joyce8/EMBER2024-capa huggingface dataset:
Function at 0x625ca040
Capabilities:
Contain obfuscated stackstrings
Get disk size

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625ca100
test ebx, ebx
je 0x625ca13f
lea eax, [ebp - 0x20]
add esi, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x625ca138
mov esi, dword [ebp - 0x1c]
test esi, esi
jne 0x625ca0c8
mov eax, dword [ebp - 0x20]
test eax, eax
js 0x625ca0c8
mov edx, 3
mov dword [ebx + 8], eax
xor eax, eax
mov word [ebx], dx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, 5
add ebx, 8
mov word [ebx - 8], cx
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.oleaut32.dll_VarR8FromUI8]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [esi - 0xc]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5e28
mov dword [esp + 8], str.drive_get_FreeSpace
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625ca065
mov eax, 0x80004005
jmp 0x625ca0ee
mov eax, 0x80004003
jmp 0x625ca0ee

Function at 0x625ca5b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x108]
mov ebx, eax
lea eax, [ebp - 0x10c]
sub esp, 0x130
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x100
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x625ca650
mov edx, dword [ebx + 0xc]
add ebx, 0xc
mov dword [esp], ebx
call dword [edx + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
sub esp, 4
cmp eax, 5
je 0x625ca680
jbe 0x625ca630
mov ebx, 0x800a003a
cmp eax, 0x50
je 0x625ca624
cmp eax, 0xb7
jne 0x625ca687
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x800a0035
cmp eax, 2
je 0x625ca624
cmp eax, 3
jne 0x625ca687
lea esp, [ebp - 8]
mov ebx, 0x800a004c
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [ebp - 0x10c]
xor eax, eax
mov edx, esi
cmp ecx, 0x100
setne al
mov dword [ebx + 0x2c], eax
mov eax, ebx
call sym._append_read_data
lea esp, [ebp - 8]
mov ebx, eax
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x800a0046
jmp 0x625ca624
mov ebx, 0x80004005
test byte [0x625d3028], 1
je 0x625ca624
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_error_code:__ld_n
mov dword [esp + 8], str.create_error
mov dword [esp + 4], 0x625d3028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x625ca624
Function at 0x625caa60
Capabilities:
Set file attributes

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x625d3028], 8
jne 0x625caab0
mov dword [esp + 4], esi
mov eax, dword [ebx + 8]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
sub esp, 8
test eax, eax
je 0x625caae8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [ebx - 0xc]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625d5fae
mov dword [esp + 8], str.file_put_Attributes
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625caa81
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 5
je 0x625cab70
jbe 0x625cab48
mov ebx, 0x800a003a
cmp eax, 0x50
je 0x625caa9a
cmp eax, 0xb7
je 0x625caa9a
mov ebx, 0x80004005
test byte [0x625d3028], 1
je 0x625caa9a
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_error_code:__ld_n
mov dword [esp + 8], str.create_error
mov dword [esp + 4], 0x625d3028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x625caa9a
mov ebx, 0x800a0035
cmp eax, 2
je 0x625caa9a
cmp eax, 3
jne 0x625cab09
lea esp, [ebp - 0xc]
mov ebx, 0x800a004c
pop ecx
mov eax, ebx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov ebx, 0x800a0046
jmp 0x625caa9a
Function at 0x625cab80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x3c
mov dword [edx], 0
mov esi, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], edx
mov dword [esp], 0x18
call esi
test eax, eax
je 0x625cad47
mov dword [eax + 0xc], sym._file_QueryInterface_12
mov ebx, eax
mov dword [eax + 0x10], 1
mov dword [esp], edi
mov edi, dword [sym.imp.kernel32.dll_GetFullPathNameW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call edi
sub esp, 0x10
mov edx, eax
test eax, eax
je 0x625cad18
add eax, eax
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x20]
test eax, eax
mov dword [ebx + 0x14], eax
je 0x625cad51
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
je 0x625cad30
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x625cac41
test al, 0x50
je 0x625caca0
mov eax, dword [ebx + 0x14]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 5
je 0x625cacd0
jbe 0x625cac80
mov ebx, 0x800a003a
cmp eax, 0x50
je 0x625cac75
cmp eax, 0xb7
jne 0x625cacd7
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x800a0035
cmp eax, 2
je 0x625cac75
cmp eax, 3
jne 0x625cacd7
lea esp, [ebp - 0xc]
mov ebx, 0x800a004c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ebx + 0xc]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], esi
mov dword [esp], 0x625d7940
call sym._init_classinfo
mov eax, dword [ebp - 0x24]
mov dword [eax], esi
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x800a0046
jmp 0x625cac75
mov ebx, 0x80004005
test byte [0x625d3028], 1
je 0x625cac75
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_error_code:__ld_n
mov dword [esp + 8], str.create_error
mov dword [esp + 4], 0x625d3028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cac75
mov dword [esp], ebx
mov ebx, 0x80004005
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x625cac75
mov esi, dword [sym.imp.ucrtbase.dll_free]
call esi
mov dword [esp], ebx
mov ebx, 0x80004005
call esi
jmp 0x625cac75
mov ebx, 0x8007000e
jmp 0x625cac75
mov dword [esp], ebx
mov ebx, 0x8007000e
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x625cac75
Function at 0x625cad70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2a8
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x284], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x288], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x290], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x27c], eax
test byte [0x625d3028], 8
jne 0x625caed0
mov eax, dword [ebp - 0x290]
test eax, eax
je 0x625cadca
mov dword [eax], 0
mov esi, dword [ebp - 0x284]
xor eax, eax
test esi, esi
je 0x625caebb
mov ebx, dword [ebp - 0x27c]
lea esi, [ebp - 0x268]
test ebx, ebx
je 0x625caf20
mov eax, dword [ebp - 0x27c]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
je 0x625caf50
mov dword [ebp - 0x28c], edi
xor ebx, ebx
lea esi, [esi]
test byte [ebp - 0x268], 0x10
jne 0x625cae86
mov eax, dword [ebp - 0x28c]
mov edx, esi
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x14]
call sym._get_full_path
lea edx, [ebp - 0x26c]
mov edi, eax
call sym._create_file
mov dword [esp], edi
mov dword [ebp - 0x280], eax
call dword [sym.imp.oleaut32.dll_SysFreeString]
mov ecx, dword [ebp - 0x280]
sub esp, 4
test ecx, ecx
js 0x625caf68
mov eax, ebx
mov edx, 9
inc ebx
shl eax, 4
add eax, dword [ebp - 0x288]
mov word [eax], dx
mov edx, dword [ebp - 0x26c]
mov dword [eax + 8], edx
cmp dword [ebp - 0x284], ebx
jbe 0x625caea4
mov eax, dword [ebp - 0x27c]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x625cae18
mov eax, dword [ebp - 0x290]
test eax, eax
je 0x625caeb0
mov dword [eax], ebx
xor eax, eax
cmp ebx, dword [ebp - 0x284]
setb al
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x290]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str._p___ld___p___p._n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x288]
mov dword [esp + 8], str.filecoll_enumvariant_Next
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x284]
mov dword [esp + 4], 0x625d3028
mov dword [esp + 0x14], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cadba
mov eax, dword [edi + 8]
mov ecx, 1
mov edx, esi
mov eax, dword [eax + 0x14]
call sym._start_enumeration
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x625caf50
mov eax, dword [ebp - 0x27c]
mov dword [edi + 0xc], eax
jmp 0x625cae0c
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x280]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
Function at 0x625cb010
Capabilities:
Contain obfuscated stackstrings
Move file

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x625d3028], 8
jne 0x625cb070
test ebx, ebx
je 0x625cb170
test esi, esi
je 0x625cb170
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_MoveFileW]
sub esp, 8
test eax, eax
je 0x625cb0c0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [ebp - 0x1c], eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_1
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str._p__s__s_n
mov dword [esp + 8], str.filesys_MoveFile
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cb035
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 5
je 0x625cb160
jbe 0x625cb130
mov ebx, 0x800a003a
cmp eax, 0x50
je 0x625cb05b
cmp eax, 0xb7
je 0x625cb05b
mov ebx, 0x80004005
test byte [0x625d3028], 1
je 0x625cb05b
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_error_code:__ld_n
mov dword [esp + 8], str.create_error
mov dword [esp + 4], 0x625d3028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cb05b
mov ebx, 0x800a0035
cmp eax, 2
je 0x625cb05b
cmp eax, 3
jne 0x625cb0ed
lea esp, [ebp - 0x10]
mov ebx, 0x800a004c
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 0x800a0046
jmp 0x625cb05b
mov ebx, 0x80070057
jmp 0x625cb05b
Function at 0x625cbf30
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x625d3028], 8
jne 0x625cbff0
lea eax, [ebp - 0x1c]
mov dword [esp], 2
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x625cbfd7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x625cc0f0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x625cc0d0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x625d6074
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._p___ld___s___lx___d___p___p___p___p._n
mov dword [esp + 8], str.drive_Invoke
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cbf73
movzx eax, ax
mov dword [esp], 0x625d6064
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
jmp 0x625cc072
mov eax, 0x625d5dde
jmp 0x625cc072
Function at 0x625cc100
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x625d3028], 8
jne 0x625cc1c0
lea eax, [ebp - 0x1c]
mov dword [esp], 4
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x625cc1a7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x625cc2c0
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x625cc2a0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x625d6074
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._p___ld___s___lx___d___p___p___p___p._n
mov dword [esp + 8], str.file_Invoke
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cc143
movzx eax, ax
mov dword [esp], 0x625d6064
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
jmp 0x625cc242
mov eax, 0x625d5dde
jmp 0x625cc242
Function at 0x625cc2d0
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x625d3028], 8
jne 0x625cc390
lea eax, [ebp - 0x1c]
mov dword [esp], 6
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x625cc377
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x625cc490
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x625cc470
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x625d6074
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._p___ld___s___lx___d___p___p___p___p._n
mov dword [esp + 8], str.filesys_Invoke
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cc313
movzx eax, ax
mov dword [esp], 0x625d6064
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
jmp 0x625cc412
mov eax, 0x625d5dde
jmp 0x625cc412
Function at 0x625cc4a0
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x30], eax
mov ebx, dword [ecx + 0x18]
mov dword [ebp - 0x38], esi
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0x1c]
test byte [0x625d3028], 8
jne 0x625cc560
lea eax, [ebp - 0x1c]
mov dword [esp], 9
mov dword [esp + 4], eax
call sym._get_typeinfo
mov edx, eax
test eax, eax
js 0x625cc547
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x24
movzx ecx, word [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x625cc660
mov ecx, eax
mov dword [ebp - 0x40], edx
shr ecx, 0x10
je 0x625cc640
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x625d6074
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._p___ld___s___lx___d___p___p___p___p._n
mov dword [esp + 8], str.textstream_Invoke
mov dword [esp + 4], 0x625d3028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x625cc4e3
movzx eax, ax
mov dword [esp], 0x625d6064
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x40]
jmp 0x625cc5e2
mov eax, 0x625d5dde
jmp 0x625cc5e2