joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f56c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f717
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44f6f8
mov dl, 1
mov eax, dword [0x41227c]
call fcn.004039d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404814
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44f6e7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00441a90
test al, al
je 0x44f6da
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44f728
lea eax, [ebp - 0x254]
call fcn.0040934c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44f6da
xor eax, eax
push ebp
push 0x44f6d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44f760
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44f6bc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44f6bc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f6da
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44f5dd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00415f54
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f71e
lea eax, [ebp - 0x260]
call fcn.00404814
ret

Function at 0x450090
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47bc90]
cmp byte [eax + 0xad], 0
jne 0x450101
cmp dword [0x47bcac], 0
jne 0x4500c2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45004c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47bcac], eax
cmp dword [0x47bca8], 0
jne 0x4500dd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47bca8], eax
cmp dword [0x47bcb0], 0
jne 0x450101
push esp
push 0
push 0
push 0x44fff0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x47bcb0], eax
pop edx
ret
Function at 0x4502d4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4502eb
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a0a8
mov eax, dword [0x4768b8]
cmp word [eax + 2], 0
jne 0x450313
mov eax, dword [0x4768b8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451ed4
mov eax, dword [0x47695c]
cmp word [eax + 2], 0
jne 0x45032d
mov eax, dword [0x47695c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004520e0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411e58]
call fcn.004039d0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411e58]
call fcn.004039d0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411e58]
call fcn.004039d0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e40c]
call fcn.00424254
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4504e4
mov eax, dword [0x4767e8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424628
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4527a4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4767e8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ca74
test eax, eax
je 0x450434
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408d04
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040caa8
test eax, eax
je 0x450448
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov byte [ebx + 0xd4], 0
push ebx
push 0x4519fc
call fcn.0041b224
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4766f0]
cmp byte [eax], 0
jne 0x450499
mov eax, ebx
call fcn.00450628
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045297c
mov eax, ebx
call fcn.004534e0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4504d9
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4508a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x450947
cmp dword [ebx + 0x94], 0
jne 0x450941
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x450830
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x450941
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x450907
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x450941
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004141fc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x450916
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x450b60
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x47bc90]
cmp dword [eax + 0x30], 0
je 0x450cbd
test bl, bl
jne 0x450c0e
cmp dword [esi + 0x9c], 0
jne 0x450c03
mov eax, esi
call fcn.0045335c
push eax
push 0x450a8c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x450bd4
mov eax, dword [0x47bc90]
call fcn.0045394c
test al, al
je 0x450bd4
mov eax, dword [0x47bcb4]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x450bd4
push 0
mov eax, dword [0x47bcb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x450bbe
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x450c03
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004141fc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x450be3
inc dword [esi + 0x9c]
jmp 0x450cbd
cmp dword [esi + 0x9c], 0
jle 0x450cbd
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x450cbd
cmp dword [esi + 0x44], 0
je 0x450c69
mov eax, dword [0x47bc90]
call fcn.0045394c
test al, al
je 0x450c69
mov eax, dword [0x47bcb4]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x450c69
push 5
mov eax, dword [0x47bcb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x450c53
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x450c98
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004141fc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x450c78
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x47bcb4
mov ecx, 1
mov edx, dword [0x450a6c]
call fcn.00405884
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x451750
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4517ba
mov eax, ebx
call fcn.0045394c
test al, al
jne 0x4517ba
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404904
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4517a7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4517c7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
jmp 0x4517c7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x452b60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452bce
mov eax, esi
call fcn.0043c950
test al, al
je 0x452bce
mov eax, dword [ebx + 0x84]
call fcn.0043c644
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452bce
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x452bc2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c644
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00434800
jmp 0x452bce
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045299c
pop esi
pop ebx
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e008]
jne 0x401010
repz ret
jmp fcn.0040189a

Function at 0x40923e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004053ae
and dword [ebp - 4], 0
cmp dword [0x810774], 0
mov ebx, eax
jne 0x4092ef
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093a0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093a0
push eax
call fcn.0040533c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x810774], eax
call esi
push eax
call fcn.0040533c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x810778], eax
call esi
push eax
call fcn.0040533c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81077c], eax
call esi
push eax
call fcn.0040533c
pop ecx
mov dword [0x810784], eax
test eax, eax
je 0x4092ef
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040533c
pop ecx
mov dword [0x810780], eax
mov eax, dword [0x810780]
cmp eax, ebx
je 0x409347
cmp dword [0x810784], ebx
je 0x409347
push eax
call fcn.004053b7
push dword [0x810784]
mov esi, eax
call fcn.004053b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409347
test edi, edi
je 0x409347
call esi
test eax, eax
je 0x40933e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40933e
test byte [ebp - 0xc], 1
jne 0x409347
or dword [ebp + 0x10], 0x200000
jmp 0x409380
mov eax, dword [0x810778]
cmp eax, ebx
je 0x409380
push eax
call fcn.004053b7
pop ecx
test eax, eax
je 0x409380
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409380
mov eax, dword [0x81077c]
cmp eax, ebx
je 0x409380
push eax
call fcn.004053b7
pop ecx
test eax, eax
je 0x409380
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x810774]
call fcn.004053b7
pop ecx
test eax, eax
je 0x4093a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b760
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x2ec91b4], 0x930
jne 0x40b77d
push str.gukegojigofacifiyefikaz
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x2ec91b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x2ec8ed0], eax
jne 0x40b7a3
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x408932
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, reloc.opengl32.dll_glEnable
call fcn.00408956
and eax, esi
xor dword [ebx], edi
push eax
pop eax
sub eax, 0xa10011d
add ebx, 1
cmp ebx, ecx
jne fcn.00408932
ret
Function at 0x476089
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x478f10
call fcn.004767c8
push 1
call fcn.0047632c
pop ecx
test al, al
jne 0x475f32
push 7
call fcn.00476593
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004762f7
mov byte [ebp - 0x24], al
mov eax, dword [0x49dd84]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x475f2b
test eax, eax
jne 0x475f9c
mov dword [0x49dd84], ecx
push 0x4783d8
push 0x4783c8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x475f7f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x476083
push 0x4783c4
push 0x4783bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49dd84], 2
jmp 0x475fa1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00476489
pop ecx
call fcn.00476587
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x475fd1
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fd1
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004767c2
call esi
call fcn.0047658d
mov esi, eax
cmp dword [esi], edi
je 0x475fef
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fef
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004766a8
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004766db
test al, al
jne 0x476028
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x476031
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004764a6
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x476083
call fcn.0047680e
ret
call fcn.00475da3
jmp 0x475f13

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003140
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
test byte [0x10016028], 8
jne 0x10003260
test esi, esi
je 0x100032c7
mov eax, dword [esi]
lea ecx, [eax + 0x1ff00]
cmp ecx, 1
ja 0x100032b8
test edi, edi
je 0x100032a8
cmp dword [edi + 0xc4], eax
mov edx, 0x10018809
sbb esi, esi
and esi, 0x80004005
cmp eax, dword [edi + 0xc4]
mov eax, str.Shader_version_not_supported_by_caps._n
cmovbe eax, edx
mov edi, eax
test ebx, ebx
je 0x10003230
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strlen]
lea ebx, [eax + 1]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10003224
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp + 0x18]
sub esp, 0xc
mov dword [edx], eax
test eax, eax
je 0x10003224
cmp ebx, 4
jb 0x10003240
mov ecx, dword [edi]
mov edx, edi
mov dword [eax], ecx
mov ecx, dword [edi + ebx - 4]
mov dword [eax + ebx - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
sub eax, ecx
add ebx, eax
sub edx, eax
and ebx, 0xfffffffc
cmp ebx, 4
jb 0x10003224
and ebx, 0xfffffffc
xor eax, eax
mov edi, dword [edx + eax]
mov dword [ecx + eax], edi
add eax, 4
cmp eax, ebx
jb 0x10003217
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov ebx, 1
mov edi, 0x10018809
jmp 0x100031b7
test ebx, ebx
je 0x10003224
movzx ecx, byte [edi]
mov byte [eax], cl
test bl, 2
je 0x10003224
movzx edx, word [edi + ebx - 2]
mov word [eax + ebx - 2], dx
jmp 0x10003224
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.vs_code__p__declaration__p__caps__p__return_error__x__errors__p._n
mov dword [esp + 8], str.ValidateVertexShader
mov dword [esp + 4], 0x10016028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x1000315f
xor esi, esi
mov edi, 0x10018809
jmp 0x100031a3
mov esi, 0x80004005
mov edi, str.Unsupported_shader_version._n
jmp 0x100031a3
mov esi, 0x80004005
mov edi, str.Invalid_code_pointer._n
jmp 0x100031a3
Function at 0x100032e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test byte [0x10016028], 8
jne 0x100033c0
test esi, esi
je 0x10003475
mov eax, dword [esi]
lea ecx, [eax + 0xff00]
cmp ecx, 4
ja 0x100033b0
test edi, edi
je 0x10003448
cmp dword [edi + 0xcc], eax
mov edx, 0x10018809
sbb esi, esi
and esi, 0x80004005
cmp eax, dword [edi + 0xcc]
mov eax, str.Shader_version_not_supported_by_caps._n
cmovbe eax, edx
mov edi, eax
test ebx, ebx
je 0x100033a0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strlen]
lea ebx, [eax + 1]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10003394
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp + 0x14]
sub esp, 0xc
mov dword [edx], eax
test eax, eax
je 0x10003394
cmp ebx, 4
jae 0x10003400
test ebx, ebx
jne 0x10003458
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ebx, 1
mov edi, 0x10018809
jmp 0x10003353
mov esi, 0x80004005
mov edi, str.Unsupported_shader_version._n
jmp 0x10003343
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.ps_code__p__caps__p__return_error__x__errors__p._n
mov dword [esp + 8], str.ValidatePixelShader
mov dword [esp + 4], 0x10016028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x100032ff
mov ecx, dword [edi]
mov edx, edi
mov dword [eax], ecx
mov ecx, dword [edi + ebx - 4]
mov dword [eax + ebx - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
sub eax, ecx
add ebx, eax
sub edx, eax
and ebx, 0xfffffffc
cmp ebx, 4
jb 0x10003394
and ebx, 0xfffffffc
xor eax, eax
mov edi, dword [edx + eax]
mov dword [ecx + eax], edi
add eax, 4
cmp eax, ebx
jb 0x1000342b
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
xor esi, esi
mov edi, 0x10018809
jmp 0x10003343
movzx ecx, byte [edi]
mov byte [eax], cl
test bl, 2
je 0x10003394
movzx edx, word [edi + ebx - 2]
mov word [eax + ebx - 2], dx
jmp 0x10003394
mov esi, 0x80004005
jmp 0x10003394
Function at 0x10003510
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call sym._wined3d_mutex_lock_0
mov ebx, dword [edi + 4]
lea eax, [edi + 4]
cmp ebx, eax
jne 0x10003542
jmp 0x100035c0
mov ebx, dword [ebx]
cmp ebx, eax
je 0x100035c0
mov ecx, dword [esi]
cmp dword [ebx + 8], ecx
jne 0x10003538
mov edi, dword [esi + 4]
cmp dword [ebx + 0xc], edi
jne 0x10003538
mov edi, dword [esi + 8]
cmp dword [ebx + 0x10], edi
jne 0x10003538
mov edi, dword [esi + 0xc]
cmp dword [ebx + 0x14], edi
jne 0x10003538
xor esi, esi
test ebx, ebx
je 0x100035c0
test byte [ebx + 0x18], 1
je 0x1000357b
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call sym._wined3d_mutex_unlock_0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._wined3d_mutex_unlock_0
mov esi, 0x88760866
jmp 0x100035b0