joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15117cc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
cmp edi, 1
jne 0x1511852
mov eax, dword [0x151bdb4]
inc dword [0x151bdb4]
test eax, eax
jne 0x1511852
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x151bd80], eax
mov edx, dword [ebp + 0x10]
mov dword [0x1514123], edx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0150de88
pop ecx
cmp dword [0x151678c], 0
je 0x151183d
call fcn.01511650
mov ebx, eax
test eax, eax
je 0x151183d
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x151183d
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], esi
jmp 0x1511852
xor eax, eax
lea edx, [ebp - 8]
push 0
push edx
mov dword [0x151678c], eax
call fcn.01511658
add esp, 8
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.01511960
mov ebx, eax
test edi, edi
jne 0x15118c1
test edi, edi
jne 0x1511892
dec dword [0x151bdb4]
jne 0x1511892
cmp dword [0x151bd80], 0
je 0x1511892
mov eax, dword [0x151bd80]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
xor edx, edx
mov dword [0x151bd80], edx
cmp dword [0x151bdb4], 0
jne 0x15118c1
cmp dword [0x151678c], 0
jne 0x15118c1
cmp dword [0x151677c], 0
je 0x15118b3
call dword [0x151677c]
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.01511658
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x61542f00
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov esi, dword [ecx + 0xc]
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0x14]
mov ebx, dword [ecx]
mov dword [ebp - 0x20], esi
mov esi, dword [ecx + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x24], edi
mov eax, dword [ecx + 8]
mov dword [ebp - 0x28], esi
mov edi, dword [ecx + 0x18]
movzx esi, word [ecx + 0x10]
test byte [0x615761e8], 8
jne 0x61542f90
mov eax, dword [ebx]
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 4], edx
call dword [eax + 0x20]
sub esp, 0x20
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x61543090
mov ecx, eax
mov dword [ebp - 0x2c], edx
shr ecx, 0x10
je 0x61543070
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6157bf24
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x2c], edx
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6157c1fc
mov dword [esp + 8], str.DispatchEx_Invoke
mov dword [esp + 4], 0x615761e8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x28]
jmp 0x61542f44
movzx eax, ax
mov dword [esp], 0x6157bf13
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x2c]
jmp 0x6154300b
mov eax, 0x6157bf0c
jmp 0x6154300b
Function at 0x6154bb60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0
mov ebx, dword [ebp + 0x14]
test byte [0x61576198], 8
jne 0x6154bcd0
lea eax, [edi - 1]
cmp eax, 1
ja 0x6154bc90
cmp edi, 2
jne 0x6154bbf1
cmp word [esi + 0x10], 1
je 0x6154bd61
lea eax, [esi + 0x10]
xor edi, edi
mov dword [esp + 0xc], 3
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov word [ebp - 0x28], di
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.oleaut32.dll_VariantChangeType]
sub esp, 0x10
test eax, eax
js 0x6154bc82
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x6154bd08
dec eax
cmp eax, 6
ja 0x6154bd6b
mov dword [ebp - 0x3c], eax
cmp word [esi], 1
je 0x6154bcb7
xor edx, edx
lea eax, [ebp - 0x38]
mov dword [esp + 4], esi
mov word [ebp - 0x38], dx
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.oleaut32.dll_VariantChangeType]
sub esp, 0x10
test eax, eax
js 0x6154bc82
movsd xmm0, qword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
movsd qword [esp], xmm0
call dword [sym.imp.oleaut32.dll_VariantTimeToSystemTime]
sub esp, 0xc
test eax, eax
js 0x6154bc82
test ebx, ebx
je 0x6154bc80
mov eax, 2
movzx ecx, word [ebp - 0x24]
sub ecx, dword [ebp - 0x3c]
add ecx, 7
mov word [ebx], ax
mov eax, 0x92492493
imul ecx
lea eax, [ecx + edx]
mov edx, ecx
sar edx, 0x1f
sar eax, 2
sub eax, edx
lea edx, [eax*8]
sub edx, eax
sub ecx, edx
inc ecx
mov word [ebx + 8], cx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x82d
mov dword [esp + 4], str..._src_wine_dlls_vbscript_global.c
mov dword [esp], str.args_cnt__1__args_cnt__2
call dword [sym.imp.ucrtbase.dll__assert]
cmp word [esi], 1
jne 0x6154bbfb
test ebx, ebx
je 0x6154bc80
mov ecx, 1
xor eax, eax
mov word [ebx], cx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call sym._wine_dbgstr_variant
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.Global_Weekday
mov dword [esp + 4], 0x61576198
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6154bb86
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x2000100c
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov eax, dword [ebp - 0x3c]
sub esp, 0x10
lea ecx, [eax + 1]
mov eax, 0x92492493
imul ecx
lea eax, [ecx + edx]
mov edx, ecx
sar edx, 0x1f
sar eax, 2
sub eax, edx
lea edx, [eax*8]
sub edx, eax
sub ecx, edx
mov dword [ebp - 0x3c], ecx
jmp 0x6154bbf1
mov eax, 0x800a005e
jmp 0x6154bc82
mov eax, 0x800a0005
jmp 0x6154bc82
Function at 0x6154c280
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
mov ebx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], ebx
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], eax
movzx ebx, word [ecx + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x18]
test byte [0x615761f8], 8
jne 0x6154c310
mov eax, dword [0x6157630c]
mov ecx, dword [eax]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [ecx + 0x2c]
sub esp, 0x20
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6154c410
mov ecx, eax
mov dword [ebp - 0x2c], edx
shr ecx, 0x10
je 0x6154c3f0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6157cc50
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x30], edx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____ld__s__ld__d__p__p__p__p__n
mov dword [esp + 8], str.Match2_Invoke
mov dword [esp + 4], 0x615761f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
mov edx, dword [ebp - 0x2c]
jmp 0x6154c2c4
movzx eax, ax
mov dword [esp], 0x6157cc3f
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
jmp 0x6154c38b
mov eax, 0x6157cbd8
jmp 0x6154c38b
Function at 0x6154cd20
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
mov ebx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], ebx
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], eax
movzx ebx, word [ecx + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x18]
test byte [0x615761f8], 8
jne 0x6154cdb0
mov eax, dword [0x61576310]
mov ecx, dword [eax]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [ecx + 0x2c]
sub esp, 0x20
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6154ceb0
mov ecx, eax
mov dword [ebp - 0x2c], edx
shr ecx, 0x10
je 0x6154ce90
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6157cc50
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x30], edx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____ld__s__ld__d__p__p__p__p__n
mov dword [esp + 8], str.MatchCollection2_Invoke
mov dword [esp + 4], 0x615761f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
mov edx, dword [ebp - 0x2c]
jmp 0x6154cd64
movzx eax, ax
mov dword [esp], 0x6157cc3f
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
jmp 0x6154ce2b
mov eax, 0x6157cbd8
jmp 0x6154ce2b
Function at 0x6154e070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
mov edi, dword [eax + 0xc]
lea eax, [edi + 2]
mov dword [ebx + 0xc], eax
movzx eax, word [edi + 2]
lea edx, [eax - 0x30]
cmp edx, 9
ja 0x6154e1e0
lea edx, [edi + 4]
mov dword [esp], ebx
xor ecx, ecx
xor esi, 1
mov dword [ebx + 0xc], edx
mov edx, 0xffff
and esi, 1
call sym._GetDecimalValue
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x6154e0c8
mov ecx, esi
mov eax, 0x2f
test cl, cl
jne 0x6154e164
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, 0x2c
je 0x6154e170
mov dword [ebp - 0x20], edx
cmp ax, 0x7d
jne 0x6154e1e0
mov eax, dword [ebx + 0x5c]
mov dword [esp + 4], 0x1c
mov dword [esp], eax
call sym._heap_pool_alloc
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x6154e1f0
mov edi, dword [ebp - 0x1c]
mov dword [eax], 0x18
mov ecx, 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [ebx + 0x20], eax
mov dword [eax + 0xc], edi
mov eax, dword [ebx + 0x20]
mov dword [eax + 0x10], edx
mov eax, edi
shr eax, 7
je 0x6154e13e
lea esi, [esi]
inc ecx
shr eax, 7
jne 0x6154e138
inc edx
mov eax, 1
shr edx, 7
je 0x6154e156
lea esi, [esi]
inc eax
shr edx, 7
jne 0x6154e150
mov edx, dword [ebx + 0x1c]
lea edx, [ecx + edx + 4]
add eax, edx
mov dword [ebx + 0x1c], eax
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ecx + 2]
mov dword [ebx + 0xc], eax
movzx edx, word [ecx + 2]
mov dword [ebp - 0x24], edx
mov eax, edx
sub edx, 0x30
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 9
mov edx, 0xffffffff
ja 0x6154e0db
add ecx, 4
mov dword [esp], ebx
mov eax, dword [ebp - 0x24]
mov edx, 0xffff
mov dword [ebx + 0xc], ecx
xor ecx, ecx
call sym._GetDecimalValue
mov edx, eax
cmp eax, 0xffffffff
jne 0x6154e1be
mov ecx, esi
mov eax, 0x30
test cl, cl
jne 0x6154e164
cmp dword [ebp - 0x1c], edx
jbe 0x6154e1ce
mov ecx, esi
mov eax, 0x31
test cl, cl
jne 0x6154e164
mov eax, dword [ebx + 0xc]
movzx eax, word [eax]
jmp 0x6154e0db
mov dword [ebx + 0xc], edi
mov eax, 0xffffffff
jmp 0x6154e164
mov dword [ebx + 0x20], 0
mov eax, 0x89
jmp 0x6154e164
Function at 0x61550a20
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
mov ebx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], ebx
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], eax
movzx ebx, word [ecx + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x18]
test byte [0x615761f8], 8
jne 0x61550ab0
mov eax, dword [0x61576308]
mov ecx, dword [eax]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [ecx + 0x2c]
sub esp, 0x20
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x61550bb0
mov ecx, eax
mov dword [ebp - 0x2c], edx
shr ecx, 0x10
je 0x61550b90
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6157cc50
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x30], edx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____ld__s__ld__d__p__p__p__p__n
mov dword [esp + 8], str.RegExp2_Invoke
mov dword [esp + 4], 0x615761f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
mov edx, dword [ebp - 0x2c]
jmp 0x61550a64
movzx eax, ax
mov dword [esp], 0x6157cc3f
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
jmp 0x61550b2b
mov eax, 0x6157cbd8
jmp 0x61550b2b
Function at 0x61552d00
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov esi, dword [ecx + 0xc]
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0x14]
mov ebx, dword [ecx]
mov dword [ebp - 0x20], esi
mov esi, dword [ecx + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x24], edi
mov eax, dword [ecx + 8]
mov dword [ebp - 0x28], esi
mov edi, dword [ecx + 0x18]
movzx esi, word [ecx + 0x10]
test byte [0x615761e8], 8
jne 0x61552d90
mov eax, dword [ebx]
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 4], edx
call dword [eax + 0x20]
sub esp, 0x20
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x61552e90
mov ecx, eax
mov dword [ebp - 0x2c], edx
shr ecx, 0x10
je 0x61552e70
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6157bf24
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x2c], edx
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6157c1fc
mov dword [esp + 8], str.ScriptDisp_Invoke
mov dword [esp + 4], 0x615761e8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x28]
jmp 0x61552d44
movzx eax, ax
mov dword [esp], 0x6157bf13
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x2c]
jmp 0x61552e0b
mov eax, 0x6157bf0c
jmp 0x61552e0b
Function at 0x61556100
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
mov ebx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], ebx
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], eax
movzx ebx, word [ecx + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x18]
test byte [0x615761f8], 8
jne 0x61556190
mov eax, dword [0x61576314]
mov ecx, dword [eax]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [ecx + 0x2c]
sub esp, 0x20
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x61556290
mov ecx, eax
mov dword [ebp - 0x2c], edx
shr ecx, 0x10
je 0x61556270
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6157cc50
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x30], edx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____ld__s__ld__d__p__p__p__p__n
mov dword [esp + 8], str.SubMatches_Invoke
mov dword [esp + 4], 0x615761f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
mov edx, dword [ebp - 0x2c]
jmp 0x61556144
movzx eax, ax
mov dword [esp], 0x6157cc3f
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x2c]
jmp 0x6155620b
mov eax, 0x6157cbd8
jmp 0x6155620b