joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425550
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [ecx]
cmp dword [esi + 0x768], 0
je 0x425594
mov eax, dword [esi + 0x7f8]
cmp eax, 0x11
je 0x425581
cmp eax, 0x21
je 0x425581
test eax, eax
jne 0x425594
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x24], 5
jne 0x425594
cmp ebx, 2
jle 0x425683
pop esi
mov eax, 7
pop ebp
ret 4
mov eax, esi
call fcn.004537d0
test al, al
je 0x42560d
mov esi, dword [esi + 0x7f8]
cmp esi, 0x3d
mov ecx, 7
je 0x4255c3
cmp esi, 0x3e
je 0x4255c3
cmp esi, 0x3f
je 0x4255c3
cmp esi, 0x40
je 0x4255c3
cmp esi, 0x41
jne 0x4255c8
mov ecx, 7
cmp esi, 0x42
je 0x4255dc
cmp esi, 0x43
je 0x4255dc
cmp esi, 0x44
je 0x4255dc
cmp esi, 0x46
jne 0x4255e1
mov ecx, 7
cmp ebp, 0x42
jne 0x4255f2
xor eax, eax
cmp ebx, ecx
pop esi
setge al
pop ebp
ret 4
mov eax, ebp
call fcn.0042b530
test al, al
je 0x425683
xor eax, eax
cmp ebx, ecx
pop esi
setl al
pop ebp
ret 4
cmp dword [esi + 0x768], 0
je 0x425673
mov eax, dword [esi + 0x7f8]
cmp eax, 0x24
je 0x42562b
cmp eax, 0x28
je 0x42562b
cmp eax, 0x16
jne 0x425673
mov eax, edi
mov edx, ebx
call fcn.004249f0
cmp eax, 0xffffffff
je 0x425651
cmp eax, ebp
je 0x425651
cmp ebp, 0x10
je 0x425651
cmp ebp, 0x1e
je 0x425651
pop esi
mov eax, 6
pop ebp
ret 4
cmp dword [esi + 0x7f8], 0x24
jne 0x425683
cmp ebx, 4
je 0x425664
cmp ebx, 6
jne 0x425683
cmp edi, 1
jne 0x425683
pop esi
mov eax, 1
pop ebp
ret 4
mov ecx, esi
call fcn.004539d0
test al, al
je 0x425683
cmp ebx, 8
jge 0x425669
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x41d3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4a3abc], 0
jne 0x41d4c4
mov byte [0x4a3abc], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41d55e
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x41d4ba
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4a51f9
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x41d4f1
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x41d48b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x41d4b5
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x41d559
Function at 0x6a7c25da
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6018], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c26a0
mov dword [esp], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c2686
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c27a0
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c2780
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d8018
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_app_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6018
mov dword [esp + 0x10], eax
mov eax, 0x6a7d80fd
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6a7c2623
mov dword [esp], 0x6a7d8007
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c271b
mov eax, section..rdata
jmp 0x6a7c271b
Function at 0x6a7c29ca
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6018], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c2a90
mov dword [esp], 1
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c2a76
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c2b90
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c2b70
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d8018
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_apps_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6018
mov dword [esp + 0x10], eax
mov eax, 0x6a7d80fd
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6a7c2a13
mov dword [esp], 0x6a7d8007
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c2b0b
mov eax, section..rdata
jmp 0x6a7c2b0b
Function at 0x6a7c41aa
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6068], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c4270
mov dword [esp], 2
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c4256
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c4370
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c4350
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d86f0
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_2
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_manager_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6068
mov dword [esp + 0x10], eax
mov eax, 0x6a7d8737
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6a7c41f3
mov dword [esp], 0x6a7d86e1
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_2
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c42eb
mov eax, 0x6a7d8660
jmp 0x6a7c42eb
Function at 0x6a7c738a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6078], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c7450
mov dword [esp], 6
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c7436
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c7550
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c7530
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d8958
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fwpolicy2_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6078
mov dword [esp + 0x10], eax
mov eax, 0x6a7d8a85
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7c73d3
mov dword [esp], 0x6a7d8947
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c74cb
mov eax, 0x6a7d8940
jmp 0x6a7c74cb
Function at 0x6a7c756a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6078], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c7630
mov dword [esp], 8
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c7616
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c7730
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c7710
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d8958
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.netfw_rule_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6078
mov dword [esp + 0x10], eax
mov eax, 0x6a7d8a85
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7c75b3
mov dword [esp], 0x6a7d8947
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c76ab
mov eax, 0x6a7d8940
jmp 0x6a7c76ab
Function at 0x6a7c774a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6078], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c7810
mov dword [esp], 9
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c77f6
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c7910
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c78f0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d8958
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.netfw_rules_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6078
mov dword [esp + 0x10], eax
mov eax, 0x6a7d8a85
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7c7793
mov dword [esp], 0x6a7d8947
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c788b
mov eax, 0x6a7d8940
jmp 0x6a7c788b