joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68007600
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
cmp dword [ecx + 4], 1
mov eax, dword [ecx + 8]
je 0x68007630
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, dword [eax + 0x1c]
mov eax, ebx
call sym._free_detail_fields
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc

Function at 0x68007670
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x18
cmp dword [ecx + 4], 1
mov eax, dword [ecx]
je 0x680076a0
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 4], 8
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowLongW]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x6800768c
mov eax, dword [eax]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 4]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x6800768c
Function at 0x68007720
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
cmp dword [ecx + 4], 1
mov dword [ebp - 0x60], eax
je 0x68007758
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 4], 0x965
xor edi, edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov ebx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call esi
mov dword [ebp - 0x5c], eax
sub esp, 0x10
mov edx, dword fs:[0x18]
mov dword [ebp - 0x64], edx
test eax, eax
jle 0x680077f6
mov eax, esi
mov esi, edi
mov edi, eax
lea esi, [esi]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], ebx
call edi
sub esp, 0x10
test eax, eax
je 0x680077f0
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x680077f0
cmp dword [ecx], 0x1c
je 0x68007850
inc esi
cmp dword [ebp - 0x5c], esi
jne 0x680077b0
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], 8
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowLongW]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x6800773f
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.comctl32.dll_ImageList_Destroy]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6800773f
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x680077f0
mov eax, dword [ecx + 4]
mov dword [esp + 4], 0
mov dword [ebp - 0x68], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x680077f0

Function at 0x680078b0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
cmp dword [ecx + 4], 1
mov eax, dword [ecx + 8]
je 0x680078e0
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, dword [eax + 0x1c]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.comctl32.dll_ImageList_Destroy]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
Function at 0x68009d30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x68017980
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
lea esi, [esi]
mov ecx, ebx
mov edx, edi
mov eax, esi
add ebx, 0xc
call sym._add_v1_field
cmp ebx, 0x680179c8
jne 0x68009d50
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x44]
test eax, eax
jne 0x68009d80
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov edx, edi
mov eax, esi
mov ecx, 0x680179c8
pop ebx
pop esi
pop edi
pop ebp
jmp sym._add_v1_field

Function at 0x68009e60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov edx, 1
mov ebp, esp
mov eax, dword [ebp + 8]
pop ebp
jmp sym._get_cert_name_string.constprop.0
Function at 0x6800b0d0
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov eax, dword [ecx + 8]
test byte [0x68015140], 8
jne 0x6800b110
cmp ebx, 1
je 0x6800b145
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p___08x___08Ix__n
mov dword [esp + 8], str.cert_prop_sheet_proc
mov dword [esp + 4], 0x68015140
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp ebx, 1
jne 0x6800b0fa
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp], esi
lea edi, [ebp - 0x28]
mov dword [esp + 4], 2
call ebx
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowRect]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0xc], 2
mov dword [esp], 0
call dword [sym.imp.user32.dll_MapWindowPoints]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], 2
call ebx
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
sub esp, 8
mov dword [ebp - 0x2c], edx
mov dword [esp], esi
mov dword [esp + 4], 1
call ebx
mov edx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 0x18], 0x1d
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowPos]
xor eax, eax
sub esp, 0x1c
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
Function at 0x6800c530
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp + 4], 0xaf4
mov dword [esp], eax
call esi
mov edi, dword [sym.imp.user32.dll_EnableWindow]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0xaf5
call esi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0xaf8
call esi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0xaf7
call esi
sub esp, 8
mov dword [esp + 0xc], 0x68017d36
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, ebx
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._refresh_store_certs

Function at 0x6800c5f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x68017980
sub esp, 0x1c
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
lea esi, [esi]
mov ecx, ebx
mov eax, edi
mov edx, esi
add ebx, 0xc
call sym._add_v1_field
mov eax, 0x680179c8
cmp eax, ebx
jne 0x6800c610
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x6800c680
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x68]
test edx, edx
je 0x6800c66d
xor ebx, ebx
lea esi, [esi]
nop
mov ecx, ebx
mov edx, esi
inc ebx
shl ecx, 4
add ecx, dword [eax + 0x6c]
mov eax, edi
call sym._add_cert_extension_detail
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
cmp ebx, dword [eax + 0x68]
jb 0x6800c650
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._add_properties
mov ecx, 0x680179c8
mov edx, esi
mov eax, edi
call sym._add_v1_field
jmp 0x6800c634

Function at 0x6800c780
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edi, [ebp - 0x168]
push ebx
lea ebx, [ebp - 0x158]
sub esp, 0x18c
mov dword [ebp - 0x16c], eax
mov dword [esp + 0xc], 0x50
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1f
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov dword [esp], esi
lea esi, [ebp - 0xb8]
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
sub esp, 8
mov dword [esp + 0x14], 0x50
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetDateFormatW]
sub esp, 0x18
cmp word [ebp - 0xb8], 0
je 0x6800c840
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x6800c818
sub ecx, esi
sar ecx, 1
mov eax, dword [ebp - 0x16c]
mov edx, esi
call sym._add_unformatted_text_to_control
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x6800c825
Function at 0x6800d260
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x130]
push ebx
sub esp, 0x14c
mov dword [ebp - 0x13c], edx
mov edx, 0xa
mov dword [ebp - 0x140], ecx
mov word [ebp - 0x136], dx
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
lea edx, [ebp - 0x124]
mov ecx, 0x14
mov dword [ebp - 0x130], 0x5c
mov ebx, eax
mov edi, edx
xor eax, eax
sub esp, 8
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], esi
mov edi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x128], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0x444
mov dword [esp], ebx
call edi
lea eax, [ebp - 0x134]
mov dword [ebp - 0xd4], 0xbc
mov dword [ebp - 0xd0], 1
sub esp, 0x10
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc8], 0x258
mov dword [esp + 4], eax
mov eax, dword [0x68024004]
mov dword [esp + 0xc], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
mov edx, dword [ebp - 0x134]
sub esp, 0x10
mov ecx, eax
mov eax, ebx
call sym._add_unformatted_text_to_control
lea eax, [ebp - 0xd4]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x447
mov dword [esp], ebx
call edi
mov dword [ebp - 0x128], 0
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x444
mov dword [esp], ebx
call edi
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x13c]
sub esp, 0x10
call sym._get_cert_name_string.constprop.0
test eax, eax
je 0x6800d3f2
cmp word [eax], 0
mov esi, eax
je 0x6800d430
mov ecx, eax
lea esi, [esi]
nop
add ecx, 2
cmp word [ecx], 0
jne 0x6800d3b8
sub ecx, esi
sar ecx, 1
mov edx, esi
mov eax, ebx
call sym._add_unformatted_text_to_control
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea edx, [ebp - 0x136]
mov eax, ebx
mov ecx, 1
call sym._add_unformatted_text_to_control
lea edx, [ebp - 0x136]
mov eax, ebx
mov ecx, 1
call sym._add_unformatted_text_to_control
lea edx, [ebp - 0x136]
mov eax, ebx
mov ecx, 1
call sym._add_unformatted_text_to_control
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x6800d3c5
Function at 0x6800f820
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x88
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov dword [ebp - 0x6c], eax
test byte [0x68015140], 8
jne 0x6800f970
mov ecx, 0x12
lea edi, [ebp - 0x60]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x6800f900
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
mov dword [ebp - 0x70], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6800f9d1
mov dword [esp + 0x14], edi
mov edx, dword [ebp - 0x70]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0
call edx
mov dword [ebp - 0x54], esi
sub esp, 0x18
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x6800f91b
test byte [0x68015140], 1
jne 0x6800f9a8
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call sym.cryptui.dll_CryptUIDlgViewCertificateW
sub esp, 8
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 8], str.CryptUIDlgViewCertificateA
mov dword [esp + 4], 0x68015140
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6800f84c
mov dword [esp + 0xc], str.ignoring_additional_prop_sheet_pages_n
mov dword [esp + 8], str.CryptUIDlgViewCertificateA
mov dword [esp + 4], 0x68015140
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6800f914
xor ebx, ebx
jmp 0x6800f956
Function at 0x68011660
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
test byte [0x68015140], 8
jne 0x68011798
cmp esi, 0x110
je 0x68011710
cmp esi, 0x111
jne 0x680116fe
cmp edi, 0x7d5
je 0x680117e0
cmp edi, 0x7d6
jne 0x680116fe
mov dword [esp + 4], 8
mov dword [esp], ebx
call dword [sym.imp.user32.dll_GetWindowLongW]
sub esp, 8
mov esi, eax
test eax, eax
je 0x680116fe
mov edx, dword [eax + 4]
test edx, edx
je 0x68011850
mov dword [esp + 0x10], eax
mov eax, dword [0x68024004]
mov dword [esp + 0xc], sym._user_notice_dlg_proc_16
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x67
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxParamW]
sub esp, 0x14
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov esi, dword [edx + 0x1c]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
test byte [esi + 8], 0x10
jne 0x68011820
mov dword [esp], ebx
mov dword [esp + 4], 0x7d6
call edi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_EnableWindow]
mov edx, esi
mov eax, ebx
sub esp, 8
call sym._set_cert_info
mov edx, dword [esi + 0x10]
mov eax, ebx
xor ecx, ecx
mov dword [esp], 0x3f2
call sym._set_cert_name_string
mov edx, dword [esi + 0x10]
mov ecx, 1
mov eax, ebx
mov dword [esp], 0x3f3
call sym._set_cert_name_string
mov edx, dword [esi + 0x10]
mov eax, ebx
call sym._set_cert_validity_period
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___08x___08Ix___08Ix__n
mov dword [esp + 8], str.general_dlg_proc
mov dword [esp + 4], 0x68015140
mov dword [esp], 3
mov dword [ebp - 0x2c], edx
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x2c]
jmp 0x6801168c
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call sym.cryptui.dll_CryptUIWizImport
xor eax, eax
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 4], 0x7d5
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
jmp 0x68011723
mov eax, dword [eax]
test eax, eax
je 0x680116fe
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CreateBindCtx]
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esi]
mov dword [esp], eax
call sym._HlinkSimpleNavigateToString_32
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
jmp 0x680116fe
Function at 0x68013ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x68013d3b
cmp byte [esi + ebx - 1], 0xa
je 0x68013d0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x680240c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x68014810
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x680240e0]
test eax, eax
je 0x680148c8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x68014850
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6801483c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x680148fd
mov dword [esp + 4], 0x6801e67c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x680240e0], eax
sub esp, 8
test eax, eax
jne 0x6801482d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6801483e
Function at 0x68014910
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x68014aa8
mov eax, dword [esi]
test eax, eax
je 0x68014a90
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x68014ab8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x68014a80
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x68014a46
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x68014980
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x68014aaa