joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bd70
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4d54ac]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x46bd83
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x46bdc4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4d5554]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x46bdf6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x46bdfa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x46bdeb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x46be18
mov bl, byte [esp + ecx + 0x4c]
jmp 0x46be1c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x46be0d
xor ecx, ecx
mov eax, 0x4d54bc
xor ebx, ebx
mov bl, byte [ecx + 0x4d5564]
cmp byte [esp + ebx + 0x14], 0
je 0x46be47
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4d557c]
cmp byte [esp + ebx + 0x14], 0
je 0x46be5e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x46be2e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x46bdb7
lea edx, [esp + 0x84]
push edx
call fcn.0046bea0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x48517f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4851b7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00483236
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048320e
jmp 0x4851c3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x486879
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4868bb
call fcn.0048c38e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4868bb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4868b2
xor eax, eax
jmp 0x4868c3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004868c9
pop edi
pop esi
pop ebx
ret 4

Function at 0x48c8be
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48c8ec
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48c90a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048c824
jmp 0x48c90a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48c90a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048c824
test edi, edi
mov eax, edi
jne 0x48c8f4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x65544290
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x655442f0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544316
mov edx, 1
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_1_0_n
mov dword [esp + 8], str.create_vs10_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x655442a3
test byte [0x6555e028], 2
jne 0x6554432b
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs10_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6554431f

Function at 0x65544360
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x655443c0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x655443e6
mov edx, 0x101
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_1_1_n
mov dword [esp + 8], str.create_vs11_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544373
test byte [0x6555e028], 2
jne 0x655443fb
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs11_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x655443ef
Function at 0x65544430
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544490
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x655444b6
mov edx, 2
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_2_0_n
mov dword [esp + 8], str.create_vs20_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544443
test byte [0x6555e028], 2
jne 0x655444cb
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs20_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x655444bf

Function at 0x65544500
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544560
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544586
mov edx, 0x102
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldvs_output.constprop.0
mov dword [esp + 0xc], str.vs_2_x_n
mov dword [esp + 8], str.create_vs2x_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544513
test byte [0x6555e028], 2
jne 0x6554459b
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs2x_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6554458f

Function at 0x655445d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544630
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544656
mov edx, 3
mov dword [eax], 1
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.vs_3_0_n
mov dword [esp + 8], str.create_vs30_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x655445e3
test byte [0x6555e028], 2
jne 0x65544668
mov dword [ebx + 0xc], 2
jmp 0x65544627
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_vs30_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6554465f
Function at 0x65544690
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x655446f8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6554471e
mov edx, 1
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_0_n
mov dword [esp + 8], str.create_ps10_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x655446a3
test byte [0x6555e028], 2
jne 0x65544733
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps10_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x65544727

Function at 0x65544760
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x655447c8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x655447ee
mov edx, 0x101
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_1_n
mov dword [esp + 8], str.create_ps11_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544773
test byte [0x6555e028], 2
jne 0x65544803
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps11_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x655447f7
Function at 0x65544830
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544898
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x655448be
mov edx, 0x201
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_2_n
mov dword [esp + 8], str.create_ps12_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544843
test byte [0x6555e028], 2
jne 0x655448d3
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps12_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x655448c7

Function at 0x65544900
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544968
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6554498e
mov edx, 0x301
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_3_n
mov dword [esp + 8], str.create_ps13_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544913
test byte [0x6555e028], 2
jne 0x655449a3
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps13_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x65544997
Function at 0x655449d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544a38
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544a5e
mov edx, 0x401
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 6
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_4_n
mov dword [esp + 8], str.create_ps14_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x655449e3
test byte [0x6555e028], 2
jne 0x65544a73
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps14_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x65544a67

Function at 0x65544aa0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544b08
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544b2e
mov edx, 2
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 8
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_2_0_n
mov dword [esp + 8], str.create_ps20_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544ab3
test byte [0x6555e028], 2
jne 0x65544b43
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps20_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x65544b37
Function at 0x65544b70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544bd8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544bfe
mov edx, 0x102
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 8
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_2_x_n
mov dword [esp + 8], str.create_ps2x_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544b83
test byte [0x6555e028], 2
jne 0x65544c13
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps2x_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x65544c07

Function at 0x65544c40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6555e018], 8
jne 0x65544ca0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x65544cc6
mov edx, 3
mov dword [eax], 2
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.ps_3_0_n
mov dword [esp + 8], str.create_ps30_parser
mov dword [esp + 4], 0x6555e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x65544c53
test byte [0x6555e028], 2
jne 0x65544cd8
mov dword [ebx + 0xc], 2
jmp 0x65544c97
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps30_parser
mov dword [esp + 4], 0x6555e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x65544ccf
Function at 0x65545260
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x38
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6555e038], 8
jne 0x655452a0
test ebx, ebx
je 0x655452d0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x65561278
mov dword [esp + 8], str.d3dcompiler_blob_Release
mov dword [esp + 4], 0x6555e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test ebx, ebx
jne 0x6554528e
mov eax, dword [esi + 0xc]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1c], edx
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x655456b0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x6555e038], 8
jne 0x65545778
test esi, esi
je 0x655457e8
mov dword [esp + 8], 0x10
mov edx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6554589a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax], str._TTe
mov dword [eax + 4], 1
mov dword [eax + 8], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [ebx + 0xc], eax
sub esp, 0xc
test eax, eax
je 0x65545823
mov dword [esi], ebx
xor edi, edi
test byte [0x6555e038], 8
jne 0x655457b0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.data_size__Iu__blob__p._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6555e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x655456d6
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x655613b5
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6555e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov edi, 0x8876086c
test byte [0x6555e038], 4
je 0x65545761
mov dword [esp + 0xc], str.Invalid_blob_specified._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6555e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x65545761
call sym._d3dcompiler_blob_init.part.0
mov edi, eax
test eax, eax
jns 0x65545754
test byte [0x6555e038], 4
jne 0x65545870
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_initialize_blob__hr__lx._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6555e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x6554583b
mov edi, 0x8007000e
jmp 0x65545761
Function at 0x6554692a
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x6555e038], 8
jne 0x65546a08
cmp edi, 1
mov eax, 1
mov dword [esp], ebx
sbb eax, 0xffffffff
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x65546a48
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x10]
mov edi, eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], esi
call dword [eax + 0xc]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
test esi, esi
je 0x65546a70
cmp dword [ebp - 0x1c], edi
jne 0x65546a70
xor ebx, ebx
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.blob__p__filename__s__overwrite__x._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6555e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x65546949
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovg ebx, eax
lea esp, [ebp - 0x10]
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 0x80004005
test byte [0x6555e038], 4
je 0x655469f3
mov dword [esp + 0xc], str.Failed_to_write_blob_contents._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6555e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x655469f3