joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6298a660
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x6298a718
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6298a760
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6298a790
mov dword [ebx + 0x10], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6298a7cb
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x1c]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x10]
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x1c]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 0x10], eax
sub esp, 0xc
test eax, eax
jne 0x6298a6c2
test byte [0x6299e048], 2
je 0x6298a799
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6298a7a8
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6298a6b1
test byte [0x6299e048], 2
jne 0x6298a7a0
xor eax, eax
jmp 0x6298a70a
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constB
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6298a70a
test byte [0x6299e048], 2
je 0x6298a799
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6298a7a8
Function at 0x6298aa30
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x6298ab3d
mov ebx, dword [esi + 0x34]
test ebx, ebx
je 0x6298ab50
mov edx, dword [esi + 0x30]
xor ebx, ebx
jmp 0x6298aa68
mov eax, dword [esi + 0x34]
inc ebx
cmp eax, ebx
jbe 0x6298aab0
lea eax, [ebx + ebx*2]
cmp dword [edx + eax*4 + 4], edi
jne 0x6298aa60
test byte [0x6299e048], 4
je 0x6298aa60
mov dword [esp + 0x10], edi
inc ebx
mov dword [esp + 0xc], str.Sampler__u_already_declared_n
mov dword [esp + 8], str.record_sampler
mov dword [esp + 4], 0x6299e048
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
cmp eax, ebx
ja 0x6298aa68
lea esi, [esi]
lea eax, [eax + eax*2 + 3]
shl eax, 2
test edx, edx
je 0x6298aba0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6298ab30
mov dword [esi + 0x30], eax
mov edx, dword [esi + 0x34]
mov ecx, dword [ebp + 0xc]
lea edx, [edx + edx*2]
mov dword [eax + edx*4], ecx
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 4], edi
mov eax, 1
inc dword [esi + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6299e048], 2
jne 0x6298abca
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xc
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 0x30], eax
sub esp, 0xc
test eax, eax
jne 0x6298aaef
test byte [0x6299e048], 2
je 0x6298ab3d
mov dword [esp + 0xc], str.Error_allocating_samplers_array_n
jmp 0x6298abd2
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6298aae8
mov dword [esp + 0xc], str.Error_reallocating_samplers_array_n
mov dword [esp + 8], str.record_sampler
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6298ab3f
Function at 0x6298b820
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor eax, eax
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret 8
Function at 0x6298d8d0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov eax, dword [eax + 0xc]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6298d930
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov edx, dword [eax + 0x1c]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
test edx, edx
je 0x6298d98d
mov eax, dword [eax + 0x10]
test eax, eax
je 0x6298d967
xor ebx, ebx
mov eax, ebx
shl eax, 5
add eax, edx
je 0x6298d961
call sym._free_variable.part.0
mov edx, dword [esi + 0x1c]
inc ebx
cmp dword [esi + 0x10], ebx
ja 0x6298d950
mov dword [esp + 8], edx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov edx, dword [esi + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6298ea40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
test eax, eax
je 0x6298eab0
mov esi, edx
mov dword [esp], eax
mov ebx, eax
mov edi, 1
call dword [sym.imp.ucrtbase.dll_strlen]
lea edx, [eax + 1]
test eax, eax
je 0x6298eaa6
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov dword [esi], eax
je 0x6298eabf
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcpy
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov edi, 1
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
xor edi, edi
test byte [0x6299e160], 2
je 0x6298eaa6
mov dword [esp + 0xc], str.Failed_to_allocate_name_memory._n
mov dword [esp + 8], str.copy_name
mov dword [esp + 4], 0x6299e160
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_3
jmp 0x6298eaa6

Function at 0x6298eb60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
test byte [0x6299e160], 8
jne 0x6298ebc8
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 8]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Free_signature__p_n
mov dword [esp + 8], str.free_signature
mov dword [esp + 4], 0x6299e160
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6298eb74
Function at 0x62990070
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6299e160], 8
jne 0x629900b0
test ebx, ebx
je 0x629900e0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._p_decreasing_refcount_to__lu._n
mov dword [esp + 8], str.d3dcompiler_shader_reflection_Release
mov dword [esp + 4], 0x6299e160
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
test ebx, ebx
jne 0x6299009d
mov eax, esi
call sym._reflection_cleanup
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x62994a00
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
test byte [0x6299e180], 8
jne 0x62994a68
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
cmp eax, ecx
jae 0x62994ab0
mov ecx, dword [ebp + 0xc]
lea eax, [eax + eax*2]
mov dword [edx + eax*4], ecx
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], esi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 4], edx
inc dword [ebx + 4]
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp + 0xc]
call sym._wine_dbgstr_an.constprop.0_2
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.dxbc__p__tag__s__size__Ix._n
mov dword [esp + 8], 0x629a834c
mov dword [esp + 4], 0x6299e180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
cmp eax, ecx
jb 0x62994a28
lea edi, [ecx + ecx]
mov dword [esp + 8], edx
lea ecx, [edi + ecx*4]
mov dword [esp + 4], 0
shl ecx, 2
mov dword [esp + 0xc], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov edx, eax
test eax, eax
je 0x62994af4
mov dword [ebx + 8], eax
mov eax, dword [ebx + 4]
mov dword [ebx], edi
jmp 0x62994a28
mov ebx, 0x8007000e
test byte [0x6299e180], 2
je 0x62994a57
mov dword [esp + 0xc], str.Failed_to_allocate_dxbc_section_memory_n
mov dword [esp + 8], 0x629a834c
mov dword [esp + 4], 0x6299e180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x62994a57

Function at 0x62994b30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x6299e180], 8
jne 0x62994ba8
test ebx, ebx
je 0x62994b98
lea eax, [ebx + ebx*2]
shl eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 8], eax
sub esp, 0xc
test eax, eax
je 0x62994bd9
mov dword [esi + 4], 0
mov dword [esi], ebx
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, 0x18
mov ebx, 2
jmp 0x62994b51
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.dxbc__p__size__u._n
mov dword [esp + 8], str.dxbc_init
mov dword [esp + 4], 0x6299e180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x62994b47
mov ebx, 0x8007000e
test byte [0x6299e180], 2
je 0x62994b88
mov dword [esp + 0xc], str.Failed_to_allocate_dxbc_section_memory_n
mov dword [esp + 8], str.dxbc_init
mov dword [esp + 4], 0x6299e180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x62994b88
Function at 0x62994fb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x6299e180], 8
jne 0x62994ff0
mov edx, dword [ebx + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.dxbc__p._n
mov dword [esp + 8], str.dxbc_destroy
mov dword [esp + 4], 0x6299e180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x62994fc3
Function at 0x62995390
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 8]
test edi, edi
je 0x629954b0
mov edx, dword [ebx]
mov esi, dword fs:[0x18]
jmp 0x629953e9
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov edx, eax
sub esp, 0x10
test edx, edx
je 0x62995478
mov dword [ebx], edx
mov dword [ebx + 8], edi
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, edi
sub eax, dword [ebx + 4]
mov dword [esp + 0xc], eax
add edx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp], 6
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
mov edi, eax
mov eax, dword [ebx + 8]
test edi, edi
js 0x62995438
mov edx, dword [ebx + 4]
mov ecx, eax
sub ecx, edx
cmp ecx, edi
ja 0x62995490
lea edi, [eax + eax]
mov eax, dword [ebx]
test eax, eax
jne 0x629953b8
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
sub esp, 0xc
test edx, edx
jne 0x629953e4
lea esi, [esi]
nop
test byte [0x6299e180], 2
jne 0x629954f8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6299e180], 8
jne 0x62995528
add edx, edi
mov dword [ebx + 4], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x6299555a
mov dword [ebx + 8], 0x100
mov edi, 0x100
jmp 0x629953a9
mov dword [esp + 0xc], str.Error_reallocating_memory_for_parser_messages_n
mov dword [esp + 8], 0x629a82dc
mov dword [esp + 4], 0x6299e180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add edx, dword [ebx]
mov dword [esp + 0xc], 0x629a72d4
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0x629a82dc
mov dword [esp + 4], 0x6299e180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov edx, dword [ebx + 4]
jmp 0x6299549d
test byte [0x6299e180], 2
je 0x62995481
mov dword [esp + 0xc], str.Error_allocating_memory_for_parser_messages_n
mov dword [esp + 8], 0x629a82dc
mov dword [esp + 4], 0x6299e180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x62995481
Function at 0x62995640
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov eax, dword [edx + 8]
add dword [ebx + 4], eax
mov eax, dword [edx]
test eax, eax
jne 0x62995668
mov dword [ebx + 8], 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 0x14
mov esi, edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 8], eax
sub esp, 0xc
test eax, eax
je 0x6299565d
mov edx, dword [esi + 4]
mov dword [eax], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 4], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6299a940
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [0x629b1084], 0
mov dword [0x629b108c], 0
mov dword [0x629b1098], 0
mov dword [0x629b1094], 0
mov dword [0x629b109c], 1
call sym._asmshader_parse
cmp dword [0x629b108c], 2
mov ebx, dword [0x629b1084]
je 0x6299aa40
test esi, esi
je 0x6299aa60
mov eax, dword [0x629b1094]
test eax, eax
jne 0x6299a9b8
mov dword [esi], 0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov edx, dword [0x629b1090]
inc eax
test edx, edx
je 0x6299aa78
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x6299a9ac
test byte [0x6299e190], 2
jne 0x6299aaa8
mov edx, dword [0x629b1090]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test ebx, ebx
je 0x6299a995
mov dword [esp], ebx
xor ebx, ebx
call sym._SlDeleteShader
test esi, esi
jne 0x6299a99d
lea esi, [esi]
mov eax, dword [0x629b1098]
test eax, eax
jne 0x6299aa03
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6299a9f0
mov dword [esp + 0xc], 0x629a9408
mov dword [esp + 8], str.parse_asm_shader
mov dword [esp + 4], 0x6299e190
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_5
jmp 0x6299aa03

Function at 0x6299ac40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x629aab20
mov dword [esp], eax
call sym._fprintf.constprop.0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
nop
Function at 0x6299c920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6299c97b
cmp byte [esi + ebx - 1], 0xa
je 0x6299c94f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x629b1184], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401af0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x4040d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
push str._shell_
push 0x80000000
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401b9d
push 0
push 0
push str.RegSetValueEx_Error
mov ecx, ebx
call sub.MFC42.DLL_CWnd::MessageBoxA
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret