joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64a99950
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a99980
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx + 0x58]
mov dword [eax], edx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a999e0
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0xc]
cmp ecx, edx
jb 0x64a99a38
mov esi, dword [ebx + 0x60]
add eax, esi
mov dword [ebx + 0x68], edx
mov dword [eax], 0x4004
mov dword [eax + 4], 0xc
mov dword [eax + 8], 0
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a99967
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a99967
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a99ab8
mov dword [eax], 0x2b464d45
mov edx, 0x10
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a99998
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a99ab8
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0xc]
jmp 0x64a99998
mov eax, 3
jmp 0x64a99971
Function at 0x64a99ad0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a99af8
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a99b60
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0x10]
cmp ecx, edx
jb 0x64a99bb8
mov esi, dword [ebx + 0x60]
mov dword [ebx + 0x68], edx
mov edx, dword [ebp + 0xc]
add eax, esi
mov dword [eax], 0x4009
mov dword [eax + 4], 0x10
mov dword [eax + 8], 4
mov dword [eax + 0xc], edx
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a99ae7
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a99ae7
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a99c38
mov dword [eax], 0x2b464d45
mov edx, 0x14
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a99b10
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a99c38
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0x10]
jmp 0x64a99b10
mov eax, 3
jmp 0x64a99ae9
Function at 0x64a9a0e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9a108
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a9a198
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0x1c]
cmp ecx, edx
jb 0x64a9a1f0
mov esi, dword [ebx + 0x60]
fld dword [ebp + 0xc]
add eax, esi
mov dword [ebx + 0x68], edx
mov edx, 0x4032
mov word [eax], dx
movzx edx, word [ebp + 0x1c]
mov dword [eax + 4], 0x1c
fstp dword [eax + 0xc]
fld dword [ebp + 0x10]
shl edx, 8
and dx, 0xf00
mov dword [eax + 8], 0x10
mov word [eax + 2], dx
fstp dword [eax + 0x10]
fld dword [ebp + 0x14]
fstp dword [eax + 0x14]
fld dword [ebp + 0x18]
fstp dword [eax + 0x18]
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9a0f7
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9a0f7
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9a270
mov dword [eax], 0x2b464d45
mov edx, 0x20
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9a124
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a9a270
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0x1c]
jmp 0x64a9a124
mov eax, 3
jmp 0x64a9a0f9
Function at 0x64a9a280
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
cmp eax, 3
je 0x64a9a3c8
sub eax, 4
mov edx, 0xffffffff
cmp eax, 1
jbe 0x64a9a300
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a9a36d
mov eax, dword [ebx + 0x68]
lea edi, [eax + 0xc]
cmp ecx, edi
jb 0x64a9a3e0
mov esi, dword [ebx + 0x60]
add esi, eax
mov eax, 0x4034
mov dword [ebx + 0x68], edi
mov word [esi], ax
movzx eax, word [ebp + 0x10]
mov dword [esi + 4], 0xc
shl eax, 8
mov dword [esi + 8], 0
or eax, edx
mov word [esi + 2], ax
mov eax, dword [ebx + 0x68]
cmp eax, 4
ja 0x64a9a470
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._write_region_data
mov edx, 0x4008
lea ecx, [eax + 0xc]
lea eax, [ebp - 0x1c]
mov dword [esp], eax
mov eax, ebx
call sym._METAFILE_AllocateRecord
test eax, eax
jne 0x64a9a2f7
mov eax, dword [ebx + 0x84]
mov ecx, dword [ebp - 0x1c]
lea edx, [eax + 1]
and eax, 0x3f
add ecx, 0xc
mov dword [ebx + 0x84], edx
mov edx, eax
or ah, 4
mov word [ecx - 0xa], ax
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], ecx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._write_region_data
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x64a9a2b0
mov dword [ebp - 0x2c], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov dword [ebx + 0x60], eax
je 0x64a9a4d0
mov dword [eax], 0x2b464d45
mov edi, 0x10
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9a2c1
test byte [0x64ab5100], 1
jne 0x64a9a4a0
mov eax, 6
jmp 0x64a9a2f7
lea eax, [edi + edi]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a9a4d0
mov eax, dword [ebx + 0x68]
mov dword [esp + 8], eax
mov ecx, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 4], ecx
call sym._memcpy
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov edx, dword [ebp - 0x30]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edi, [eax + 0xc]
jmp 0x64a9a2c1
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
xor eax, eax
sub esp, 0xc
jmp 0x64a9a2f7
mov dword [esp + 0xc], 0x64abf26c
mov dword [esp + 8], str.METAFILE_SetClipRegion
mov dword [esp + 4], 0x64ab5100
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_9
jmp 0x64a9a3d5
mov eax, 3
jmp 0x64a9a2f7
Function at 0x64a9a4e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9a508
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a9a578
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0x10]
cmp ecx, edx
jb 0x64a9a5d0
mov esi, dword [ebx + 0x60]
mov dword [ebx + 0x68], edx
add eax, esi
mov edx, 0x4030
fld dword [ebp + 0x10]
mov word [eax], dx
mov edx, dword [ebp + 0xc]
mov dword [eax + 4], 0x10
mov dword [eax + 8], 4
mov word [eax + 2], dx
fstp dword [eax + 0xc]
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9a4f7
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9a4f7
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9a650
mov dword [eax], 0x2b464d45
mov edx, 0x14
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9a520
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a9a650
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0x10]
jmp 0x64a9a520
mov eax, 3
jmp 0x64a9a4f9
Function at 0x64a9a660
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9a688
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x64]
test edx, edx
je 0x64a9a710
mov eax, dword [ebx + 0x68]
lea edi, [eax + 0x24]
cmp edx, edi
jb 0x64a9a768
mov edx, dword [ebx + 0x60]
add edx, eax
mov dword [ebx + 0x68], edi
mov dword [edx], 0x402a
lea eax, [edx + 0xc]
mov dword [edx + 4], 0x24
mov dword [edx + 8], 0x18
mov ecx, dword [esi]
mov dword [edx + 0xc], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9a67a
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9a67a
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9a7f0
mov dword [eax], 0x2b464d45
mov edi, 0x28
mov edx, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9a6a4
lea eax, [edi + edi]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x64a9a7f0
mov eax, dword [ebx + 0x68]
mov dword [esp + 8], eax
mov ecx, dword [ebx + 0x60]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x20], edx
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x68]
sub esp, 0xc
mov dword [ebx + 0x60], edx
lea edi, [eax + 0x24]
jmp 0x64a9a6a4
mov eax, 3
jmp 0x64a9a67c
Function at 0x64a9a800
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9a828
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a9a8a8
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0x14]
cmp ecx, edx
jb 0x64a9a900
mov esi, dword [ebx + 0x60]
fld dword [ebp + 0xc]
mov dword [ebx + 0x68], edx
add eax, esi
mov edx, 0x402e
mov word [eax], dx
xor edx, edx
cmp dword [ebp + 0x14], 1
sete dl
mov dword [eax + 4], 0x14
fstp dword [eax + 0xc]
fld dword [ebp + 0x10]
shl edx, 0xd
mov dword [eax + 8], 8
mov word [eax + 2], dx
fstp dword [eax + 0x10]
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9a817
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9a817
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9a980
mov dword [eax], 0x2b464d45
mov edx, 0x18
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9a840
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a9a980
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0x14]
jmp 0x64a9a840
mov eax, 3
jmp 0x64a9a819
Function at 0x64a9a990
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9a9b8
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x64]
test edx, edx
je 0x64a9aa60
mov eax, dword [ebx + 0x68]
lea edi, [eax + 0x24]
cmp edx, edi
jb 0x64a9aab8
mov edx, dword [ebx + 0x60]
add eax, edx
mov edx, 0x402c
mov dword [ebx + 0x68], edi
mov word [eax], dx
xor edx, edx
cmp dword [ebp + 0x10], 1
sete dl
mov dword [eax + 4], 0x24
shl edx, 0xd
mov dword [eax + 8], 0x18
mov word [eax + 2], dx
mov ecx, dword [esi]
lea edx, [eax + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9a9aa
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9a9aa
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9ab40
mov dword [eax], 0x2b464d45
mov edi, 0x28
mov edx, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9a9d4
lea eax, [edi + edi]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x64a9ab40
mov eax, dword [ebx + 0x68]
mov dword [esp + 8], eax
mov ecx, dword [ebx + 0x60]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x20], edx
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x68]
sub esp, 0xc
mov dword [ebx + 0x60], edx
lea edi, [eax + 0x24]
jmp 0x64a9a9d4
mov eax, 3
jmp 0x64a9a9ac
Function at 0x64a9ab50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9ab78
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a9abf0
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0x10]
cmp ecx, edx
jb 0x64a9ac48
mov esi, dword [ebx + 0x60]
mov dword [ebx + 0x68], edx
add eax, esi
mov edx, 0x402f
fld dword [ebp + 0xc]
mov word [eax], dx
xor edx, edx
cmp dword [ebp + 0x10], 1
sete dl
mov dword [eax + 4], 0x10
shl edx, 0xd
mov dword [eax + 8], 4
mov word [eax + 2], dx
fstp dword [eax + 0xc]
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9ab67
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9ab67
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9acc8
mov dword [eax], 0x2b464d45
mov edx, 0x14
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9ab90
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a9acc8
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0x10]
jmp 0x64a9ab90
mov eax, 3
jmp 0x64a9ab69
Function at 0x64a9ace0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
sub eax, 4
cmp eax, 1
jbe 0x64a9ad08
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x64a9ad88
mov eax, dword [ebx + 0x68]
lea edx, [eax + 0x14]
cmp ecx, edx
jb 0x64a9ade0
mov esi, dword [ebx + 0x60]
fld dword [ebp + 0xc]
mov dword [ebx + 0x68], edx
add eax, esi
mov edx, 0x402d
mov word [eax], dx
xor edx, edx
cmp dword [ebp + 0x14], 1
sete dl
mov dword [eax + 4], 0x14
fstp dword [eax + 0xc]
fld dword [ebp + 0x10]
shl edx, 0xd
mov dword [eax + 8], 8
mov word [eax + 2], dx
fstp dword [eax + 0x10]
mov eax, dword [ebx + 0x68]
cmp eax, 4
jbe 0x64a9acf7
mov edx, dword [ebx + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call sym._GdiComment_12
mov dword [ebx + 0x68], 4
sub esp, 0xc
jmp 0x64a9acf7
mov dword [esp + 8], 0x100
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x60], eax
sub esp, 0xc
test eax, eax
je 0x64a9ae60
mov dword [eax], 0x2b464d45
mov edx, 0x18
mov esi, dword [ebx + 0x60]
mov eax, 4
mov dword [ebx + 0x64], 0x100
jmp 0x64a9ad20
lea eax, [edx + edx]
mov dword [ebp - 0x1c], eax
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64a9ae60
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x60], esi
sub esp, 0xc
lea edx, [eax + 0x14]
jmp 0x64a9ad20
mov eax, 3
jmp 0x64a9acf9