joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012b0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
jle 0x401300
xor eax, eax
jmp 0x4012d7
add eax, 1
cmp ecx, eax
je 0x401340
mov edx, dword [ebx + eax*4]
cmp word [edx], 0x2f
jne 0x4012d0
test byte [section..data], 1
jne 0x401440
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [section..bss]
xor eax, eax
test edx, edx
jne 0x4012f2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.File_not_found_n
call sym._fwrite
jmp 0x4012ed
cmp ecx, 1
je 0x401300
lea eax, [ebx + ecx*4]
lea edi, [ebx + 4]
mov dword [ebp - 0x21c], eax
jmp 0x401363
add edi, 4
cmp dword [ebp - 0x21c], edi
je 0x401300
mov esi, dword [edi]
mov dword [esp + 4], 0x3a
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x4013e0
xor ecx, ecx
lea ebx, [eax + 2]
mov word [eax], cx
mov dword [esp + 4], str.__r_n
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x401358
mov dword [esp], esi
lea esi, [ebp - 0x218]
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x218], eax
jmp 0x4013b7
mov edx, ebx
call sym._search
mov dword [esp + 8], esi
mov dword [esp + 4], 0x404044
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_wcstok]
test eax, eax
jne 0x4013b0
jmp 0x401358
mov dword [esp], str.PATH
call dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [ebp - 0x220], eax
mov dword [esp + 4], str.__r_n
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x401358
lea ebx, [ebp - 0x214]
mov dword [esp], 0x104
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
jne 0x40146d
mov ebx, esi
mov esi, dword [ebp - 0x220]
jmp 0x401397
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unsupported_option__ls_n
mov dword [esp + 8], str.wmain
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x4012ed
mov edx, esi
mov eax, ebx
call sym._search
jmp 0x40142a

Function at 0x4014c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401518
cmp byte [esi + ebx - 1], 0xa
je 0x4014ec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401f10
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xc87542
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, str._q
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5c6610c1
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10005810
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x54]
mov edx, dword [eax + 4]
cmp edx, 0xffffffff
je 0x1000584e
mov dword [esp], edx
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [ebx + 0x54]
sub esp, 8
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x48]
test edx, edx
je 0x10005948
test byte [0x1001c03c], 8
jne 0x10005910
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov dword [esp], eax
call edx
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x70]
test edx, edx
je 0x10005893
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x74]
test edx, edx
je 0x100058a9
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym._NS_DeleteSessionCache
mov eax, dword [ebx + 0x54]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [eax + 0x5c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x3c]
mov dword [eax + 0x18], 0
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp], ebx
call esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], str.Calling_SP_ShutdownEx_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebx + 0x54]
mov edx, dword [eax + 0x30]
mov edx, dword [edx + 0x48]
jmp 0x10005869
mov edx, dword [ecx + 0x40]
test edx, edx
je 0x1000587d
test byte [0x1001c03c], 8
jne 0x10005970
call edx
mov eax, dword [ebx + 0x54]
jmp 0x1000587d
mov dword [esp + 0xc], str.Calling_obsolete_SP_Shutdown_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x40]
jmp 0x1000595c
Function at 0x10007280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x1c]
test byte [0x1001c03c], 1
jne 0x10007310
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax + 0x78]
test edx, edx
je 0x100073b8
test esi, esi
mov ecx, 1
cmovne ecx, esi
mov edx, ecx
test ebx, ebx
je 0x10007368
test cl, 1
je 0x100073c8
and edx, 8
mov esi, dword [eax + 0x20]
jne 0x100072de
test byte [0x1001c03c], 1
jne 0x10007388
test esi, esi
je 0x100073e0
mov eax, dword [esi + 8]
mov edx, dword [edi]
mov dword [esp], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sym._memcpy
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], esi
sub eax, 0x18
mov dword [esp + 0xc], str.__p_____p__p_0x_08lx__p__p__u_:_stub_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DP_IF_Receive
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
jmp 0x1000729b
test cl, 8
je 0x10007418
test cl, 1
je 0x100073c8
mov eax, dword [eax + 0x20]
test eax, eax
jne 0x100072fb
jmp 0x100073e0
mov dword [esp + 0xc], str.Remove_from_queue_n
mov dword [esp + 8], str.DP_IF_Receive
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
jmp 0x100072de
mov eax, 0x88770140
jmp 0x100072fd
movzx eax, byte [0x1001c03c]
test dl, 6
je 0x100073ea
test al, 1
jne 0x10007422
lea esi, cs:[esi]
mov eax, 0x887700be
jmp 0x100072fd
test al, 2
je 0x100073e0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Hmmm..dwFlags_0x_08lx_n
mov dword [esp + 8], str.DP_IF_Receive
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x100073e0
mov eax, 0x80070057
jmp 0x100072fd
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Find_matching_message_0x_08lx_n
mov dword [esp + 8], str.DP_IF_Receive
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
jmp 0x100073e0
Function at 0x10009210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test byte [0x1001c03c], 8
jne 0x100092c0
mov eax, dword [eax + 0x3c]
mov edx, dword [eax + 0x78]
test edx, edx
je 0x10009361
mov eax, dword [eax + 0x18]
test eax, eax
je 0x10009261
mov edi, dword [eax + 0x10]
mov eax, edi
jmp 0x1000925d
mov ecx, dword [eax + 8]
cmp esi, dword [ecx]
je 0x10009270
mov eax, dword [eax]
cmp edi, eax
je 0x10009261
test eax, eax
jne 0x10009250
mov eax, 0x88770096
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
test byte [ebp + 0x18], 1
jne 0x100092b0
mov eax, dword [ecx + 0x28]
mov edx, dword [ecx + 0x24]
test ebx, ebx
je 0x10009352
mov esi, dword [ebp + 0x14]
cmp dword [esi], eax
jb 0x10009352
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call sym._memcpy
add esp, 0x24
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x1c]
jmp 0x1000927c
lea edi, [eax - 0x18]
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], 0x1001eef8
mov dword [esp + 8], str.IDirectPlay4Impl_GetPlayerData
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x10009361
test byte [0x1001c03c], 8
je 0x1000923d
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 8], str.DP_FindPlayer
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
jmp 0x1000923d
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, 0x8877001e
jmp 0x10009266
mov eax, 0x88770140
jmp 0x10009266
Function at 0x10009900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test byte [0x1001c03c], 8
jne 0x100099c0
mov eax, dword [eax + 0x3c]
mov edx, dword [eax + 0x78]
test edx, edx
je 0x10009ad1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x10009951
mov edx, dword [eax + 0x10]
mov eax, edx
jmp 0x1000994d
mov ebx, dword [eax + 8]
cmp esi, dword [ebx]
je 0x10009960
mov eax, dword [eax]
cmp edx, eax
je 0x10009951
test eax, eax
jne 0x10009940
mov eax, 0x8877009b
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test edi, edi
je 0x10009ab0
cmp dword [edi], 0x10
je 0x10009a60
test byte [0x1001c03c], 1
jne 0x10009990
xor eax, eax
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 0xc], str.Message_not_sent_and_dwFlags_ignored_n
mov dword [esp + 8], str.DP_IF_SetPlayerName
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
xor eax, eax
jmp 0x1000997c
lea ebx, [eax - 0x18]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p____0x_08lx__p_0x_08lx__u__n
mov dword [esp + 8], str.DP_IF_SetPlayerName
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x10009ad1
test byte [0x1001c03c], 8
je 0x1000992d
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 8], str.DP_FindPlayer
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
jmp 0x1000992d
mov eax, dword [ebx + 0xc]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call esi
mov edx, dword [edi]
lea eax, [ebx + 4]
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._memcpy
mov eax, dword [edi + 8]
mov esi, dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [esp], eax
call esi
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call esi
mov dword [ebx + 0x10], eax
jmp 0x10009971
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 4], 0x10
jmp 0x10009971
mov eax, 0x88770140
jmp 0x10009956
Function at 0x10009ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x1c]
lea edx, [ecx - 0x18]
test byte [0x1001c03c], 1
jne 0x10009ba8
mov eax, dword [ecx + 0x3c]
cmp dword [eax + 0x78], 0
je 0x10009c3a
test byte [0x1001c03c], 8
jne 0x10009c00
mov edx, dword [eax + 0x18]
test ebx, ebx
je 0x10009b58
mov ecx, dword [edx + 8]
mov eax, ecx
jmp 0x10009b3e
mov edx, dword [eax + 8]
cmp ebx, dword [edx + 0x20]
je 0x10009b58
mov eax, dword [eax]
cmp ecx, eax
je 0x10009b42
test eax, eax
jne 0x10009b30
lea esp, [ebp - 0xc]
mov eax, 0x8877009b
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
test edx, edx
je 0x10009b42
mov ebx, dword [edx + 8]
test ebx, ebx
jne 0x10009b6e
jmp 0x10009b98
mov ebx, dword [ebx]
test ebx, ebx
je 0x10009b98
mov eax, dword [ebx + 8]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
lea ecx, [eax + 0x24]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [ebp + 0x14]
sub esp, 0x14
test eax, eax
jne 0x10009b68
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
mov dword [ebp - 0x10], edx
mov dword [esp + 0xc], str.__p____0x_08lx__p__p__p_0x_08lx_:_semi_stub_n
mov dword [esp + 8], str.IDirectPlay4Impl_EnumGroupsInGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10009b05
mov dword [ebp + 8], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 8], str.DP_FindAnyGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
jmp 0x10009b1f
mov eax, 0x88770140
jmp 0x10009b9a
Function at 0x10009c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
lea esi, [ebx - 0x18]
test byte [0x1001c03c], 1
jne 0x10009d90
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x10009e29
test byte [0x1001c03c], 8
jne 0x10009de0
mov eax, dword [eax + 0x18]
test eax, eax
je 0x10009cb1
mov eax, dword [eax + 0x10]
mov ebx, eax
jmp 0x10009cad
mov esi, dword [ebx + 8]
cmp edx, dword [esi]
je 0x10009cc0
mov ebx, dword [ebx]
cmp eax, ebx
je 0x10009cb1
test ebx, ebx
jne 0x10009ca0
mov eax, 0x88770096
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
mov edx, ecx
test eax, eax
je 0x10009cdf
mov dword [ebp - 0x10], ecx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 1]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10009cff
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea edx, [edx + eax + 1]
test edi, edi
je 0x10009e1a
mov eax, dword [ebp + 0x14]
cmp dword [eax], edx
jb 0x10009e1a
add esi, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._memcpy
mov eax, dword [ebx + 8]
mov edx, dword [eax + 0xc]
test edx, edx
je 0x10009d80
mov dword [esp + 4], edx
mov ecx, dword [eax + 4]
add ecx, edi
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 0xc]
test edx, edx
je 0x10009d70
mov edx, dword [eax + 0x10]
mov dword [esp + 4], edx
add edi, dword [eax + 4]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strcpy]
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [edi + 0xc], 0
xor eax, eax
jmp 0x10009d60
mov dword [edi + 8], 0
jmp 0x10009d41
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p____0x_08lx__p__p__u_:_ANSI_n
mov dword [esp + 8], str.DP_IF_GetPlayerName
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
mov edx, dword [ebp + 0xc]
jmp 0x10009c72
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 8], str.DP_FindPlayer
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
mov dword [ebp + 0xc], edx
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebp + 0xc]
jmp 0x10009c8d
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, 0x8877001e
jmp 0x10009cb6
mov eax, 0x88770140
jmp 0x10009cb6
Function at 0x1000a030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
lea ecx, [edx - 0x18]
test byte [0x1001c03c], 1
jne 0x1000a108
mov eax, dword [edx + 0x3c]
cmp dword [eax + 0x78], 0
je 0x1000a19a
test byte [0x1001c03c], 8
jne 0x1000a160
mov edx, dword [eax + 0x18]
test ebx, ebx
je 0x1000a0a8
mov ecx, dword [edx + 8]
mov eax, ecx
jmp 0x1000a08e
mov edx, dword [eax + 8]
cmp ebx, dword [edx + 0x20]
je 0x1000a0a8
mov eax, dword [eax]
cmp ecx, eax
je 0x1000a092
test eax, eax
jne 0x1000a080
lea esp, [ebp - 0xc]
mov eax, 0x8877009b
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
test edx, edx
je 0x1000a092
mov ebx, dword [edx + 0x10]
test ebx, ebx
je 0x1000a0f6
lea esi, cs:[esi]
mov eax, dword [ebx + 8]
mov edx, dword [eax]
cmp edx, 0x19a9d65b
je 0x1000a0f0
cmp edx, 1
je 0x1000a0f0
mov dword [esp + 0x10], edi
mov ecx, dword [eax + 0x30]
add eax, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call esi
sub esp, 0x14
test eax, eax
je 0x1000a0f6
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1000a0b8
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
mov dword [ebp - 0x10], ecx
mov dword [esp + 0xc], str.__p____0x_08lx__p__p__p_0x_08lx_:_semi_stub_n
mov dword [esp + 8], str.IDirectPlay4Impl_EnumGroupPlayers
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
jmp 0x1000a055
mov dword [ebp + 8], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 8], str.DP_FindAnyGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
jmp 0x1000a06f
mov eax, 0x88770140
jmp 0x1000a0f8
Function at 0x1000b8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub eax, 0x18
mov dword [ebp - 0x10], eax
test byte [0x1001c03c], 8
jne 0x1000b9e0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax + 0x78]
test edx, edx
je 0x1000baad
mov ebx, dword [eax + 0x18]
test esi, esi
je 0x1000b920
mov ecx, dword [ebx + 8]
mov eax, ecx
jmp 0x1000b906
mov edx, dword [eax + 8]
cmp esi, dword [edx + 0x20]
je 0x1000b922
mov eax, dword [eax]
cmp ecx, eax
je 0x1000b90a
test eax, eax
jne 0x1000b8f8
add esp, 0x20
mov eax, 0x8877009b
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, ebx
test edx, edx
je 0x1000b90a
test byte [0x1001c03c], 8
jne 0x1000ba70
test edi, edi
je 0x1000b958
mov edx, dword [ebx + 8]
mov eax, edx
jmp 0x1000b94e
mov ebx, dword [eax + 8]
cmp edi, dword [ebx + 0x20]
je 0x1000b958
mov eax, dword [eax]
cmp edx, eax
je 0x1000b90a
test eax, eax
jne 0x1000b940
jmp 0x1000b90a
test ebx, ebx
je 0x1000b90a
mov dword [esp + 4], 0xc
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
test eax, eax
je 0x1000bab7
add dword [ebx + 4], 1
mov dword [eax + 8], ebx
mov dword [eax], 0
mov edx, dword [ebx + 0xc]
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ebx + 0xc], eax
test byte [0x1001c03c], 1
jne 0x1000b9b0
xor eax, eax
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 0xc], str.Not_sending_message_n
mov dword [esp + 8], str.IDirectPlay4Impl_AddGroupToGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
jmp 0x1000b99a
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p____0x_08lx_0x_08lx__n
mov dword [esp + 8], str.IDirectPlay4Impl_AddGroupToGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x1000baad
test byte [0x1001c03c], 8
je 0x1000b8e6
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DP_FindAnyGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
jmp 0x1000b8e6
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0x1001eec9
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DP_FindAnyGroup
mov dword [esp + 4], 0x1001c03c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax + 0x18]
jmp 0x1000b933
mov eax, 0x88770140
jmp 0x1000b99c
mov eax, 0x88770028
jmp 0x1000b99c