0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x10020690
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x100206d0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4
xor edx, edx
mov eax, ebx
call sym._GotoState
jmp 0x100206a0

Function at 0x10021330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 2
je 0x10021348
mov edx, 2
mov eax, ebx
call sym._GotoState
mov dword [ebx], 1
mov dword [ebp + 8], ebx
pop ebx
pop ebp
jmp sym.glu32.dll_gluTessEndPolygon

Function at 0x10021440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10021498
cmp byte [esi + ebx - 1], 0xa
je 0x1002146c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1002ac84], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10021ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10021c98
mov edi, dword [0x1002ac84]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10021ba7
test byte [0x10022030], 8
jne 0x10021c40
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10022040], 8
jne 0x10021c00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10021b49
cmp esi, 3
jbe 0x10021bb8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x10021b5a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10025bb8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10021b49
mov dword [esp], 0x10022040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10021b20
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10021b20
mov dword [esp], 0x10022030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10021b0b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10021b13
mov eax, 0xffffffff
jmp 0x10021ba7
Function at 0x407e2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430c50]
jne 0x407e39
repz ret
jmp fcn.0040c56d

Function at 0x40b2c0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406060
and dword [ebp - 4], 0
cmp dword [0x43a620], 0
mov ebx, eax
jne 0x40b371
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b422
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b422
push eax
call fcn.00405fee
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43a620], eax
call esi
push eax
call fcn.00405fee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43a624], eax
call esi
push eax
call fcn.00405fee
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43a628], eax
call esi
push eax
call fcn.00405fee
pop ecx
mov dword [0x43a630], eax
test eax, eax
je 0x40b371
push 0x42cf10
push edi
call esi
push eax
call fcn.00405fee
pop ecx
mov dword [0x43a62c], eax
mov eax, dword [0x43a62c]
cmp eax, ebx
je 0x40b3c9
cmp dword [0x43a630], ebx
je 0x40b3c9
push eax
call fcn.00406069
push dword [0x43a630]
mov esi, eax
call fcn.00406069
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b3c9
test edi, edi
je 0x40b3c9
call esi
test eax, eax
je 0x40b3c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b3c0
test byte [ebp - 0xc], 1
jne 0x40b3c9
or dword [ebp + 0x10], 0x200000
jmp 0x40b402
mov eax, dword [0x43a624]
cmp eax, ebx
je 0x40b402
push eax
call fcn.00406069
pop ecx
test eax, eax
je 0x40b402
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b402
mov eax, dword [0x43a628]
cmp eax, ebx
je 0x40b402
push eax
call fcn.00406069
pop ecx
test eax, eax
je 0x40b402
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43a620]
call fcn.00406069
pop ecx
test eax, eax
je 0x40b422
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b424
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401430
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x414010]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x40d240]
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov ebx, ecx
push eax
push str.ShockwaveFlash.ShockwaveFlash
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x401549
test ebx, ebx
jne 0x40147f
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b4f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push str.D27CDB6B_AE6D_11cf_96B8_444553540000
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x401549
lea eax, [ebp - 0x28]
push eax
push 0x409
push 0
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_LHashValOfNameSys]
mov edi, eax
test edi, edi
jne 0x40153e
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x40153e
push esi
call fcn.00401b9e
add esp, 4
mov dword [ebp - 0x38], eax
push eax
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40153e
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x411cf0
push dword [ebp - 0x38]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40153e
cmp dword [ebp - 0x30], edi
je 0x40153e
mov ecx, dword [ebp - 0x34]
cmp dword [ecx], 0xfeef04bd
jne 0x40153e
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x411cf4
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [ebp - 0x28]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b4f
mov esp, ebp
pop ebp
ret