joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fb44b90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44bf8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44c1e
mov edx, 0x102
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 8
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_2_x_n
mov dword [esp + 8], str.create_ps2x_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44ba3
test byte [0x6fb5e028], 2
jne 0x6fb44c33
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps2x_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb44c27

Function at 0x6fb44c60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6fb5e018], 8
jne 0x6fb44cc0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6fb44ce6
mov edx, 3
mov dword [eax], 2
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.ps_3_0_n
mov dword [esp + 8], str.create_ps30_parser
mov dword [esp + 4], 0x6fb5e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x6fb44c73
test byte [0x6fb5e028], 2
jne 0x6fb44cf8
mov dword [ebx + 0xc], 2
jmp 0x6fb44cb7
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps30_parser
mov dword [esp + 4], 0x6fb5e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x6fb44cef
Function at 0x6fb45280
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x38
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6fb5e038], 8
jne 0x6fb452c0
test ebx, ebx
je 0x6fb452f0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6fb61278
mov dword [esp + 8], str.d3dcompiler_blob_Release
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test ebx, ebx
jne 0x6fb452ae
mov eax, dword [esi + 0xc]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1c], edx
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x6fb456d0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x6fb5e038], 8
jne 0x6fb45798
test esi, esi
je 0x6fb45808
mov dword [esp + 8], 0x10
mov edx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6fb458ba
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax], sym._d3dcompiler_blob_QueryInterface_12
mov dword [eax + 4], 1
mov dword [eax + 8], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [ebx + 0xc], eax
sub esp, 0xc
test eax, eax
je 0x6fb45843
mov dword [esi], ebx
xor edi, edi
test byte [0x6fb5e038], 8
jne 0x6fb457d0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.data_size__Iu__blob__p._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6fb456f6
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6fb613b5
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov edi, 0x8876086c
test byte [0x6fb5e038], 4
je 0x6fb45781
mov dword [esp + 0xc], str.Invalid_blob_specified._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x6fb45781
call sym._d3dcompiler_blob_init.part.0
mov edi, eax
test eax, eax
jns 0x6fb45774
test byte [0x6fb5e038], 4
jne 0x6fb45890
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_initialize_blob__hr__lx._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x6fb4585b
mov edi, 0x8007000e
jmp 0x6fb45781
Function at 0x6fb4694a
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x6fb5e038], 8
jne 0x6fb46a28
cmp edi, 1
mov eax, 1
mov dword [esp], ebx
sbb eax, 0xffffffff
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x6fb46a68
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x10]
mov edi, eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], esi
call dword [eax + 0xc]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
test esi, esi
je 0x6fb46a90
cmp dword [ebp - 0x1c], edi
jne 0x6fb46a90
xor ebx, ebx
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.blob__p__filename__s__overwrite__x._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6fb46969
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovg ebx, eax
lea esp, [ebp - 0x10]
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 0x80004005
test byte [0x6fb5e038], 4
je 0x6fb46a13
mov dword [esp + 0xc], str.Failed_to_write_blob_contents._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6fb5e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x6fb46a13
Function at 0x6fb47fb0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov edx, dword [edx]
cmp edx, ecx
jae 0x6fb48068
cmp ecx, 0x3fffffff
ja 0x6fb48059
mov ebx, eax
cmp edx, 8
mov eax, 8
cmovae eax, edx
cmp edx, 0x1fffffff
jbe 0x6fb47ff9
jmp 0x6fb47ffd
add eax, eax
cmp eax, 0x1fffffff
ja 0x6fb47ffd
cmp ecx, eax
ja 0x6fb47ff0
cmp ecx, eax
cmovae eax, ecx
mov edi, eax
lea edx, [eax*4]
mov eax, dword [ebx]
test eax, eax
je 0x6fb48078
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6fb48050
mov dword [ebx], eax
mov eax, 1
mov dword [esi], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6fb5e048], 2
jne 0x6fb4809e
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6fb4803a
mov dword [esp + 0xc], str.Failed_to_allocate_memory._n
mov dword [esp + 8], str.array_reserve
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6fb48059
Function at 0x6fb4a1e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x1c
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6fb4a26a
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6fb4a230
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 4], 8
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov dword [ebx + 0x28], eax
sub esp, 0xc
test eax, eax
je 0x6fb4a299
mov eax, dword [ebp + 8]
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6fb5e048], 2
je 0x6fb4a221
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_an_instruction_structure_n
mov dword [esp + 8], str.alloc_instr
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6fb4a221
test byte [0x6fb5e048], 2
jne 0x6fb4a2cd
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6fb4a221
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_instruction_registers_n
mov dword [esp + 8], str.alloc_instr
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6fb4a2a2
Function at 0x6fb4a350
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6fb4a428
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x6fb4a470
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6fb4a4a0
mov dword [ebx + 8], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6fb4a4db
movss xmm0, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x14]
movss dword [eax + 4], xmm0
movss xmm0, dword [ebp + 0x14]
mov dword [eax], edx
mov edx, dword [ebx + 8]
movss dword [eax + 8], xmm0
movss xmm0, dword [ebp + 0x18]
movss dword [eax + 0xc], xmm0
movss xmm0, dword [ebp + 0x1c]
movss dword [eax + 0x10], xmm0
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x14]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 8], eax
sub esp, 0xc
test eax, eax
jne 0x6fb4a3b2
test byte [0x6fb5e048], 2
je 0x6fb4a4a9
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6fb4a4b8
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6fb4a3a1
test byte [0x6fb5e048], 2
jne 0x6fb4a4b0
xor eax, eax
jmp 0x6fb4a41c
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constF
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6fb4a41c
test byte [0x6fb5e048], 2
je 0x6fb4a4a9
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6fb4a4b8
Function at 0x6fb4a4f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6fb4a5b8
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6fb4a600
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6fb4a630
mov dword [ebx + 0xc], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6fb4a66b
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0xc], edx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x10], edx
mov edx, dword [ebx + 0xc]
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x18]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 0xc], eax
sub esp, 0xc
test eax, eax
jne 0x6fb4a552
test byte [0x6fb5e048], 2
je 0x6fb4a639
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6fb4a648
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6fb4a541
test byte [0x6fb5e048], 2
jne 0x6fb4a640
xor eax, eax
jmp 0x6fb4a5ac
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constI
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6fb4a5ac
test byte [0x6fb5e048], 2
je 0x6fb4a639
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6fb4a648
Function at 0x6fb4a680
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x6fb4a738
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6fb4a780
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6fb4a7b0
mov dword [ebx + 0x10], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6fb4a7eb
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x1c]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x10]
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x1c]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 0x10], eax
sub esp, 0xc
test eax, eax
jne 0x6fb4a6e2
test byte [0x6fb5e048], 2
je 0x6fb4a7b9
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6fb4a7c8
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6fb4a6d1
test byte [0x6fb5e048], 2
jne 0x6fb4a7c0
xor eax, eax
jmp 0x6fb4a72a
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constB
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6fb4a72a
test byte [0x6fb5e048], 2
je 0x6fb4a7b9
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6fb4a7c8
Function at 0x6fb4aa50
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x6fb4ab5d
mov ebx, dword [esi + 0x34]
test ebx, ebx
je 0x6fb4ab70
mov edx, dword [esi + 0x30]
xor ebx, ebx
jmp 0x6fb4aa88
mov eax, dword [esi + 0x34]
inc ebx
cmp eax, ebx
jbe 0x6fb4aad0
lea eax, [ebx + ebx*2]
cmp dword [edx + eax*4 + 4], edi
jne 0x6fb4aa80
test byte [0x6fb5e048], 4
je 0x6fb4aa80
mov dword [esp + 0x10], edi
inc ebx
mov dword [esp + 0xc], str.Sampler__u_already_declared_n
mov dword [esp + 8], str.record_sampler
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
cmp eax, ebx
ja 0x6fb4aa88
lea esi, [esi]
lea eax, [eax + eax*2 + 3]
shl eax, 2
test edx, edx
je 0x6fb4abc0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6fb4ab50
mov dword [esi + 0x30], eax
mov edx, dword [esi + 0x34]
mov ecx, dword [ebp + 0xc]
lea edx, [edx + edx*2]
mov dword [eax + edx*4], ecx
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 4], edi
mov eax, 1
inc dword [esi + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6fb5e048], 2
jne 0x6fb4abea
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xc
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi + 0x30], eax
sub esp, 0xc
test eax, eax
jne 0x6fb4ab0f
test byte [0x6fb5e048], 2
je 0x6fb4ab5d
mov dword [esp + 0xc], str.Error_allocating_samplers_array_n
jmp 0x6fb4abf2
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6fb4ab08
mov dword [esp + 0xc], str.Error_reallocating_samplers_array_n
mov dword [esp + 8], str.record_sampler
mov dword [esp + 4], 0x6fb5e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6fb4ab5f
Function at 0x6fb4b840
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor eax, eax
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret 8
Function at 0x6fb4d8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov eax, dword [eax + 0xc]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fb4d950
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov edx, dword [eax + 0x1c]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
test edx, edx
je 0x6fb4d9ad
mov eax, dword [eax + 0x10]
test eax, eax
je 0x6fb4d987
xor ebx, ebx
mov eax, ebx
shl eax, 5
add eax, edx
je 0x6fb4d981
call sym._free_variable.part.0
mov edx, dword [esi + 0x1c]
inc ebx
cmp dword [esi + 0x10], ebx
ja 0x6fb4d970
mov dword [esp + 8], edx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov edx, dword [esi + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret