joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b6c5320
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
test byte [0x6b6d7038], 8
jne 0x6b6c5478
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x6b6c54eb
mov dword [esp], edi
call sym._get_Cookie_magic
cmp eax, 0x50
jne 0x6b6c54e1
mov edi, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov edx, edi
shl edx, 4
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x24], eax
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6b6c5526
test edi, edi
je 0x6b6c5420
xor edi, edi
jmp 0x6b6c53c4
inc edi
add ebx, 0xc
add esi, 0x10
cmp dword [ebp - 0x1c], edi
je 0x6b6c5420
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._TF_SELECTION_to_TS_SELECTION_ACP
test eax, eax
jns 0x6b6c53b8
test byte [0x6b6d7038], 8
jne 0x6b6c54b8
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], 0
mov ebx, 0x80004005
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [edx + 0x24]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p___li__li__p_n
mov dword [esp + 8], str.Context_SetSelection
mov dword [esp + 4], 0x6b6d7038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6b6c5352
mov dword [esp + 0xc], str.Selection_Conversion_Failed_n
mov dword [esp + 8], str.Context_SetSelection
mov dword [esp + 4], 0x6b6d7038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6b6c53e1
mov ebx, 0x80040201
jmp 0x6b6c540d
mov ebx, 0x80004001
test byte [0x6b6d7038], 1
je 0x6b6c540d
mov dword [esp + 0xc], str.Context_does_not_have_a_ITextStoreACP_n
mov dword [esp + 8], str.Context_SetSelection
mov dword [esp + 4], 0x6b6d7038
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_2
jmp 0x6b6c540d
mov ebx, 0x8007000e
jmp 0x6b6c540d
Function at 0x6b6c73b0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
je 0x6b6c73e8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7048], 8
jne 0x6b6c7428
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6b6da25e
mov dword [esp + 8], str.DisplayAttributeMgr_Destructor
mov dword [esp + 4], 0x6b6d7048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6b6c73f1

Function at 0x6b6c7580
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6b6c7620
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c7627
mov edx, dword [ebp + 0xc]
mov dword [eax], sym._DisplayAttributeMgr_QueryInterface_12
xor ebx, ebx
mov dword [eax + 4], 1
mov dword [edx], eax
test byte [0x6b6d7048], 8
jne 0x6b6c75e8
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6b6da278
mov dword [esp + 8], str.DisplayAttributeMgr_Constructor
mov dword [esp + 4], 0x6b6d7048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, 0x80040110
jmp 0x6b6c75db
mov ebx, 0x8007000e
jmp 0x6b6c75db
Function at 0x6b6c7a50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
mov esi, 0xffffffff
push ebx
push ecx
sub esp, 0x3c
mov ebx, dword [ecx]
lock xadd dword [ebx + 8], esi
dec esi
je 0x6b6c7a88
lea esp, [ebp - 0xc]
mov eax, esi
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [ebp - 0x1c], 0
test byte [0x6b6d7058], 8
jne 0x6b6c7b50
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sym.msctf.dll_TF_GetThreadMgr
mov eax, dword [ebp - 0x1c]
sub esp, 4
test eax, eax
je 0x6b6c7acb
mov dword [esp], eax
mov dword [esp + 4], ebx
call sym._ThreadMgr_OnDocumentMgrDestruction
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6b6c7add
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6b6c7aef
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6b6c7b01
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
lea eax, [ebx + 0x20]
mov dword [esp], eax
call sym._free_sinks
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sym._CompartmentMgr_Destructor
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6da45e
mov dword [esp + 8], str.DocumentMgr_Destructor
mov dword [esp + 4], 0x6b6d7058
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6b6c7a9c

Function at 0x6b6c7fe0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
je 0x6b6c8018
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7058], 8
jne 0x6b6c8058
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6b6da45e
mov dword [esp + 8], str.EnumTfContext_Destructor
mov dword [esp + 4], 0x6b6d7058
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6b6c8021
Function at 0x6b6c8240
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
mov eax, dword fs:[0x18]
sub esp, 0x20
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c82d1
mov dword [ebx], eax
xor ebx, ebx
mov dword [eax], sym._EnumTfContext_QueryInterface_12
mov dword [eax + 4], 1
mov dword [eax + 0xc], esi
test byte [0x6b6d7058], 8
jne 0x6b6c82a0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6b6da4a3
mov dword [esp + 8], str.EnumTfContext_Constructor
mov dword [esp + 4], 0x6b6d7058
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x8007000e
jmp 0x6b6c8295

Function at 0x6b6c88d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov dword [esp + 8], 0x28
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c89b9
mov ebx, eax
mov dword [eax], str._xlk0wlkPzlk
xor esi, esi
mov dword [eax + 4], 0x6b6da704
mov dword [eax + 8], 1
mov eax, dword [ebp + 8]
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x20]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6b6e3778
mov dword [esp], ebx
call sym._CompartmentMgr_Constructor
lea eax, [ebp - 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [0x6b6ec008]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._Context_Constructor
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
test byte [0x6b6d7058], 8
jne 0x6b6c8988
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6da4a3
mov dword [esp + 8], str.DocumentMgr_Constructor
mov dword [esp + 4], 0x6b6d7058
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
mov esi, 0x8007000e
jmp 0x6b6c897b
Function at 0x6b6c8c10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1ec
mov eax, dword [eax + 0x60]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x1cc], 0x27
test eax, eax
je 0x6b6c8d60
mov edx, dword [ebx + 0x64]
lea ecx, [ebp - 0x1cc]
lea edi, [ebp - 0x1b6]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x6b6c8c8c
cmp eax, 0xea
jne 0x6b6c8dd8
inc dword [ebx + 0x64]
test esi, esi
je 0x6b6c8d50
lea eax, [ebp - 0x1c8]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
js 0x6b6c8d55
mov eax, dword [ebp + 8]
add esi, 0x14
mov dword [esi - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esi - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esi - 8], eax
movzx eax, word [ebx + 0x68]
mov word [esi - 4], ax
lea eax, [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._get_active_textservice
lea ecx, [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x1c8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x1c4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1c0]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x1bc]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0x6b6d7074
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x1c]
sub esp, 0x14
test eax, eax
jne 0x6b6c8e00
lea esi, [esi]
nop
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, word [ebx + 0x68]
lea edi, [ebp - 0x168]
mov dword [esp + 0x10], str.LanguageProfile
mov dword [esp + 8], str._s_s0x_08x
mov dword [esp + 0x14], eax
lea eax, [ebx + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xa8
mov dword [esp], edi
call sym._swprintf_1
lea eax, [ebx + 0x60]
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x6b6c8de7
mov dword [ebx + 0x64], 0
mov eax, dword [ebx + 0x60]
xor edx, edx
jmp 0x6b6c8c39
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [ebx + 0x60], 0
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x6c]
lea ecx, [ebp + 8]
mov edx, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x1c]
sub esp, 0x14
jmp 0x6b6c8d50
Function at 0x6b6c9310
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 0xc], ebx
dec ebx
je 0x6b6c9348
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7080], 8
jne 0x6b6c9390
lea eax, [esi + 0x14]
mov dword [esp], eax
call sym._free_sinks
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6b6da7be
mov dword [esp + 8], str.InputProcessorProfiles_Destructor
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6c9351

Function at 0x6b6c9420
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
je 0x6b6c9458
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7080], 8
jne 0x6b6c94a8
mov eax, dword [esi + 8]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6b6da7be
mov dword [esp + 8], str.ProfilesEnumGuid_Destructor
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6c9461
Function at 0x6b6c94e0
Capabilities:
Query or enumerate registry key

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x98
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x80], eax
test byte [0x6b6d7080], 8
jne 0x6b6c95d0
test esi, esi
je 0x6b6c95fd
mov eax, dword [edi + 8]
xor ebx, ebx
test eax, eax
je 0x6b6c95b1
mov edx, dword [ebp - 0x7c]
test edx, edx
jne 0x6b6c955e
jmp 0x6b6c95b1
lea eax, [ebp - 0x66]
inc dword [edi + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
sub esp, 8
test eax, eax
js 0x6b6c9556
inc ebx
add esi, 0x10
cmp ebx, dword [ebp - 0x7c]
jae 0x6b6c95b1
mov eax, dword [edi + 8]
lea edx, [ebp - 0x6c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x66]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edx
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x6c], 0x27
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x6b6c9538
cmp eax, 0xea
je 0x6b6c9538
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x6b6c95ba
mov dword [eax], ebx
xor eax, eax
cmp ebx, dword [ebp - 0x7c]
setne al
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x6b6da7d8
mov dword [esp + 8], str.ProfilesEnumGuid_Next
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6c9515
mov eax, 0x80004003
jmp 0x6b6c95c2
Function at 0x6b6c96e0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov edi, dword fs:[0x18]
sub esp, 0x4c
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c97f5
mov dword [eax], sym._ProfilesEnumGuid_QueryInterface_12
mov ebx, eax
lea eax, [eax + 8]
mov dword [eax - 4], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftCTFTIP
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
mov edx, eax
test eax, eax
jne 0x6b6c97d0
mov dword [esi], ebx
test byte [0x6b6d7080], 8
jne 0x6b6c9798
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6da7de
mov dword [esp + 8], str.ProfilesEnumGuid_Constructor
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
mov dword [ebp - 0x1c], eax
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, 0x80004005
sub esp, 0xc
jmp 0x6b6c978b
mov edx, 0x8007000e
jmp 0x6b6c978b

Function at 0x6b6c9b20
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0xffffffff
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
lock xadd dword [ebx + 4], esi
dec esi
je 0x6b6c9b58
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7080], 8
jne 0x6b6c9bc8
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call edi
mov eax, dword [ebx + 0x60]
sub esp, 4
test eax, eax
je 0x6b6c9b81
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6da7be
mov dword [esp + 8], str.EnumTfLanguageProfiles_Destructor
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6c9b61
Function at 0x6b6c9c00
Capabilities:
Query or enumerate registry key

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x44], eax
test byte [0x6b6d7080], 8
jne 0x6b6c9d50
test edi, edi
je 0x6b6c9d7d
mov eax, dword [ebx + 8]
xor esi, esi
test eax, eax
je 0x6b6c9d30
mov edx, dword [ebp - 0x3c]
test edx, edx
je 0x6b6c9d30
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x40], ecx
jmp 0x6b6c9c6c
cmp esi, dword [ebp - 0x3c]
jae 0x6b6c9d30
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 0x40]
lea ecx, [ebp - 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x2c], 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x6b6c9cbf
cmp eax, 0xea
jne 0x6b6c9d30
lea eax, [ebp - 0x28]
inc dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
sub esp, 8
test eax, eax
js 0x6b6c9c60
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x10], edi
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, ebx
call sym._next_LanguageProfile
cmp eax, 1
je 0x6b6c9d20
cmp eax, 0xffffffff
je 0x6b6c9c60
cmp dword [ebp - 0x3c], esi
ja 0x6b6c9cdc
jmp 0x6b6c9c60
inc esi
add edi, 0x38
jmp 0x6b6c9d10
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x6b6c9d39
mov dword [eax], esi
xor eax, eax
cmp esi, dword [ebp - 0x3c]
setne al
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6da7d8
mov dword [esp + 8], str.EnumTfLanguageProfiles_Next
mov dword [esp + 4], 0x6b6d7080
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6b6c9c32
mov eax, 0x80004003
jmp 0x6b6c9d41