Function at 0x667c5f90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov ebx, dword [ecx + 8]
test byte [0x667cc034], 8
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x20], ebx
mov ebx, dword [eax + 0x14]
jne 0x667c61a0
test ebx, ebx
sete dl
test ecx, ecx
setne al
or dl, al
jne 0x667c6178
test esi, esi
je 0x667c6178
mov dword [ebx], 0
mov eax, edi
and eax, 0xf
je 0x667c6200
dec eax
cmp eax, 1
ja 0x667c6178
mov eax, edi
mov ecx, 0xc0000000
and eax, 0xf0
cmp eax, 0x20
je 0x667c6215
ja 0x667c6140
test eax, eax
je 0x667c614a
cmp eax, 0x10
jne 0x667c6178
mov edx, edi
xor eax, eax
and edx, 0xf000
je 0x667c6160
cmp edx, 0x1000
jne 0x667c6178
mov dword [ebp - 0x20], 2
mov dword [esp + 8], eax
xor edx, edx
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 0xc], edx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x667c6250
mov dword [ebp - 0x20], eax
xor edx, edx
mov ecx, 0x1c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
call eax
mov ecx, dword [ebp - 0x20]
mov dword [eax], sym._shstream_QueryInterface_12
sub esp, 0xc
mov edx, eax
cmp word [esi], 0
mov dword [eax + 4], 1
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
je 0x667c6270
mov ecx, esi
lea esi, [esi]
nop
add ecx, 2
cmp word [ecx], 0
jne 0x667c60e0
sub ecx, esi
lea edi, [ecx + 2]
mov dword [ebp - 0x20], edx
xor edx, edx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov edx, dword [ebp - 0x20]
mov ecx, edi
mov dword [edx + 0x10], eax
sub esp, 0xc
cmp ecx, 8
mov edi, eax
jae 0x667c6220
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [ebx], edx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
cmp eax, 0x30
je 0x667c6190
cmp eax, 0x40
jne 0x667c6178
mov eax, 3
mov edx, edi
and edx, 0xf000
jne 0x667c603b
lea esi, [esi]
cmp dword [ebp - 0x20], 1
sbb edx, edx
and edx, 2
inc edx
mov dword [ebp - 0x20], edx
jmp 0x667c604e
mov eax, 0x80070057
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
mov eax, 2
jmp 0x667c614f
mov dword [ebp - 0x24], ecx
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x24], ebx
mov ecx, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov dword [esp], 3
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, str._s___ld___lx___d___p___p__n
mov dword [esp + 0x10], eax
mov eax, str.SHCreateStreamOnFileEx
mov dword [esp + 8], eax
mov eax, 0x667cc034
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0
mov ecx, dword [ebp - 0x24]
jmp 0x667c5fca
mov eax, edi
mov ecx, 0x80000000
and eax, 0xf0
cmp eax, 0x20
jne 0x667c6014
mov eax, 1
jmp 0x667c614f
test al, 1
jne 0x667c628c
test edi, 2
jne 0x667c627a
test edi, 4
je 0x667c6125
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x667c6125
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
test eax, eax
jle 0x667c617d
movzx eax, ax
or eax, 0x80070000
jmp 0x667c617d
mov edi, 2
jmp 0x667c60ee
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x667c622c
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x667c6224