joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dec692a
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x6dede038], 8
jne 0x6dec6a08
cmp edi, 1
mov eax, 1
mov dword [esp], ebx
sbb eax, 0xffffffff
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x6dec6a48
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x10]
mov edi, eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], esi
call dword [eax + 0xc]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
test esi, esi
je 0x6dec6a70
cmp dword [ebp - 0x1c], edi
jne 0x6dec6a70
xor ebx, ebx
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.blob__p__filename__s__overwrite__x._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6dede038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6dec6949
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovg ebx, eax
lea esp, [ebp - 0x10]
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 0x80004005
test byte [0x6dede038], 4
je 0x6dec69f3
mov dword [esp + 0xc], str.Failed_to_write_blob_contents._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6dede038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x6dec69f3
Function at 0x6dec7f90
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov edx, dword [edx]
cmp edx, ecx
jae 0x6dec8048
cmp ecx, 0x3fffffff
ja 0x6dec8039
mov ebx, eax
cmp edx, 8
mov eax, 8
cmovae eax, edx
cmp edx, 0x1fffffff
jbe 0x6dec7fd9
jmp 0x6dec7fdd
add eax, eax
cmp eax, 0x1fffffff
ja 0x6dec7fdd
cmp ecx, eax
ja 0x6dec7fd0
cmp ecx, eax
cmovae eax, ecx
mov edi, eax
lea edx, [eax*4]
mov eax, dword [ebx]
test eax, eax
je 0x6dec8058
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6dec8030
mov dword [ebx], eax
mov eax, 1
mov dword [esi], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6dede048], 2
jne 0x6dec807e
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6dec801a
mov dword [esp + 0xc], str.Failed_to_allocate_memory._n
mov dword [esp + 8], str.array_reserve
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6dec8039
Function at 0x6deca1c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x1c
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6deca24a
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6deca210
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 4], 8
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov dword [ebx + 0x28], eax
sub esp, 0xc
test eax, eax
je 0x6deca279
mov eax, dword [ebp + 8]
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6dede048], 2
je 0x6deca201
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_an_instruction_structure_n
mov dword [esp + 8], str.alloc_instr
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6deca201
test byte [0x6dede048], 2
jne 0x6deca2ad
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6deca201
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_instruction_registers_n
mov dword [esp + 8], str.alloc_instr
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6deca282
Function at 0x6deca330
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6deca408
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x6deca450
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6deca480
mov dword [ebx + 8], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6deca4bb
movss xmm0, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x14]
movss dword [eax + 4], xmm0
movss xmm0, dword [ebp + 0x14]
mov dword [eax], edx
mov edx, dword [ebx + 8]
movss dword [eax + 8], xmm0
movss xmm0, dword [ebp + 0x18]
movss dword [eax + 0xc], xmm0
movss xmm0, dword [ebp + 0x1c]
movss dword [eax + 0x10], xmm0
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x14]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 8], eax
sub esp, 0xc
test eax, eax
jne 0x6deca392
test byte [0x6dede048], 2
je 0x6deca489
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6deca498
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6deca381
test byte [0x6dede048], 2
jne 0x6deca490
xor eax, eax
jmp 0x6deca3fc
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constF
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6deca3fc
test byte [0x6dede048], 2
je 0x6deca489
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6deca498
Function at 0x6deca4d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6deca598
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6deca5e0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6deca610
mov dword [ebx + 0xc], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6deca64b
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0xc], edx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x10], edx
mov edx, dword [ebx + 0xc]
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x18]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 0xc], eax
sub esp, 0xc
test eax, eax
jne 0x6deca532
test byte [0x6dede048], 2
je 0x6deca619
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6deca628
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6deca521
test byte [0x6dede048], 2
jne 0x6deca620
xor eax, eax
jmp 0x6deca58c
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constI
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6deca58c
test byte [0x6dede048], 2
je 0x6deca619
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6deca628
Function at 0x6deca660
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x6deca718
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6deca760
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6deca790
mov dword [ebx + 0x10], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6deca7cb
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x1c]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x10]
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x1c]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 0x10], eax
sub esp, 0xc
test eax, eax
jne 0x6deca6c2
test byte [0x6dede048], 2
je 0x6deca799
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6deca7a8
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6deca6b1
test byte [0x6dede048], 2
jne 0x6deca7a0
xor eax, eax
jmp 0x6deca70a
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constB
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6deca70a
test byte [0x6dede048], 2
je 0x6deca799
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6deca7a8
Function at 0x6decaa30
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x6decab3d
mov ebx, dword [esi + 0x34]
test ebx, ebx
je 0x6decab50
mov edx, dword [esi + 0x30]
xor ebx, ebx
jmp 0x6decaa68
mov eax, dword [esi + 0x34]
inc ebx
cmp eax, ebx
jbe 0x6decaab0
lea eax, [ebx + ebx*2]
cmp dword [edx + eax*4 + 4], edi
jne 0x6decaa60
test byte [0x6dede048], 4
je 0x6decaa60
mov dword [esp + 0x10], edi
inc ebx
mov dword [esp + 0xc], str.Sampler__u_already_declared_n
mov dword [esp + 8], str.record_sampler
mov dword [esp + 4], 0x6dede048
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
cmp eax, ebx
ja 0x6decaa68
lea esi, [esi]
lea eax, [eax + eax*2 + 3]
shl eax, 2
test edx, edx
je 0x6decaba0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6decab30
mov dword [esi + 0x30], eax
mov edx, dword [esi + 0x34]
mov ecx, dword [ebp + 0xc]
lea edx, [edx + edx*2]
mov dword [eax + edx*4], ecx
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 4], edi
mov eax, 1
inc dword [esi + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6dede048], 2
jne 0x6decabca
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xc
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 0x30], eax
sub esp, 0xc
test eax, eax
jne 0x6decaaef
test byte [0x6dede048], 2
je 0x6decab3d
mov dword [esp + 0xc], str.Error_allocating_samplers_array_n
jmp 0x6decabd2
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6decaae8
mov dword [esp + 0xc], str.Error_reallocating_samplers_array_n
mov dword [esp + 8], str.record_sampler
mov dword [esp + 4], 0x6dede048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6decab3f
Function at 0x6decb820
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor eax, eax
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret 8
Function at 0x6decd8d0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov eax, dword [eax + 0xc]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6decd930
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov edx, dword [eax + 0x1c]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
test edx, edx
je 0x6decd98d
mov eax, dword [eax + 0x10]
test eax, eax
je 0x6decd967
xor ebx, ebx
mov eax, ebx
shl eax, 5
add eax, edx
je 0x6decd961
call sym._free_variable.part.0
mov edx, dword [esi + 0x1c]
inc ebx
cmp dword [esi + 0x10], ebx
ja 0x6decd950
mov dword [esp + 8], edx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov edx, dword [esi + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6decea40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
test eax, eax
je 0x6deceab0
mov esi, edx
mov dword [esp], eax
mov ebx, eax
mov edi, 1
call dword [sym.imp.ucrtbase.dll_strlen]
lea edx, [eax + 1]
test eax, eax
je 0x6deceaa6
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov dword [esi], eax
je 0x6deceabf
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcpy
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov edi, 1
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
xor edi, edi
test byte [0x6dede160], 2
je 0x6deceaa6
mov dword [esp + 0xc], str.Failed_to_allocate_name_memory._n
mov dword [esp + 8], str.copy_name
mov dword [esp + 4], 0x6dede160
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_3
jmp 0x6deceaa6

Function at 0x6deceb60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
test byte [0x6dede160], 8
jne 0x6decebc8
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 8]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Free_signature__p_n
mov dword [esp + 8], str.free_signature
mov dword [esp + 4], 0x6dede160
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6deceb74
Function at 0x6ded0070
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6dede160], 8
jne 0x6ded00b0
test ebx, ebx
je 0x6ded00e0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._p_decreasing_refcount_to__lu._n
mov dword [esp + 8], str.d3dcompiler_shader_reflection_Release
mov dword [esp + 4], 0x6dede160
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
test ebx, ebx
jne 0x6ded009d
mov eax, esi
call sym._reflection_cleanup
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x6ded4a00
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
test byte [0x6dede180], 8
jne 0x6ded4a68
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
cmp eax, ecx
jae 0x6ded4ab0
mov ecx, dword [ebp + 0xc]
lea eax, [eax + eax*2]
mov dword [edx + eax*4], ecx
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], esi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 4], edx
inc dword [ebx + 4]
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp + 0xc]
call sym._wine_dbgstr_an.constprop.0_2
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.dxbc__p__tag__s__size__Ix._n
mov dword [esp + 8], 0x6dee834c
mov dword [esp + 4], 0x6dede180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
cmp eax, ecx
jb 0x6ded4a28
lea edi, [ecx + ecx]
mov dword [esp + 8], edx
lea ecx, [edi + ecx*4]
mov dword [esp + 4], 0
shl ecx, 2
mov dword [esp + 0xc], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov edx, eax
test eax, eax
je 0x6ded4af4
mov dword [ebx + 8], eax
mov eax, dword [ebx + 4]
mov dword [ebx], edi
jmp 0x6ded4a28
mov ebx, 0x8007000e
test byte [0x6dede180], 2
je 0x6ded4a57
mov dword [esp + 0xc], str.Failed_to_allocate_dxbc_section_memory_n
mov dword [esp + 8], 0x6dee834c
mov dword [esp + 4], 0x6dede180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x6ded4a57

Function at 0x6ded4b30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x6dede180], 8
jne 0x6ded4ba8
test ebx, ebx
je 0x6ded4b98
lea eax, [ebx + ebx*2]
shl eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 8], eax
sub esp, 0xc
test eax, eax
je 0x6ded4bd9
mov dword [esi + 4], 0
mov dword [esi], ebx
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, 0x18
mov ebx, 2
jmp 0x6ded4b51
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.dxbc__p__size__u._n
mov dword [esp + 8], str.dxbc_init
mov dword [esp + 4], 0x6dede180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6ded4b47
mov ebx, 0x8007000e
test byte [0x6dede180], 2
je 0x6ded4b88
mov dword [esp + 0xc], str.Failed_to_allocate_dxbc_section_memory_n
mov dword [esp + 8], str.dxbc_init
mov dword [esp + 4], 0x6dede180
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x6ded4b88
Function at 0x6ded4fb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x6dede180], 8
jne 0x6ded4ff0
mov edx, dword [ebx + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.dxbc__p._n
mov dword [esp + 8], str.dxbc_destroy
mov dword [esp + 4], 0x6dede180
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6ded4fc3