Function at 0x6f5085e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2d8
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x290], 0
mov esi, dword [ecx + 0x10]
mov edi, dword [ecx + 0x14]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x29c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x2a0], eax
test byte [0x6f50d038], 8
jne 0x6f5089c8
mov eax, ebx
call sym._skip_schema
mov ebx, eax
test eax, eax
je 0x6f508d0a
lea edx, [ebp - 0x280]
xor eax, eax
mov ecx, 0x14
mov dword [ebp - 0x284], 0x54
mov edi, edx
lea esi, [ebp - 0x284]
lea edx, [ebp - 0x290]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x2a0]
mov eax, dword [edi]
mov dword [esp], edi
mov dword [esp + 8], esi
mov dword [esp + 4], edx
call dword [eax + 0xc]
sub esp, 0xc
mov edi, eax
test eax, eax
js 0x6f508980
mov dword [esp], esi
call sym._ReleaseBindInfo_4
sub esp, 4
cmp word [ebx], 0
je 0x6f508cc8
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x6f5086a8
sub eax, ebx
mov edx, eax
add eax, 6
sar edx, 1
add edx, 3
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [ebp - 0x28c], edx
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x28c]
sub esp, 0xc
mov dword [esp], edi
add eax, eax
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call sym._memcpy
lea eax, [ebp - 0x28c]
mov dword [esp], edi
mov dword [esp + 0xc], 0x100000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dword [sym.imp.shlwapi.dll_UrlUnescapeW]
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x6f5088fc
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], 0x6f50fe80
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsstr]
mov ecx, eax
test eax, eax
je 0x6f508d8c
xor eax, eax
mov dword [ebp - 0x2ac], ecx
mov word [ecx], ax
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call sym._chm_openW
mov ecx, dword [ebp - 0x2ac]
test eax, eax
mov dword [ebp - 0x2a8], eax
je 0x6f508e10
movzx edx, word [ecx + 4]
lea ebx, [ecx + 4]
test dx, dx
je 0x6f508cd7
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x6f5087a0
sub eax, ebx
mov esi, eax
sar esi, 1
mov dword [ebp - 0x28c], esi
cmp dx, 0x2f
je 0x6f508943
cmp dx, 0x5c
je 0x6f508943
add eax, 2
mov dword [ebp - 0x2ac], ecx
lea edi, [esi + 1]
mov dword [esp + 8], eax
lea eax, [ecx + 6]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
mov ecx, dword [ebp - 0x2ac]
mov eax, 0x2f
mov dword [ebp - 0x28c], edi
mov word [ecx + 4], ax
cmp word [ebx + esi*2], 0x2f
mov eax, 0x2f
je 0x6f508c1e
mov edx, ebx
cmp ax, 0x5c
jne 0x6f50881e
mov esi, 0x2f
mov word [edx], si
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x6f508810
movzx edx, word [ecx + 4]
lea eax, [ecx + 6]
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x2ac], eax
lea ecx, [edi + 2]
lea eax, [esi + 2]
cmp dx, 0x2f
je 0x6f508867
mov word [esi], dx
test dx, dx
je 0x6f508a28
movzx edx, word [edi + 2]
mov esi, eax
mov edi, ecx
lea ecx, [edi + 2]
lea eax, [esi + 2]
cmp dx, 0x2f
jne 0x6f508847
mov edx, 0x2f
mov word [esi], dx
movzx edx, word [edi + 2]
cmp dx, 0x2e
jne 0x6f5088f3
mov esi, dword [ebp - 0x2ac]
nop
movzx edx, word [ecx + 2]
test dx, dx
je 0x6f508c4d
cmp dx, 0x2f
je 0x6f508960
cmp dx, 0x2e
jne 0x6f508c41
movzx edx, word [ecx + 4]
test dx, dx
je 0x6f5088b4
cmp dx, 0x2f
jne 0x6f508c41
add ecx, 6
cmp eax, esi
jbe 0x6f5088dc
cmp word [eax - 2], 0x2f
je 0x6f508970
sub eax, 2
jmp 0x6f5088dc
cmp word [eax - 2], 0x2f
lea edx, [eax - 2]
je 0x6f5088ea
mov eax, edx
cmp ebx, eax
jb 0x6f5088d0
cmp word [eax], 0x2f
je 0x6f508e46
movzx edx, word [ecx]
cmp dx, 0x2e
je 0x6f508880
mov esi, eax
mov edi, ecx
jmp 0x6f50883b
test byte [0x6f50d038], 4
jne 0x6f508bf1
mov esi, dword [ebp - 0x2a0]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
cmp word [ebx + eax - 2], 0x2f
je 0x6f508c20
mov eax, edx
test dx, dx
jne 0x6f50880e
jmp 0x6f50882e
add ecx, 4
jmp 0x6f5088ea
sub eax, 4
jmp 0x6f5088dc
test byte [0x6f50d038], 4
je 0x6f508933
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.GetBindInfo_failed:__08lx_n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x24], edi
mov edi, dword [ebp - 0x2a0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2a4]
mov dword [esp + 0x20], esi
mov esi, dword [ebp - 0x29c]
sub eax, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__p_____s__p__p__08lx__Ix__n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508631
test byte [0x6f50d038], 8
jne 0x6f508c57
lea esi, [ebp - 0x230]
xor eax, eax
mov ecx, 0x86
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2a8]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._chm_resolve_object
test eax, eax
jne 0x6f508d14
mov dword [esp], ebx
mov dword [esp + 4], 0x2f
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov edi, dword [ebp - 0x29c]
add eax, 2
mov edx, dword [edi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb
mov dword [esp], edi
call dword [edx + 0x10]
lea eax, [ebp - 0x288]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call sym._FindMimeFromData_32
mov ecx, dword [ebp - 0x2a0]
sub esp, 0x20
mov ebx, eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test ebx, ebx
js 0x6f508b39
mov eax, dword [edi]
mov edx, dword [ebp - 0x288]
mov dword [esp + 4], 0xd
mov dword [esp], edi
mov dword [esp + 8], edx
call dword [eax + 0x10]
mov eax, dword [ebp - 0x288]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
sub esp, 4
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x6f508b4e
mov dword [esp], eax
call sym._chm_close
mov eax, dword [ebp - 0x2a4]
mov edi, dword [ebp - 0x2a8]
mov ecx, 0x86
mov dword [eax + 0x14], edi
lea edi, [eax + 0x1c]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x29c]
mov edx, dword [edi]
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 9
call dword [edx + 0x14]
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x6f508c8b
mov esi, dword [ebp - 0x29c]
mov eax, dword [esi]
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], esi
call dword [eax + 0x10]
sub esp, 0xc
mov edi, eax
mov eax, dword [esi]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
call dword [eax + 0x18]
mov eax, edi
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.UrlUnescape_failed:__08lx_n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508909
mov esi, edi
dec esi
xor edi, edi
mov dword [ebp - 0x28c], esi
mov word [ebx + esi*2], di
movzx edx, word [ecx + 4]
mov eax, edx
test dx, dx
jne 0x6f50880e
jmp 0x6f50882e
movzx edx, word [ecx]
mov esi, eax
mov edi, ecx
jmp 0x6f50883b
lea edi, [ecx + 2]
mov esi, eax
jmp 0x6f50883b
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0xc], 0x6f50ff39
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508a35
test byte [0x6f50d038], 4
jne 0x6f508ce0
mov esi, dword [ebp - 0x2a4]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6f508cb0
mov dword [esp], eax
call sym._chm_close
mov dword [esi + 0x14], 0
mov eax, dword [ebp - 0x2a4]
mov esi, dword [ebp - 0x29c]
mov dword [eax + 0x10], 0
jmp 0x6f508bc2
mov eax, 6
mov edx, 3
jmp 0x6f5086bd
xor eax, eax
xor esi, esi
jmp 0x6f5087c9
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.ReportData_failed:__08lx_n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508c94
mov edi, 0x800c0011
jmp 0x6f508933
test byte [0x6f50d038], 4
jne 0x6f508dc1
mov edi, dword [ebp - 0x2a0]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x2a8]
sub esp, 0xc
mov dword [esp], eax
call sym._chm_close
mov edi, dword [ebp - 0x29c]
mov eax, dword [edi]
mov dword [esp], edi
mov edi, 0x80030002
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80030002
call dword [eax + 0x18]
sub esp, 0x10
jmp 0x6f508933
test byte [0x6f50d038], 4
jne 0x6f508dea
mov edi, dword [ebp - 0x2a0]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6f508d59
mov dword [esp + 0xc], str.Could_not_resolve_chm_object_n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508d21
mov dword [esp + 0xc], str.invalid_url_n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508d95
test byte [0x6f50d038], 4
je 0x6f508d95
mov dword [esp + 0xc], str.Could_not_open_chm_file_n
mov dword [esp + 8], str.ITSProtocol_Start
mov dword [esp + 4], 0x6f50d038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f508d95
add eax, 2
jmp 0x6f5088ea