joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afde4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4afe86
cmp dword [ebx + 0x94], 0
jne 0x4afe80
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4afd30
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4afe80
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4afe46
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4afe80
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00433b6c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4afe55
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b00a4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x524280]
cmp dword [eax + 0x170], 0
je 0x4b0209
test bl, bl
jne 0x4b0157
cmp dword [esi + 0x9c], 0
jne 0x4b014c
mov eax, esi
call fcn.004b2f94
push eax
push 0x4affb0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b011d
mov eax, dword [0x524280]
cmp byte [eax + 0xd3], 0
je 0x4b011d
mov eax, dword [esi + 0xd8]
call fcn.00407ed4
mov edi, eax
cmp edi, 0
jl 0x4b011d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b0106
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b014c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00433b6c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b012c
inc dword [esi + 0x9c]
jmp 0x4b0209
cmp dword [esi + 0x9c], 0
jle 0x4b0209
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b0209
cmp dword [esi + 0x44], 0
je 0x4b01b4
mov eax, dword [0x524280]
cmp byte [eax + 0xd3], 0
je 0x4b01b4
mov eax, dword [esi + 0xd8]
call fcn.00407ed4
mov edi, eax
cmp edi, 0
jl 0x4b01b4
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b019d
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b01e3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00433b6c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b01c3
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a332c]
call fcn.00408094
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b0e58
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b0ec3
cmp byte [ebx + 0xd3], 0
jne 0x4b0ec3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004069a0
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b0eb0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b0ed0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406864
jmp 0x4b0ed0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406864
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b26f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b2766
mov eax, esi
call fcn.0048ad1c
test al, al
je 0x4b2766
mov eax, dword [ebx + 0x84]
call fcn.0048a970
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b2766
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b275a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048a970
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00481944
jmp 0x4b2766
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b2530
pop esi
pop ebx
ret
Function at 0x40138b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [section..data], eax
push 0x30
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x1000
push dword [section..data]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push dword [section..data]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40100f
mov dword [ebp - 0x10], 6
mov dword [ebp - 8], str.Clock
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [section..data]
push 0
push 0
push 0x172
push 0xfa
push 0x64
push 0x64
push 0xcf0000
push str.Clock
push str.Clock
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x404004], eax
push 1
push dword [0x404004]
call sub.user32.dll_ShowWindow
push dword [0x404004]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401479
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401452
leave
ret
Function at 0x10011867
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
jb 0x1001187d
call esi
shr eax, 8
cmp al, 1
jae 0x10011883
call esi
cmp al, 5
jbe 0x1001189b
push 0
push dword [esp + 0x10]
push 0x1001181b
push dword [esp + 0x14]
call sub.COMCTL32.dll_SetWindowSubclass
xor eax, eax
jmp 0x100118ab
push dword [esp + 0xc]
push 0xfffffffffffffffc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret 8

Function at 0x100118af
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
jb 0x100118c5
call esi
shr eax, 8
cmp al, 1
jae 0x100118cb
call esi
cmp al, 5
jbe 0x100118df
push dword [esp + 0xc]
push 0x1001181b
push dword [esp + 0x10]
call sub.COMCTL32.dll_RemoveWindowSubclass
jmp 0x100118ef
push dword [esp + 0x10]
push 0xfffffffffffffffc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret 0xc
Function at 0x10011a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov edx, dword [esp + 4]
mov dword [eax], vtable.D3DContext.0
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
movzx ecx, byte [edx + 0xc]
mov byte [eax + 0xc], cl
push esi
fld dword [edx + 0x10]
push edi
fstp dword [eax + 0x10]
movzx ecx, byte [edx + 0x14]
mov byte [eax + 0x14], cl
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x20], ecx
mov ecx, dword [edx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, dword [edx + 0x28]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x2c]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x34]
mov dword [eax + 0x34], ecx
mov ecx, dword [edx + 0x38]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x3c]
mov dword [eax + 0x3c], ecx
mov ecx, dword [edx + 0x40]
mov dword [eax + 0x40], ecx
mov ecx, dword [edx + 0x44]
mov dword [eax + 0x44], ecx
mov ecx, dword [edx + 0x48]
mov dword [eax + 0x48], ecx
mov ecx, dword [edx + 0x4c]
mov dword [eax + 0x4c], ecx
mov ecx, dword [edx + 0x50]
mov dword [eax + 0x50], ecx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0x54], ecx
mov ecx, dword [edx + 0x58]
mov dword [eax + 0x58], ecx
mov ecx, dword [edx + 0x5c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [edx + 0x60]
mov dword [eax + 0x60], ecx
mov ecx, dword [edx + 0x64]
mov dword [eax + 0x64], ecx
mov ecx, dword [edx + 0x68]
mov dword [eax + 0x68], ecx
mov ecx, dword [edx + 0x6c]
mov dword [eax + 0x6c], ecx
mov ecx, dword [edx + 0x70]
mov dword [eax + 0x70], ecx
mov ecx, dword [edx + 0x74]
mov dword [eax + 0x74], ecx
mov ecx, dword [edx + 0x78]
mov dword [eax + 0x78], ecx
mov ecx, dword [edx + 0x7c]
mov dword [eax + 0x7c], ecx
mov ecx, dword [edx + 0x80]
mov dword [eax + 0x80], ecx
mov ecx, dword [edx + 0x84]
mov dword [eax + 0x84], ecx
mov ecx, dword [edx + 0x88]
mov dword [eax + 0x88], ecx
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x90], ecx
lea esi, [edx + 0x94]
lea edi, [eax + 0x94]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0xcc]
lea edi, [eax + 0xcc]
mov ecx, 0x4c
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x1fc]
mov dword [eax + 0x1fc], ecx
mov ecx, dword [edx + 0x200]
mov dword [eax + 0x200], ecx
mov ecx, dword [edx + 0x204]
mov dword [eax + 0x204], ecx
mov ecx, dword [edx + 0x208]
mov dword [eax + 0x208], ecx
mov ecx, dword [edx + 0x20c]
mov dword [eax + 0x20c], ecx
mov ecx, dword [edx + 0x210]
mov dword [eax + 0x210], ecx
mov edx, dword [edx + 0x214]
pop edi
mov dword [eax + 0x214], edx
pop esi
ret 4
Function at 0x10011c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov edx, dword [esp + 4]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
movzx ecx, byte [edx + 0xc]
mov byte [eax + 0xc], cl
push esi
fld dword [edx + 0x10]
push edi
fstp dword [eax + 0x10]
movzx ecx, byte [edx + 0x14]
mov byte [eax + 0x14], cl
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x20], ecx
mov ecx, dword [edx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, dword [edx + 0x28]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x2c]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x34]
mov dword [eax + 0x34], ecx
mov ecx, dword [edx + 0x38]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x3c]
mov dword [eax + 0x3c], ecx
mov ecx, dword [edx + 0x40]
mov dword [eax + 0x40], ecx
mov ecx, dword [edx + 0x44]
mov dword [eax + 0x44], ecx
mov ecx, dword [edx + 0x48]
mov dword [eax + 0x48], ecx
mov ecx, dword [edx + 0x4c]
mov dword [eax + 0x4c], ecx
mov ecx, dword [edx + 0x50]
mov dword [eax + 0x50], ecx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0x54], ecx
mov ecx, dword [edx + 0x58]
mov dword [eax + 0x58], ecx
mov ecx, dword [edx + 0x5c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [edx + 0x60]
mov dword [eax + 0x60], ecx
mov ecx, dword [edx + 0x64]
mov dword [eax + 0x64], ecx
mov ecx, dword [edx + 0x68]
mov dword [eax + 0x68], ecx
mov ecx, dword [edx + 0x6c]
mov dword [eax + 0x6c], ecx
mov ecx, dword [edx + 0x70]
mov dword [eax + 0x70], ecx
mov ecx, dword [edx + 0x74]
mov dword [eax + 0x74], ecx
mov ecx, dword [edx + 0x78]
mov dword [eax + 0x78], ecx
mov ecx, dword [edx + 0x7c]
mov dword [eax + 0x7c], ecx
mov ecx, dword [edx + 0x80]
mov dword [eax + 0x80], ecx
mov ecx, dword [edx + 0x84]
mov dword [eax + 0x84], ecx
mov ecx, dword [edx + 0x88]
mov dword [eax + 0x88], ecx
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x90], ecx
lea esi, [edx + 0x94]
lea edi, [eax + 0x94]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0xcc]
lea edi, [eax + 0xcc]
mov ecx, 0x4c
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x1fc]
mov dword [eax + 0x1fc], ecx
mov ecx, dword [edx + 0x200]
mov dword [eax + 0x200], ecx
mov ecx, dword [edx + 0x204]
mov dword [eax + 0x204], ecx
mov ecx, dword [edx + 0x208]
mov dword [eax + 0x208], ecx
mov ecx, dword [edx + 0x20c]
mov dword [eax + 0x20c], ecx
mov ecx, dword [edx + 0x210]
mov dword [eax + 0x210], ecx
mov edx, dword [edx + 0x214]
pop edi
mov dword [eax + 0x214], edx
pop esi
ret 4
Function at 0x100130d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100130df
pop dword [ebp - 0x10]
mov eax, 0xa808ee86
sub eax, 0x9807bda7
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa100254e
add dword [ebp - 0x20], 0xad521ffd
mov dword [ebp - 0x1c], 0x6a91005c
sub dword [ebp - 0x1c], 0x385db417
mov dword [ebp - 0x18], 0x665f3b0f
sub dword [ebp - 0x18], 0x1a12f6e1
mov dword [ebp - 0x14], 0x5caeaa4e
sub dword [ebp - 0x14], 0x5caeaa4e
lea eax, [ebp - 0x20]
push eax
mov eax, 0x80647109
sub eax, 0x7058cff5
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x8f7d5e8d
add dword [ebp - 0x20], 0xe4f50ac9
mov dword [ebp - 0x1c], 0x805d1488
add dword [ebp - 0x1c], 0xc10f4ced
mov dword [ebp - 0x18], 0x61ea2276
sub dword [ebp - 0x18], 0xfe7ab60a
mov dword [ebp - 0x14], 0x581dfe6d
sub dword [ebp - 0x14], 0x581dfe6d
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3f3f5
push 0
call eax
mov ecx, 0x4ee2
mov ebx, eax
mov edi, 0x10146400
add edi, dword [ebp - 0x10]
mov edx, 0x1d65e952
xor dword [ebp - 0xc], 0xcc04c1de
mov esi, dword [edi]
xor dword [ebp - 8], ebx
sub esi, edx
sub dword [ebp - 8], 0xce20a2df
mov dword [ebx], esi
add dword [ebp - 8], ebx
add ebx, 4
add edi, 0xa3f64918
sub edi, 0xa3f64914
loop 0x100131ea
add eax, 0x9df1be94
sub eax, 0x9df09039
xor ebx, ebx
add ebx, eax
add eax, 0xbf62c2b
add eax, 0xf409d3da
mov ecx, 0xb7916cfb
add ecx, 0x586e9305
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10018500
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x100fd640]
xor eax, esp
mov dword [esp + 0x11c], eax
cmp word [0x100fddb8], 0
push ebx
jne 0x10018722
push esi
push 0x11c
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.kernel32.dll_GetVersionExW]
push str._I__OS_Version_
push 0
push 3
mov esi, eax
call fcn.100130d0
add esp, 0xc
test esi, esi
pop esi
je 0x10018706
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
cmp eax, 2
jne 0x100186f1
cmp ecx, 4
jbe 0x100186f1
mov eax, dword [esp + 0xc]
mov ebx, 1
cmp ecx, 6
jb 0x10018628
test eax, eax
jne 0x100185de
cmp byte [esp + 0x11e], bl
jne 0x100185bc
push str.OS_VISTA_n
push eax
push 3
call fcn.100130d0
add esp, 0xc
mov word [0x100fddb8], bx
jmp 0x10018722
push str.OS_WINSERV_2008_n
push 0
push 3
call fcn.100130d0
mov edx, 2
add esp, 0xc
mov word [0x100fddb8], dx
jmp 0x10018722
cmp eax, ebx
jb 0x10018628
cmp byte [esp + 0x11e], bl
jne 0x10018606
push str.OS_WINDOWS7_or_newer_n
push 0
push 3
call fcn.100130d0
add esp, 0xc
mov eax, 0x20
jmp 0x1001871c
push str.OS_WINSERV_2008R2_or_newer_n
push 0
push 3
call fcn.100130d0
mov ecx, 0x40
add esp, 0xc
mov word [0x100fddb8], cx
jmp 0x10018722
cmp ecx, 5
jne 0x100186d0
cmp eax, 2
jne 0x1001867c
cmp byte [esp + 0x11e], bl
jne 0x10018661
push str.OS_WINXP_64_n
push 0
push 3
call fcn.100130d0
mov edx, 8
add esp, 0xc
mov word [0x100fddb8], dx
jmp 0x10018722
push str.OS_WINSERV_2003_n
push 0
push 3
call fcn.100130d0
add esp, 0xc
mov eax, 0x10
jmp 0x1001871c
cmp eax, ebx
jne 0x100186d0
push str.OS_WINXP
push 0
push 3
call fcn.100130d0
add esp, 0xc
test dword [esp + 0x11c], 0x200
mov ecx, 4
mov word [0x100fddb8], cx
je 0x100186bd
push str.Home_n
push 0
push 3
call fcn.100130d0
add esp, 0xc
jmp 0x10018722
push str.Pro_n
push 0
push 3
call fcn.100130d0
add esp, 0xc
jmp 0x10018722
push eax
push ecx
push str.OS_UNKNOWN:_dwMajorVersion_d_dwMinorVersion_d_n
push 0
push 3
call fcn.100130d0
mov edx, 0xff80
add esp, 0x14
mov word [0x100fddb8], dx
jmp 0x10018722
push ecx
push eax
push str.OS_UNKNOWN:_dwPlatformId_d_dwMajorVersion_d_n
push 0
push 3
call fcn.100130d0
add esp, 0x14
jmp 0x10018717
push str.OS_UNKNOWN:_GetVersionEx_failed_n
push 0
push 3
call fcn.100130d0
add esp, 0xc
mov eax, 0xff80
mov word [0x100fddb8], ax
movzx ecx, word [esp + 0x128]
movzx eax, word [0x100fddb8]
and eax, ecx
mov ecx, dword [esp + 0x120]
pop ebx
xor ecx, esp
call fcn.100b4c22
add esp, 0x120
ret
Function at 0x10018890
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push str.J2D_D3D_RASTERIZER
call dword [sym.imp.MSVCR100.dll_getenv]
mov esi, eax
add esp, 4
mov ebx, 1
test esi, esi
je 0x10018979
push edi
push str._W__D3DPPLM::SelectDeviceType:
push 0
push 2
call fcn.100130d0
mov edi, dword [sym.imp.MSVCR100.dll_strncmp]
push 3
push 0x100ca9ec
push esi
call edi
add esp, 0x18
test eax, eax
je 0x10018951
push 3
push 0x100ba4a4
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10018951
push 3
push 0x100ca9e8
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10018941
push 3
push 0x100ca9e4
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10018941
push 3
push 0x100ca9e0
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x1001892d
push str.nullref_rasterizer_selected
push eax
push 2
call fcn.100130d0
mov ebx, 4
jmp 0x10018964
push esi
push str.unknown_rasterizer:__s__only__refhalnul__supported__hal_selected_instead
push 0
push 2
call fcn.100130d0
add esp, 0x10
jmp 0x10018967
push str.hal_rasterizer_selected
push 0
push 2
call fcn.100130d0
jmp 0x10018964
push str.ref_rasterizer_selected
push 0
push 2
call fcn.100130d0
mov ebx, 2
add esp, 0xc
push 0x100c9da4
push 0
push 2
call fcn.100130d0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x10019290
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
ja 0x100192ac
call esi
cmp al, 5
jne 0x100192ba
call esi
shr eax, 8
cmp al, 1
jb 0x100192ba
push 0x52
call fcn.10018500
add esp, 4
test eax, eax
je 0x100192e5
push str.D3DPPLM::CheckOSVersion:_Windows_2000_or_earlier__or_a_server__OS_detected__failed
push 1
push 1
call fcn.100130d0
add esp, 0xc
cmp dword [0x100fddb4], 0
je 0x100192e9
push str.__OS_check_overridden_via_J2D_D3D_NO_HWCHECK
push 1
push 2
call fcn.100130d0
add esp, 0xc
xor eax, eax
pop esi
ret
mov eax, 0x80004005
pop esi
ret
Function at 0x1004b3b7
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push str.OGLFuncs_InitPlatformFuncs
inc ebx
push ebx
push 3
call fcn.100130d0
mov eax, dword [0x100fdf58]
add esp, 0xc
test eax, eax
jne 0x1004b3e7
push str.OGLFuncs_InitPlatformFuncs:_library_not_yet_initialized
push ebx
push ebx
call fcn.100130d0
add esp, 0xc
xor al, al
pop ebx
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
mov edi, str.wglCreateContext
push edi
push eax
call esi
mov dword [0x10100fe4], eax
test eax, eax
je 0x1004b48f
mov edi, str.wglDeleteContext
push edi
push dword [0x100fdf58]
call esi
mov dword [0x10100f84], eax
test eax, eax
je 0x1004b48f
mov edi, str.wglMakeCurrent
push edi
push dword [0x100fdf58]
call esi
mov dword [0x101010b8], eax
test eax, eax
je 0x1004b48f
mov edi, str.wglGetCurrentContext
push edi
push dword [0x100fdf58]
call esi
mov dword [0x101010e0], eax
test eax, eax
je 0x1004b48f
mov edi, str.wglGetCurrentDC
push edi
push dword [0x100fdf58]
call esi
mov dword [0x101010dc], eax
test eax, eax
je 0x1004b48f
mov edi, str.wglGetProcAddress
push edi
push dword [0x100fdf58]
call esi
mov dword [0x101010f4], eax
test eax, eax
je 0x1004b48f
mov edi, str.wglShareLists
push edi
push dword [0x100fdf58]
call esi
mov dword [0x10100f68], eax
test eax, eax
jne 0x1004b49e
push edi
push ebx
push ebx
call fcn.100130d0
add esp, 0xc
xor al, al
jmp 0x1004b4a0
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x1005a676
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x1fd0]
mov eax, 0x2050
call fcn.100b5140
mov eax, dword [0x100fd640]
xor eax, ebp
mov dword [ebp + 0x1fcc], eax
mov ecx, dword [ebp + 0x1fe4]
mov eax, dword [ebp + 0x1fd8]
push ebx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1fe0]
push ecx
push eax
xor ebx, ebx
call dword [0x100fe0ec]
test eax, eax
je 0x1005a7df
push esi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x1005a7ce
push edi
push 0x2c
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [ebp + 0x1fe8]
add esp, 0xc
mov eax, edi
neg eax
mov dword [ebp - 0x58], eax
push 0x20
xor eax, eax
inc eax
mov word [ebp - 0x54], ax
pop eax
push ebx
mov word [ebp - 0x52], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x70]
mov esi, edi
push dword [ebp - 0x64]
imul esi, edi
mov dword [ebp - 0x60], 0x28
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x50], ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ebx, dword [sym.imp.kernel32.dll_GetVersion]
call ebx
cmp al, 5
jb 0x1005a73f
call ebx
shr eax, 8
cmp al, 1
jae 0x1005a745
call ebx
cmp al, 5
jbe 0x1005a75a
xor eax, eax
test esi, esi
jle 0x1005a75a
test dword [ebp + eax*4 - 0x34], 0xff000000
jne 0x1005a795
inc eax
cmp eax, esi
jl 0x1005a74b
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0xfcc]
push eax
push edi
push 0
push dword [ebp - 0x74]
push dword [ebp - 0x64]
call dword [sym.imp.GDI32.dll_GetDIBits]
xor ecx, ecx
test esi, esi
jle 0x1005a795
cmp dword [ebp + ecx*4 + 0xfcc], 0
jne 0x1005a790
lea eax, [ebp + ecx*4 - 0x34]
or dword [eax], 0xff000000
inc ecx
cmp ecx, esi
jl 0x1005a77c
push dword [ebp - 0x64]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [ebp - 0x6c]
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0x2cc]
mov ebx, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x390]
test al, al
jne 0x1005a7cd
mov eax, dword [edi]
lea ecx, [ebp - 0x34]
push ecx
push esi
push 0
push ebx
push edi
call dword [eax + 0x34c]
pop edi
push dword [ebp - 0x70]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x74]
call esi
pop esi
mov ecx, dword [ebp + 0x1fcc]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100b4c22
add ebp, 0x1fd0
leave
ret 0x14
Function at 0x1005eb54
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.J2D_TRACE_LEVEL
call esi
and dword [0x100fb180], 0
pop ecx
test eax, eax
je 0x1005eb9a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push ecx
push 0x100cf05c
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
test eax, eax
jle 0x1005eb9a
mov eax, dword [ebp - 4]
cmp eax, 5
ja 0x1005eb9a
mov dword [0x100fb180], eax
push str.J2D_TRACE_FILE
call esi
mov esi, eax
pop ecx
test esi, esi
je 0x1005ebcd
push 0x100cf048
push esi
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [0x100fe1a8], eax
test eax, eax
jne 0x1005ebe4
push esi
push str._E_:_Error_opening_trace_file__s_n
call dword [sym.imp.MSVCR100.dll_printf]
pop ecx
pop ecx
cmp dword [0x100fe1a8], 0
jne 0x1005ebe4
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
mov dword [0x100fe1a8], eax
pop esi
leave
ret