joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a7c5ad0
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40e8], 8
jne 0x6a7c5b90
lea eax, [ebp - 0x1c]
mov dword [esp], 3
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7c5b77
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7c5c90
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7c5c70
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d6b04
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d726c
mov dword [esp + 8], str.fw_port_Invoke
mov dword [esp + 4], 0x6a7d40e8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7c5b13
movzx eax, ax
mov dword [esp], 0x6a7d6af3
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x40]
jmp 0x6a7c5c12
mov eax, 0x6a7d6aec
jmp 0x6a7c5c12
Function at 0x6a7c6860
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40e8], 8
jne 0x6a7c6920
lea eax, [ebp - 0x1c]
mov dword [esp], 4
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7c6907
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7c6a20
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7c6a00
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d6b04
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d726c
mov dword [esp + 8], str.fw_ports_Invoke
mov dword [esp + 4], 0x6a7d40e8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7c68a3
movzx eax, ax
mov dword [esp], 0x6a7d6af3
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x40]
jmp 0x6a7c69a2
mov eax, 0x6a7d6aec
jmp 0x6a7c69a2
Function at 0x6a7c7140
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40f8], 8
jne 0x6a7c7200
lea eax, [ebp - 0x1c]
mov dword [esp], 7
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7c71e7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7c7300
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7c72e0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d74fc
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d7543
mov dword [esp + 8], str.fw_profile_Invoke
mov dword [esp + 4], 0x6a7d40f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6a7c7183
movzx eax, ax
mov dword [esp], 0x6a7d74eb
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp - 0x40]
jmp 0x6a7c7282
mov eax, 0x6a7d74e4
jmp 0x6a7c7282
Function at 0x6a7c9140
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40d8], 8
jne 0x6a7c9200
lea eax, [ebp - 0x1c]
mov dword [esp], 6
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7c91e7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7c9300
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7c92e0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d6358
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d6464
mov dword [esp + 8], str.fwpolicy2_Invoke
mov dword [esp + 4], 0x6a7d40d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7c9183
movzx eax, ax
mov dword [esp], 0x6a7d6347
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x40]
jmp 0x6a7c9282
mov eax, 0x6a7d6340
jmp 0x6a7c9282
Function at 0x6a7cbd10
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40d8], 8
jne 0x6a7cbdd0
lea eax, [ebp - 0x1c]
mov dword [esp], 8
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7cbdb7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7cbed0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7cbeb0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d6358
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d6464
mov dword [esp + 8], str.netfw_rule_Invoke
mov dword [esp + 4], 0x6a7d40d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7cbd53
movzx eax, ax
mov dword [esp], 0x6a7d6347
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x40]
jmp 0x6a7cbe52
mov eax, 0x6a7d6340
jmp 0x6a7cbe52
Function at 0x6a7cd610
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40d8], 8
jne 0x6a7cd6d0
lea eax, [ebp - 0x1c]
mov dword [esp], 9
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7cd6b7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7cd7d0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7cd7b0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d6358
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d6464
mov dword [esp + 8], str.netfw_rules_Invoke
mov dword [esp + 4], 0x6a7d40d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7cd653
movzx eax, ax
mov dword [esp], 0x6a7d6347
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x40]
jmp 0x6a7cd752
mov eax, 0x6a7d6340
jmp 0x6a7cd752
Function at 0x6a7ce550
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x6a7ce6e8
mov eax, dword [esi]
test eax, eax
je 0x6a7ce6d0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x6a7ce6f8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x6a7ce6c0
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x6a7ce686
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x6a7ce5c0
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x6a7ce6ea
Function at 0x6a7cf130
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x6a7d40e8], 8
jne 0x6a7cf1f0
lea eax, [ebp - 0x1c]
mov dword [esp], 0xc
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x6a7cf1d7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x6a7cf2f0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x6a7cf2d0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d6b04
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a7d726c
mov dword [esp + 8], str.static_port_mapping_Invoke
mov dword [esp + 4], 0x6a7d40e8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7cf173
movzx eax, ax
mov dword [esp], 0x6a7d6af3
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x40]
jmp 0x6a7cf272
mov eax, 0x6a7d6aec
jmp 0x6a7cf272