joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62984690
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x629846f8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6298471e
mov edx, 1
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_0_n
mov dword [esp + 8], str.create_ps10_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x629846a3
test byte [0x6299e028], 2
jne 0x62984733
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps10_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x62984727

Function at 0x62984760
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x629847c8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x629847ee
mov edx, 0x101
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_1_n
mov dword [esp + 8], str.create_ps11_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x62984773
test byte [0x6299e028], 2
jne 0x62984803
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps11_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x629847f7
Function at 0x62984830
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x62984898
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x629848be
mov edx, 0x201
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_2_n
mov dword [esp + 8], str.create_ps12_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x62984843
test byte [0x6299e028], 2
jne 0x629848d3
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps12_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x629848c7

Function at 0x62984900
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x62984968
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x6298498e
mov edx, 0x301
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 4
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_3_n
mov dword [esp + 8], str.create_ps13_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x62984913
test byte [0x6299e028], 2
jne 0x629849a3
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps13_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x62984997
Function at 0x629849d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x62984a38
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x62984a5e
mov edx, 0x401
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 6
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_1_4_n
mov dword [esp + 8], str.create_ps14_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x629849e3
test byte [0x6299e028], 2
jne 0x62984a73
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps14_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x62984a67

Function at 0x62984aa0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x62984b08
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x62984b2e
mov edx, 2
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 8
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_2_0_n
mov dword [esp + 8], str.create_ps20_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x62984ab3
test byte [0x6299e028], 2
jne 0x62984b43
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps20_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x62984b37
Function at 0x62984b70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x62984bd8
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x62984bfe
mov edx, 0x102
mov dword [eax], 2
mov word [eax + 4], dx
mov edx, 8
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
jmp sym._gen_oldps_input.constprop.0
mov dword [esp + 0xc], str.ps_2_x_n
mov dword [esp + 8], str.create_ps2x_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x62984b83
test byte [0x6299e028], 2
jne 0x62984c13
mov dword [ebx + 0xc], 2
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps2x_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x62984c07

Function at 0x62984c40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x6299e018], 8
jne 0x62984ca0
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 4], eax
sub esp, 0xc
test eax, eax
je 0x62984cc6
mov edx, 3
mov dword [eax], 2
mov word [eax + 4], dx
mov dword [ebx], sym._asmparser_constF
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0xc], str.ps_3_0_n
mov dword [esp + 8], str.create_ps30_parser
mov dword [esp + 4], 0x6299e018
mov dword [esp], 3
call sym._wine_dbg_log
jmp 0x62984c53
test byte [0x6299e028], 2
jne 0x62984cd8
mov dword [ebx + 0xc], 2
jmp 0x62984c97
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_the_shader_n
mov dword [esp + 8], str.create_ps30_parser
mov dword [esp + 4], 0x6299e028
mov dword [esp], 1
call sym._wine_dbg_log
jmp 0x62984ccf
Function at 0x62985260
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x38
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x6299e038], 8
jne 0x629852a0
test ebx, ebx
je 0x629852d0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x629a1278
mov dword [esp + 8], str.d3dcompiler_blob_Release
mov dword [esp + 4], 0x6299e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test ebx, ebx
jne 0x6298528e
mov eax, dword [esi + 0xc]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1c], edx
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x629856b0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x6299e038], 8
jne 0x62985778
test esi, esi
je 0x629857e8
mov dword [esp + 8], 0x10
mov edx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6298589a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax], sym._d3dcompiler_blob_QueryInterface_12
mov dword [eax + 4], 1
mov dword [eax + 8], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [ebx + 0xc], eax
sub esp, 0xc
test eax, eax
je 0x62985823
mov dword [esi], ebx
xor edi, edi
test byte [0x6299e038], 8
jne 0x629857b0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.data_size__Iu__blob__p._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6299e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x629856d6
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x629a13b5
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6299e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov edi, 0x8876086c
test byte [0x6299e038], 4
je 0x62985761
mov dword [esp + 0xc], str.Invalid_blob_specified._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6299e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x62985761
call sym._d3dcompiler_blob_init.part.0
mov edi, eax
test eax, eax
jns 0x62985754
test byte [0x6299e038], 4
jne 0x62985870
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_initialize_blob__hr__lx._n
mov dword [esp + 8], str.D3DCreateBlob
mov dword [esp + 4], 0x6299e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x6298583b
mov edi, 0x8007000e
jmp 0x62985761
Function at 0x6298692a
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x6299e038], 8
jne 0x62986a08
cmp edi, 1
mov eax, 1
mov dword [esp], ebx
sbb eax, 0xffffffff
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x62986a48
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x10]
mov edi, eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], esi
call dword [eax + 0xc]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
test esi, esi
je 0x62986a70
cmp dword [ebp - 0x1c], edi
jne 0x62986a70
xor ebx, ebx
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.blob__p__filename__s__overwrite__x._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6299e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x62986949
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovg ebx, eax
lea esp, [ebp - 0x10]
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 0x80004005
test byte [0x6299e038], 4
je 0x629869f3
mov dword [esp + 0xc], str.Failed_to_write_blob_contents._n
mov dword [esp + 8], str.D3DWriteBlobToFile
mov dword [esp + 4], 0x6299e038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x629869f3
Function at 0x62987f90
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov edx, dword [edx]
cmp edx, ecx
jae 0x62988048
cmp ecx, 0x3fffffff
ja 0x62988039
mov ebx, eax
cmp edx, 8
mov eax, 8
cmovae eax, edx
cmp edx, 0x1fffffff
jbe 0x62987fd9
jmp 0x62987fdd
add eax, eax
cmp eax, 0x1fffffff
ja 0x62987fdd
cmp ecx, eax
ja 0x62987fd0
cmp ecx, eax
cmovae eax, ecx
mov edi, eax
lea edx, [eax*4]
mov eax, dword [ebx]
test eax, eax
je 0x62988058
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x62988030
mov dword [ebx], eax
mov eax, 1
mov dword [esi], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6299e048], 2
jne 0x6298807e
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6298801a
mov dword [esp + 0xc], str.Failed_to_allocate_memory._n
mov dword [esp + 8], str.array_reserve
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x62988039
Function at 0x6298a1c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x1c
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6298a24a
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6298a210
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 4], 8
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov dword [ebx + 0x28], eax
sub esp, 0xc
test eax, eax
je 0x6298a279
mov eax, dword [ebp + 8]
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6299e048], 2
je 0x6298a201
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_an_instruction_structure_n
mov dword [esp + 8], str.alloc_instr
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6298a201
test byte [0x6299e048], 2
jne 0x6298a2ad
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6298a201
mov dword [esp + 0xc], str.Failed_to_allocate_memory_for_instruction_registers_n
mov dword [esp + 8], str.alloc_instr
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
jmp 0x6298a282
Function at 0x6298a330
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6298a408
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x6298a450
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6298a480
mov dword [ebx + 8], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6298a4bb
movss xmm0, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x14]
movss dword [eax + 4], xmm0
movss xmm0, dword [ebp + 0x14]
mov dword [eax], edx
mov edx, dword [ebx + 8]
movss dword [eax + 8], xmm0
movss xmm0, dword [ebp + 0x18]
movss dword [eax + 0xc], xmm0
movss xmm0, dword [ebp + 0x1c]
movss dword [eax + 0x10], xmm0
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x14]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 8], eax
sub esp, 0xc
test eax, eax
jne 0x6298a392
test byte [0x6299e048], 2
je 0x6298a489
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6298a498
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6298a381
test byte [0x6299e048], 2
jne 0x6298a490
xor eax, eax
jmp 0x6298a3fc
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constF
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6298a3fc
test byte [0x6299e048], 2
je 0x6298a489
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6298a498
Function at 0x6298a4d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6298a598
lea edx, [eax*4 + 4]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6298a5e0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x6298a610
mov dword [ebx + 0xc], eax
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x6298a64b
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0xc], edx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x10], edx
mov edx, dword [ebx + 0xc]
mov dword [edx + ecx*4], eax
mov eax, 1
inc dword [ebx + 0x18]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebx + 0xc], eax
sub esp, 0xc
test eax, eax
jne 0x6298a532
test byte [0x6299e048], 2
je 0x6298a619
mov dword [esp + 0xc], str.Failed_to_allocate_the_constants_array_n
jmp 0x6298a628
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
jmp 0x6298a521
test byte [0x6299e048], 2
jne 0x6298a620
xor eax, eax
jmp 0x6298a58c
mov dword [esp + 0xc], str.Failed_to_grow_the_constants_array_n
mov dword [esp + 8], str.add_constI
mov dword [esp + 4], 0x6299e048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
xor eax, eax
jmp 0x6298a58c
test byte [0x6299e048], 2
je 0x6298a619
mov dword [esp + 0xc], str.Failed_to_allocate_a_new_constant_n
jmp 0x6298a628