joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4253f8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x425493
mov eax, dword [ebp - 4]
call fcn.00421a94
xor edx, edx
push ebp
push 0x42548c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x42543a
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
test eax, eax
je 0x425453
push 0xffffffffffffffff
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetClipboardData
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00421d88
push ebx
call sub.user32.dll_CallWindowProcA
mov edx, dword [ebp - 4]
mov eax, dword [0x467788]
call fcn.004183a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425493
mov eax, dword [ebp - 4]
call fcn.00421c00
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x43733c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
push ebx
call sub.user32.dll_EnableWindow
push 0
mov eax, dword [esp + 8]
sub eax, edi
push eax
mov eax, dword [esp + 8]
sub eax, esi
push eax
push ebx
call sub.user32.dll_GetKeyboardState
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x43cd60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x180], 0
je 0x43ce58
mov edi, dword [ebx]
cmp edi, 0x7b
jne 0x43cda0
cmp dword [esi + 0x30], 0
je 0x43cda0
mov eax, dword [ebx + 8]
push eax
mov ecx, dword [ebx + 4]
mov edx, edi
mov eax, dword [esi + 0x30]
call fcn.00439bb4
mov ebp, eax
mov dword [ebx + 0xc], ebp
test ebp, ebp
jne 0x43ce61
mov edi, dword [ebx]
mov eax, edi
add eax, 0xfffffece
sub eax, 7
jb 0x43cdba
add eax, 0xffff4407
sub eax, 7
jb 0x43cdd4
jmp 0x43ce13
mov ebp, dword [ebx + 8]
push ebp
mov eax, dword [ebx + 4]
push eax
add edi, 0xbc00
push edi
push ebp
call fcn.00406a50
mov dword [ebx + 0xc], eax
jmp 0x43ce3f
mov eax, dword [esi + 0x68]
mov eax, dword [eax + 0x18]
call fcn.004209f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyState
mov eax, dword [esi + 0x170]
call fcn.00421674
call fcn.004209f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
mov eax, dword [esi + 0x170]
call fcn.004216b0
mov dword [ebx + 0xc], eax
jmp 0x43ce3f
cmp edi, dword [0x469b2c]
jne 0x43ce20
mov dword [ebx + 0xc], esi
jmp 0x43ce3f
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
push edi
mov eax, dword [esi + 0x180]
push eax
mov eax, dword [esi + 0x174]
push eax
call fcn.00406690
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
cmp eax, 0xc
jne 0x43ce61
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.004385a0
jmp 0x43ce61
mov edx, ebx
mov eax, esi
call fcn.00439e14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100014c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80c]
mov esi, edx
push ebx
sub esp, 0x810
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0xd
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
je 0x10001511
xor ebx, ebx
lea esi, [esi]
movzx edx, word [edi + ebx*2]
add ebx, 1
cmp dx, 0x26
je 0x10001520
cmp ebx, eax
jne 0x10001500
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, eax
jae 0x10001511
mov dword [esp], str.Alt_
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [esi], eax
sub esp, 4
test eax, eax
je 0x10001550
movzx edx, word [ebp + ebx*2 - 0x80c]
mov word [eax + 8], dx
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x8007000e
jmp 0x10001516

Function at 0x10001560
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x80c]
push ebx
mov ebx, edx
sub esp, 0x814
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0xd
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
je 0x100015e0
xor edx, edx
lea esi, [esi]
movzx ecx, word [esi + edx*2]
mov edi, edx
add edx, 1
cmp cx, 0x26
je 0x100015f0
cmp eax, edx
jne 0x100015a0
mov dword [esp], esi
mov dword [esp + 4], edx
call dword [sym.imp.oleaut32.dll_SysAllocStringLen]
sub esp, 8
cmp eax, 1
mov dword [ebx], eax
sbb eax, eax
lea esp, [ebp - 0xc]
pop ebx
and eax, 0x8007000e
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [eax - 1]
mov eax, ecx
mov dword [ebp - 0x810], ecx
sub eax, edi
add eax, eax
mov dword [esp + 8], eax
lea eax, [esi + edx*2]
mov dword [esp + 4], eax
lea eax, [esi + edi*2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
mov ecx, dword [ebp - 0x810]
mov edx, ecx
jmp 0x100015b3
Function at 0x10001790
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea ecx, [ebp + 8]
sub esp, 0x20
mov eax, dword [ecx + 0x14]
mov edi, dword [ecx]
add ecx, 4
mov dword [esp], ecx
mov dword [ebp - 0x18], eax
call sym._convert_child_id
test eax, eax
jne 0x100018a0
mov dword [esp + 4], 0xfffffff0
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowLongW]
sub esp, 8
and eax, 0x20
mov dword [ebp - 0x14], eax
jne 0x100018b0
mov ecx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xe
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x20], ecx
mov dword [esp], eax
call ecx
lea edx, [eax + 1]
sub esp, 0x10
lea eax, [edx + edx]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x100018b9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xd
mov dword [esp + 8], edx
mov eax, dword [edi + 0x14]
mov dword [esp], eax
call ecx
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov edi, dword [ebp - 0x18]
sub esp, 4
mov dword [edi], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x14], 0x80070057
jmp 0x1000188b
mov dword [ebp - 0x14], 0x80070005
jmp 0x1000188b
mov dword [ebp - 0x14], 0x8007000e
jmp 0x1000188b

Function at 0x10001ff0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
sub esp, 0x18
mov esi, dword [ebp + 8]
lock xadd dword [esi + 0x10], ebx
sub ebx, 1
test byte [0x10024018], 8
jne 0x10002020
test ebx, ebx
je 0x10002050
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x1002609a
mov dword [esp + 8], str.Client_Release
mov dword [esp + 4], 0x10024018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test ebx, ebx
jne 0x10002015
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x10006390
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x34
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [sym.imp.user32.dll_IsWindow]
sub esp, 4
test eax, eax
je 0x100064b8
mov dword [esp + 8], 0x24
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x100064bf
mov eax, 0x10027508
mov dword [esp + 4], 0x10027320
movd xmm0, eax
mov eax, 0x10027518
mov dword [esp], ebx
movd xmm1, eax
mov eax, 0x10027534
movd xmm2, eax
mov eax, 0x10027560
punpckldq xmm1, xmm0
movd xmm0, eax
punpckldq xmm0, xmm2
punpcklqdq xmm0, xmm1
movups xmmword [ebp - 0x38], xmm0
call sym._find_class_data
movdqu xmm0, xmmword [ebp - 0x38]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xa
movups xmmword [esi], xmm0
test eax, eax
je 0x100064b0
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov ecx, sym._Client_QueryInterface_12
test eax, eax
je 0x1000647b
mov eax, dword [eax]
test eax, eax
je 0x1000647b
mov dword [esp], esi
call eax
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], eax
call ecx
mov ebx, eax
mov eax, dword [esi]
sub esp, 0xc
mov dword [esp], esi
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [esi + 0x20]
jmp 0x10006463
mov ebx, 0x80004005
jmp 0x1000649b
mov ebx, 0x8007000e
jmp 0x1000649b
Function at 0x100078a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
test byte [0x10024028], 8
jne 0x10007930
test edi, edi
je 0x10007a1c
mov dword [edi], 0
mov dword [esp], esi
call dword [sym.imp.user32.dll_IsWindow]
sub esp, 4
test eax, eax
je 0x10007910
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
js 0x10007a21
jne 0x10007a00
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym.oleacc.dll_CreateStdAccessibleObject
test ebx, ebx
je 0x10007a30
mov eax, ebx
shr eax, 0x10
je 0x100079e8
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], 0x1002769c
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._p__ld__s__p_n
mov dword [esp + 8], str.AccessibleObjectFromWindow
mov dword [esp + 4], 0x10024028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x100078c1
movzx eax, bx
mov dword [esp], 0x1002768c
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x100079a5
mov dword [ebp + 0x14], edi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], 0
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym.oleacc.dll_ObjectFromLresult
mov eax, 0x80070057
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0x10027685
jmp 0x100079a5
Function at 0x10008790
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov esi, dword [ebp + 0xc]
test byte [0x10024028], 8
jne 0x10008808
mov ecx, dword [ebp + 0x10]
test esi, esi
setne bl
test ecx, ecx
jne 0x100087c8
test bl, bl
je 0x100087c8
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.oleacc.dll_GetRoleTextW
sub esp, 0xc
test eax, eax
jne 0x10008848
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100087b5
test bl, bl
je 0x100087b5
mov byte [esi], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], str._lu__p__u_n
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], str.GetRoleTextA
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10024028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x100087a5
lea ecx, [eax + 1]
mov dword [esp + 4], 0
lea eax, [ecx + ecx]
mov dword [ebp - 0x10], ecx
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x100087b5
mov ecx, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym.oleacc.dll_GetRoleTextW
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
mov ecx, dword [ebp - 0x10]
sub esp, 0x20
test esi, esi
je 0x10008990
cmp dword [ebp + 0x10], eax
jb 0x10008960
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x20
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x10]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
lea eax, [edx - 1]
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi], 0
sub esp, 0xc
jmp 0x100087b5
mov dword [ebp - 0x10], eax
jmp 0x10008930
Function at 0x1000c3a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
sub esp, 0x18
mov esi, dword [ebp + 8]
lock xadd dword [esi + 0x10], ebx
sub ebx, 1
test byte [0x10024050], 8
jne 0x1000c3d0
test ebx, ebx
je 0x1000c400
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__ref___lu_n
mov dword [esp + 8], str.Window_Release
mov dword [esp + 4], 0x10024050
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
test ebx, ebx
jne 0x1000c3c5
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4

Function at 0x10013b30
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x34
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [sym.imp.user32.dll_IsWindow]
sub esp, 4
test eax, eax
je 0x10013c20
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x10013c27
mov edx, 0x1002a7d0
mov dword [esp], ebx
movd xmm0, edx
mov edx, 0x1002a7e0
mov dword [esp + 4], 0x1002a7a0
movd xmm1, edx
mov edx, 0x1002a7fc
movd xmm2, edx
mov edx, 0x1002a820
punpckldq xmm1, xmm0
movd xmm0, edx
punpckldq xmm0, xmm2
punpcklqdq xmm0, xmm1
movups xmmword [ebp - 0x38], xmm0
call sym._find_class_data
mov eax, dword [ebp - 0x1c]
movdqu xmm0, xmmword [ebp - 0x38]
mov dword [esp], esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esi + 0x14], ebx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 1
call sym._Window_QueryInterface_12
mov ebx, eax
mov eax, dword [esi]
sub esp, 0xc
mov dword [esp], esi
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov ebx, 0x80004005
jmp 0x10013c0e
mov ebx, 0x8007000e
jmp 0x10013c0e

Function at 0x10022ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10022b28
cmp byte [esi + ebx - 1], 0xa
je 0x10022afc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100310a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10023150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10023328
mov edi, dword [0x100310a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10023237
test byte [0x10024150], 8
jne 0x100232d0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10024160], 8
jne 0x10023290
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100231d9
cmp esi, 3
jbe 0x10023248
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100231ea
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1002b748]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100231d9
mov dword [esp], 0x10024160
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100231b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100231b0
mov dword [esp], 0x10024150
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1002319b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100231a3
mov eax, 0xffffffff
jmp 0x10023237
Function at 0x10023570
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100310c0]
test eax, eax
je 0x10023628
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x100235b0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1002359c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1002365d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100310c0], eax
sub esp, 8
test eax, eax
jne 0x1002358d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1002359e
Function at 0x10023670
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10023800
mov eax, dword [esi]
test eax, eax
je 0x100237e8
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1002380c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x100237d8
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1002379c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x100236d6
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10023802