joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5418e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x63ee94]
sub esp, 0x50
mov dword [eax], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov byte [eax + 0x40], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov byte [eax + 0x5c], 0
mov dword [eax + 0x70], 0
mov dword [eax + 0x74], 0
push esi
mov byte [eax + 0x78], 0
push dword [ecx + 0x10]
mov ecx, dword [0x5e6fd4]
call fcn.0050a7b0
mov esi, eax
test esi, esi
jne 0x541970
push str.Miss__Invalid_Frame._n
push 0x279
push str.userworld_stateusermenu_abilitymss_ability_frame.cpp
call fcn.004301a0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call fcn.004429e0
movq xmm0, qword [ebp - 0x28]
mov eax, dword [0x6233ec]
movq qword [ebp - 0x50], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x48], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x40], xmm0
movq xmm0, qword [ebp - 0x10]
mov dword [ebp - 0x18], eax
movq qword [ebp - 0x38], xmm0
movq xmm0, qword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 9
call fcn.00442d10
movzx eax, word [esi + 0x36]
push eax
movzx eax, word [esi + 0x34]
push eax
movzx eax, word [esi + 0x32]
push eax
movzx eax, word [esi + 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00442860
lea eax, [ebp - 0x50]
push eax
call fcn.00442d10
add esp, 0x20
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x541a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x63ee98]
sub esp, 0x50
mov dword [eax], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov byte [eax + 0x40], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov byte [eax + 0x5c], 0
mov dword [eax + 0x70], 0
mov dword [eax + 0x74], 0
push esi
mov byte [eax + 0x78], 0
push dword [ecx + 0x10]
mov ecx, dword [0x5e6fd4]
call fcn.0050a7b0
mov esi, eax
test esi, esi
jne 0x541a90
push str.Miss__Invalid_Frame._n
push 0x4cc
push str.userworld_stateusermenu_abilitymss_ability_frame.cpp
call fcn.004301a0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call fcn.004429e0
movq xmm0, qword [ebp - 0x28]
mov eax, dword [0x6233ec]
movq qword [ebp - 0x50], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x48], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x40], xmm0
movq xmm0, qword [ebp - 0x10]
mov dword [ebp - 0x18], eax
movq qword [ebp - 0x38], xmm0
movq xmm0, qword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 9
call fcn.00442d10
movzx eax, word [esi + 0x36]
push eax
movzx eax, word [esi + 0x34]
push eax
movzx eax, word [esi + 0x32]
push eax
movzx eax, word [esi + 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00442860
lea eax, [ebp - 0x50]
push eax
call fcn.00442d10
add esp, 0x20
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x541f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58540b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi]
mov dword [esi + 0x64], 0
mov dword [esi + 8], 0
call dword [eax + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push 2
mov ecx, esi
call dword [eax + 0x48]
push 0x90
call fcn.00425cc0
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x541fe8
push fcn.004159f0
push 0x540370
push 5
lea edi, [eax + 4]
push 0x1c
push edi
mov dword [eax], 5
call fcn.0057d2d4
jmp 0x541fea
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x63ee94], edi
test edi, edi
jne 0x542012
push str._nMiss__Cant_Allocate._n
push 0x151
push str.userworld_stateusermenu_abilitymss_ability_frame.cpp
call fcn.004301a0
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [0x5e6fd4]
inc eax
push eax
call fcn.0050a7b0
movzx ecx, word [eax + 0x32]
mov dx, word [eax + 0x30]
mov esi, dword [0x63ee94]
mov word [ebp + 0xa], cx
mov word [esi + 0xa], dx
mov word [ebp + 8], dx
mov ecx, dword [ebp + 8]
shr ecx, 0x10
mov word [esi + 0xc], cx
mov edx, dword [eax + 0x1c]
movzx eax, word [edx + 0x32]
mov cx, word [edx + 0x30]
mov word [ebp + 0xa], ax
mov word [esi + 0x26], cx
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
shr eax, 0x10
mov word [esi + 0x28], ax
mov edx, dword [edx + 0x1c]
movzx eax, word [edx + 0x32]
mov cx, word [edx + 0x30]
mov word [ebp + 0xa], ax
mov word [esi + 0x42], cx
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
shr eax, 0x10
mov word [esi + 0x44], ax
mov edx, dword [edx + 0x1c]
movzx eax, word [edx + 0x32]
mov cx, word [edx + 0x30]
mov word [ebp + 0xa], ax
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
mov word [esi + 0x5e], cx
shr eax, 0x10
mov word [esi + 0x60], ax
mov eax, dword [edx + 0x1c]
mov cx, word [eax + 0x30]
movzx eax, word [eax + 0x32]
mov word [ebp + 0xa], ax
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
shr eax, 0x10
mov word [esi + 0x7a], cx
mov word [esi + 0x7c], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5420e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58540b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi]
mov dword [esi + 0x64], 0
mov dword [esi + 8], 0
call dword [eax + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push 3
mov ecx, esi
call dword [eax + 0x48]
push 0x90
call fcn.00425cc0
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x542168
push fcn.004159f0
push 0x540370
push 5
lea edi, [eax + 4]
push 0x1c
push edi
mov dword [eax], 5
call fcn.0057d2d4
jmp 0x54216a
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x63ee98], edi
test edi, edi
jne 0x542192
push str._nMiss__Cant_Allocate._n
push 0x3d8
push str.userworld_stateusermenu_abilitymss_ability_frame.cpp
call fcn.004301a0
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [0x5e6fd4]
inc eax
push eax
call fcn.0050a7b0
movzx ecx, word [eax + 0x32]
mov dx, word [eax + 0x30]
mov esi, dword [0x63ee98]
mov word [ebp + 0xa], cx
mov word [esi + 0xa], dx
mov word [ebp + 8], dx
mov ecx, dword [ebp + 8]
shr ecx, 0x10
mov word [esi + 0xc], cx
mov edx, dword [eax + 0x1c]
movzx eax, word [edx + 0x32]
mov cx, word [edx + 0x30]
mov word [ebp + 0xa], ax
mov word [esi + 0x26], cx
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
shr eax, 0x10
mov word [esi + 0x28], ax
mov edx, dword [edx + 0x1c]
movzx eax, word [edx + 0x32]
mov cx, word [edx + 0x30]
mov word [ebp + 0xa], ax
mov word [esi + 0x42], cx
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
shr eax, 0x10
mov word [esi + 0x44], ax
mov edx, dword [edx + 0x1c]
movzx eax, word [edx + 0x32]
mov cx, word [edx + 0x30]
mov word [ebp + 0xa], ax
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
mov word [esi + 0x5e], cx
shr eax, 0x10
mov word [esi + 0x60], ax
mov eax, dword [edx + 0x1c]
mov cx, word [eax + 0x30]
movzx eax, word [eax + 0x32]
mov word [ebp + 0xa], ax
mov word [ebp + 8], cx
mov eax, dword [ebp + 8]
shr eax, 0x10
mov word [esi + 0x7a], cx
mov word [esi + 0x7c], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x57a380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586c38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push 0
push dword [esi]
call fcn.0057c610
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], edi
mov dword [edi], vtable.world::WTAlarmAttrSE.0
mov eax, dword [esi + 4]
mov dword [edi + 0x2c], eax
cmp dword [edi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x38], eax
movzx eax, byte [esi + 0x14]
mov byte [edi + 0x3c], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0x3d], al
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], 0
jne 0x57a421
push str.Pointer_must_not_be_NULL__pc__
push 0xd8
push str.userworld_taskuserwt_attr_se.cpp
call fcn.004301a0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x57a440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586c38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eae84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push 0
push dword [esi]
call fcn.0057c610
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], edi
mov dword [edi], vtable.world::WTTrapAttrSE.0
mov eax, dword [esi + 4]
mov dword [edi + 0x2c], eax
cmp dword [edi + 0x2c], 0
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x38], eax
movzx eax, byte [esi + 0x14]
mov byte [edi + 0x3c], al
movzx eax, byte [esi + 0x15]
mov dword [ebp - 4], 0
mov byte [edi + 0x3d], al
mov byte [edi + 0x3e], 0
jne 0x57a4d4
push str.Pointer_must_not_be_NULL__pc__
push 0x104
push str.userworld_taskuserwt_attr_se.cpp
call fcn.004301a0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x57e060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
call sub.SDL2.dll_SDL_SetMainReady
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042ae90
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR110.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x57e090
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.SDL2.dll_SDL_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 4]
push edx
push str.UCS_2_INTERNAL
push str.UTF_8
call sub.SDL2.dll_SDL_iconv_string
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x57e0d6
call fcn.0057e340
jmp 0x57e144
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.0057e150
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
lea edx, [ecx*4 + 4]
push edx
call sub.SDL2.dll_SDL_malloc
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x57e10a
call fcn.0057e340
jmp 0x57e144
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0057e150
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0057e060
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
call sub.SDL2.dll_SDL_free
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call sub.SDL2.dll_SDL_free
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x28
mov byte [ebp - 0x11], 0x1a
test byte [0x425010], 8
jne 0x403ec0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x403ef2
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [ebp - 0x10]
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov esi, eax
test eax, eax
jne 0x403ea0
test byte [0x425010], 2
jne 0x403f43
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov esi, 1
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._wine_dbgstr_wn.constprop.5
mov dword [esp + 0xc], str.Appending_EOF_to__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.WCMD_AppendEOF
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.6
jmp 0x403ddc
xor esi, esi
test byte [0x425010], 2
je 0x403e90
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, edi
call sym._wine_dbgstr_wn.constprop.5
mov dword [esp + 0xc], str.Failed_to_open__s___ld__n
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.WCMD_AppendEOF
mov dword [esp + 4], 0x425010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.6
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, edi
mov dword [ebp - 0x18], edx
call sym._wine_dbgstr_wn.constprop.5
mov edx, dword [ebp - 0x18]
mov dword [esp + 0xc], str.Failed_to_append_EOF_to__s___ld__n
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.WCMD_AppendEOF
mov dword [esp + 4], 0x425010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.6
jmp 0x403e84
Function at 0x407ae0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
sub esp, 4
mov ebx, eax
lea eax, [ebp - 0x22]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
jne 0x407b20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movsx esi, word [ebp - 0x20]
movsx eax, word [ebp - 0x22]
lea edi, [ebp - 0x28]
mov dword [esp], ebx
mov dword [esp + 0x10], edi
add esi, 1
mov dword [esp + 0xc], 0
imul esi, eax
mov dword [esp + 4], 0x20
mov dword [esp + 8], esi
call dword [sym.imp.kernel32.dll_FillConsoleOutputCharacterW]
movzx eax, word [ebp - 0x1a]
sub esp, 0x14
mov dword [esp + 0x10], edi
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FillConsoleOutputAttribute]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_SetConsoleCursorPosition]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a450
Capabilities:
Create directory

Disassembly:
push ebp
mov ecx, dword fs:[0x18]
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
xor eax, eax
cmp word [0x434460], 0
je 0x40a5a1
lea esi, [esi]
lea ecx, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym._WCMD_parameter
mov ebx, dword [ebp - 0x10]
mov edi, eax
test ebx, ebx
je 0x40a5b5
movzx ebx, word [eax + 2]
lea edx, [eax + 4]
cmp bx, 0x3a
cmovne edx, eax
cmp word [eax], 0
mov esi, edx
jne 0x40a4d8
jmp 0x40a5c0
movzx ebx, word [eax + 2]
add eax, 2
test bx, bx
jne 0x40a4d4
sub eax, edi
sar eax, 1
lea eax, [eax + eax - 2]
add eax, edi
cmp eax, esi
jne 0x40a4fd
jmp 0x40a503
xor ecx, ecx
sub eax, 2
mov word [eax + 2], cx
cmp eax, esi
je 0x40a503
cmp word [eax], 0x5c
je 0x40a4f0
movzx eax, word [esi]
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryW]
lea esi, [esi]
cmp ax, 0x5c
je 0x40a563
test ax, ax
je 0x40a570
lea esi, [esi]
nop
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x40a531
cmp ax, 0x5c
jne 0x40a520
test ax, ax
je 0x40a570
xor eax, eax
mov word [esi], ax
mov dword [esp + 4], 0
mov dword [esp], edi
call ebx
mov edx, 0x5c
sub esp, 8
mov word [esi], dx
test eax, eax
jne 0x40a563
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x34], 0xb7
jne 0x40a590
movzx eax, word [esi + 2]
add esi, 2
jmp 0x40a510
mov dword [esp + 4], 0
mov dword [esp], edi
call ebx
sub esp, 8
test eax, eax
je 0x40a590
mov eax, dword [ebp - 0x14]
jmp 0x40a480
call dbg.WCMD_print_error
mov dword [0x4386f0], 1
jmp 0x40a584
mov dword [esp], 0x3f2
call sym._WCMD_LoadMessage
mov dword [esp], eax
call dbg.WCMD_output_stderr
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xfffffffe
jmp 0x40a4e8
Function at 0x4101a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, dword [0x42f344]
test eax, eax
je 0x410320
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x21c
mov ebx, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov dword [esp + 4], str.ENABLEDELAYEDEXPANSION
mov dword [esp], 0x434460
call ebx
test eax, eax
jne 0x4102b0
mov edi, 1
test byte [0x425010], 8
jne 0x410283
mov dword [esp + 4], 0x14
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_LocalAlloc]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x4102e5
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
call sym._WCMD_dupenv
mov dword [ebx + 8], eax
test eax, eax
je 0x410321
mov eax, dword [0x42f344]
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [0x430440]
mov dword [0x430440], ebx
mov dword [ebx], eax
mov eax, dword [0x42f340]
mov dword [0x42f340], edi
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x214]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
movzx eax, word [ebp - 0x214]
sub esp, 8
mov word [ebx + 4], ax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Setting_delayed_expansion_to__d_n
mov dword [esp + 8], str.WCMD_setlocal
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.6
jmp 0x4101ea
mov dword [esp + 4], str.ENABLEDELAYEDEXPANSION
mov dword [esp], 0x430460
call ebx
test eax, eax
je 0x4101d8
mov dword [esp + 4], str.DISABLEDELAYEDEXPANSION
mov dword [esp], 0x434460
call ebx
test eax, eax
jne 0x410332
xor edi, edi
jmp 0x4101dd
test byte [0x425010], 2
je 0x41027b
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.WCMD_setlocal
mov dword [esp + 4], 0x425010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.6
jmp 0x41027b
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
jmp 0x41026f
mov dword [esp + 4], str.DISABLEDELAYEDEXPANSION
mov dword [esp], 0x430460
call ebx
test eax, eax
je 0x4102de
mov edi, dword [0x42f340]
jmp 0x4101dd
Function at 0x411060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x4110a0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.WCMD_print_error
mov edi, dword [sym.imp.kernel32.dll_LocalAlloc]
mov dword [esp + 4], 0x14
mov dword [esp], 0
call edi
sub esp, 8
mov esi, eax
mov dword [esp + 4], 0x800
mov dword [esp], 0
call edi
sub esp, 8
mov edi, eax
test esi, esi
je 0x411153
xor eax, eax
mov edx, 0x2f
test edi, edi
jne 0x4110ea
jmp 0x411153
movzx edx, word [eax + 0x42875e]
mov word [eax + 0x438700], dx
add eax, 2
test dx, dx
jne 0x4110e3
mov dword [esp + 4], edi
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov dword [0x4386f0], 0
sub esp, 8
mov dword [esp], ebx
call dbg.WCMD_setshow_default
mov eax, dword [0x4386f0]
test eax, eax
jne 0x4111a0
mov edx, dword [0x430444]
mov dword [esi + 8], edi
mov eax, 1
mov dword [esi], edx
test edx, edx
je 0x411142
mov eax, dword [edx + 4]
add eax, 1
mov dword [esi + 4], eax
mov dword [0x430444], esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.kernel32.dll_LocalFree]
mov dword [esp], esi
call ebx
sub esp, 4
mov dword [esp], edi
call ebx
sub esp, 4
test byte [0x425010], 2
je 0x41114b
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.WCMD_pushd
mov dword [esp + 4], 0x425010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.6
jmp 0x41114b
mov ebx, dword [sym.imp.kernel32.dll_LocalFree]
mov dword [esp], esi
call ebx
sub esp, 4
mov dword [esp], edi
call ebx
sub esp, 4
jmp 0x41114b
Function at 0x4117e0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x80c
movzx edx, word [0x434460]
mov eax, dword [ebp + 8]
or dx, word [0x430460]
je 0x411830
cmp word [eax], 0x3d
lea edx, [eax + 2]
mov dword [esp], 0x428838
cmove eax, edx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
sub esp, 8
test eax, eax
je 0x411824
mov ebx, dword [ebp - 4]
leave
ret
call dbg.WCMD_print_error
mov ebx, dword [ebp - 4]
leave
ret
lea ebx, [ebp - 0x804]
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], 0x428838
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
je 0x411880
mov dword [esp], 0x428842
call sym._WCMD_output_asis
mov dword [esp], ebx
call sym._WCMD_output_asis
mov dword [esp], 0x427120
call sym._WCMD_output_asis
jmp 0x41181f
mov dword [esp], 0x406
call sym._WCMD_LoadMessage
mov dword [esp], eax
call dbg.WCMD_output_stderr
jmp 0x41181f

Function at 0x4118a0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
movzx eax, word [0x434460]
test ax, ax
je 0x4118f3
cmp ax, 0x20
sete cl
cmp ax, 0x3d
sete dl
or cl, dl
mov edx, 0x434460
jne 0x4118d0
cmp ax, 9
jne 0x411910
add edx, 2
movzx eax, word [edx]
cmp ax, 0x3d
sete bl
cmp ax, 0x20
sete cl
or bl, cl
jne 0x4118d0
cmp ax, 9
je 0x4118d0
test ax, ax
jne 0x411910
mov dword [esp + 4], 0
mov dword [esp], 0x42884e
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
mov dword [esp + 4], edx
mov dword [esp], 0x42884e
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret
Function at 0x412ec0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], 0x434460
call dword [sym.imp.ucrtbase.dll_wcstol]
mov ebx, eax
mov eax, dword [0x42f344]
test eax, eax
je 0x412f2b
mov dword [esp + 4], 0x4289ba
mov dword [esp], 0x438700
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x412f2b
mov eax, dword [0x42f344]
mov dword [0x4386f0], ebx
mov dword [eax + 0x38], 1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExitProcess]