joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6903a640
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x7c
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x68]
mov dword [esp + 4], eax
lea eax, [esp + 0x64]
mov dword [esp], eax
lea ecx, [esp + 0x60]
mov eax, esi
lea edx, [esp + 0x5c]
call sym._get_gif_frame_rect
mov dword [esp + 0x34], eax
test eax, eax
js 0x6903a7ff
mov dword [esp + 4], esi
lea eax, [esp + 0x6c]
mov dword [esp + 8], eax
mov dword [esp], 0x69083894
call sym._WICConvertBitmapSource_12
sub esp, 0xc
test eax, eax
mov dword [esp + 0x34], eax
js 0x6903a7ff
mov eax, dword [esp + 0x64]
mov ecx, 8
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x68]
mov esi, dword fs:[0x18]
imul eax, edx
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov dword [esp + 0x4c], eax
mov ebp, eax
je 0x6903a82d
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
imul edx, eax
mov edi, dword [ecx]
shl eax, 2
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], ecx
mov dword [esp + 0x10], ebp
shl edx, 2
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call dword [edi + 0x1c]
sub esp, 0x14
mov edi, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x6c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test edi, edi
js 0x6903a80b
mov eax, dword [esp + 0x68]
test eax, eax
je 0x6903a7d9
mov esi, dword [ebx + 0x3c]
mov ecx, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x40], ecx
lea edx, [ecx*4]
mov dword [esp + 0x3c], edx
add eax, edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], esi
mov edx, esi
add esi, ecx
mov dword [esp + 0x30], esi
neg edx
lea ebp, [ebp + edx*4]
lea esi, [esi]
nop
cmp dword [esp + 0x38], edi
jbe 0x6903a7d9
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x6903a7cc
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
jmp 0x6903a7c6
mov edx, dword [ebx + 0x58]
mov ecx, dword [ebx + 0x54]
imul edx, edi
lea edx, [edx + eax*4]
add edx, ecx
mov ecx, dword [ebp + eax*4]
mov esi, ecx
shr esi, 0x18
or esi, dword [esp + 0x2c]
je 0x6903a7bf
mov dword [edx], ecx
inc eax
cmp dword [esp + 0x30], eax
je 0x6903a7cc
cmp dword [esp + 0x28], eax
ja 0x6903a7a0
mov esi, dword [esp + 0x3c]
inc edi
add ebp, esi
cmp edi, dword [esp + 0x44]
jne 0x6903a780
mov edi, dword [esp + 0x4c]
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esp + 0x34]
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6903a7ff
mov dword [esp + 0x34], 0x8007000e
jmp 0x6903a7ff
Function at 0x69057790
Capabilities:
Get process heap flags

Disassembly:
sub esp, 0x2c
test eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
je 0x69057900
mov ebx, eax
mov eax, dword [eax + 8]
cmp eax, 1
je 0x69057830
cmp eax, 2
je 0x690577e0
test byte [0x6907a0e8], 4
mov esi, 4
jne 0x690578d0
mov eax, esi
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov dword [esp], ebx
call sym._METAFILE_Free
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx]
test eax, eax
je 0x690577ff
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp], ebx
call sym._terminate_encoder_wic
mov edx, dword [ebx + 0x28]
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor esi, esi
sub esp, 0xc
jmp 0x690577c8
mov eax, dword [ebx + 0x48]
xor ecx, ecx
mov dword [esp + 4], ecx
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x5c]
sub esp, 0xc
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x50]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
mov eax, dword [ebx + 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
mov eax, dword [ebx + 0x68]
sub esp, 4
test eax, eax
je 0x690578a3
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov edx, dword [ebx + 0x70]
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x690577ee
mov dword [esp + 0x10], ebx
mov ecx, str.invalid_image:__p_n
mov ebx, str.free_image_data
mov dword [esp + 0xc], ecx
mov edi, 0x6907a0e8
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_6
jmp 0x690577c8
mov esi, 2
jmp 0x690577c8
Function at 0x69057910
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a0e8], 8
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
jne 0x69057980
mov eax, esi
call sym._free_image_data
test eax, eax
mov ebx, eax
jne 0x6905796a
mov dword [esi + 8], 0xffffffff
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov ecx, dword [ebp - 0xc]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov ecx, 0x69081013
mov ebx, str.GdipDisposeImage
mov dword [esp + 0x10], esi
mov eax, 0x6907a0e8
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
jmp 0x69057934
Function at 0x69058c10
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a0e8], 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx]
mov dword [ebp - 8], esi
mov esi, dword [ecx + 4]
mov dword [ebp - 4], edi
mov edi, dword [ecx + 8]
mov dword [ebp - 0x10], ecx
jne 0x69058cc0
test esi, esi
sete dl
test edi, edi
sete al
or dl, al
jne 0x69058cb8
test ebx, ebx
je 0x69058cb8
mov edx, 4
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [edi], eax
sub esp, 0xc
test eax, eax
je 0x69058d23
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.gdiplus.dll_GdipCloneImage
sub esp, 8
test eax, eax
mov ebx, eax
jne 0x69058d00
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 2
jmp 0x69058c9d
mov dword [esp + 0x18], edi
mov eax, str._p__p__p_n
mov dword [esp + 0xc], eax
mov eax, str.GdipCreateCachedBitmap
mov dword [esp + 8], eax
mov eax, 0x6907a0e8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
jmp 0x69058c41
mov eax, dword [edi]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x69058c9d
mov ebx, 3
jmp 0x69058c9d
Function at 0x69059630
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
test byte [0x6907a0e8], 8
mov ebx, dword [ecx]
jne 0x69059690
test ebx, ebx
je 0x690596bf
mov eax, dword [ebx]
mov dword [esp], eax
call sym.gdiplus.dll_GdipDisposeImage
xor edx, edx
mov eax, dword fs:[0x18]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov eax, str.GdipDeleteCachedBitmap
mov ecx, 0x69081013
mov dword [esp + 8], eax
mov eax, 0x6907a0e8
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
test ebx, ebx
jne 0x69059651
lea esp, [ebp - 8]
mov eax, 2
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x6905a280
Capabilities:
Get process heap flags

Disassembly:
push ebx
mov edx, 0x69082fb4
sub esp, 0x28
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x18]
call sym._initialize_decoder_wic
test eax, eax
mov ebx, eax
jne 0x6905a2f7
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
test eax, eax
js 0x6905a300
mov dword [esp], sym._gif_metadata_reader
mov eax, dword [esp + 0x34]
xor edx, edx
cmp dword [esp + 0x1c], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
seta dl
xor ecx, ecx
call sym._decode_frame_wic
mov ebx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test ebx, ebx
jne 0x6905a2f7
cmp dword [esp + 0x1c], 1
ja 0x6905a318
add esp, 0x28
mov eax, ebx
pop ebx
ret
mov dword [esp], eax
call sym._hresult_to_status
add esp, 0x28
mov ebx, eax
mov eax, ebx
pop ebx
ret
mov ecx, dword [esp + 0x34]
mov eax, dword fs:[0x18]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [eax + 0x28], 0
add esp, 0x28
mov eax, ebx
pop ebx
ret
Function at 0x6905afb0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x48
test byte [0x6907a0e8], 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ecx]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
jne 0x6905b0d0
test esi, esi
je 0x6905b0c0
test ebx, ebx
je 0x6905b0c0
mov eax, dword [ebx + 4]
cmp eax, 0x100
ja 0x6905b0c0
lea eax, [eax*4 + 8]
mov edx, 8
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
sub esp, 0xc
test eax, eax
je 0x6905b135
mov eax, dword [esi + 0x28]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [esi + 0x28], edx
lea edi, [edx + 8]
mov dword [edx + 4], ecx
shl ecx, 2
mov dword [edx], eax
lea esi, [ebx + 8]
sub esp, 0xc
cmp ecx, 8
jae 0x6905b090
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 8
test edi, 1
jne 0x6905b108
test edi, 2
jne 0x6905b120
test edi, 4
je 0x6905b071
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6905b071
mov eax, 2
jmp 0x6905b075
mov ecx, 0x69080bf6
mov edi, str.GdipSetImagePalette
mov dword [esp + 0x14], ebx
mov eax, 0x6907a0e8
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
jmp 0x6905afde
movzx eax, byte [ebx + 8]
lea edi, [edx + 9]
dec ecx
lea esi, [ebx + 9]
mov byte [edx + 8], al
jmp 0x6905b098
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6905b0a4
mov eax, 3
jmp 0x6905b075
Function at 0x6905dd90
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test ebx, ebx
je 0x6905de40
mov edx, 0x4d0
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x6905de53
mov dword [eax], 4
xor ebx, ebx
test byte [0x6907a0f8], 8
jne 0x6905de00
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], eax
mov ecx, 0x6907a0f8
mov eax, 0x69083af7
mov dword [esp + 4], ecx
mov edx, str.GdipCreateImageAttributes
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_7
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
lea esp, [ebp - 8]
mov ebx, 2
pop ecx
mov eax, ebx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov ebx, 3
jmp 0x6905dded
Function at 0x6905e920
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ecx + 8]
test byte [0x6907a0f8], 8
mov dword [ebp - 0xc], ebx
mov edx, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x10]
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], eax
jne 0x6905ea50
test edx, edx
je 0x6905ea48
cmp ebx, 4
ja 0x6905ea48
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x6905eaa0
mov dword [ebp - 0x24], edx
test esi, esi
je 0x6905ea48
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6905ea48
lea edi, [eax*8]
mov edx, 8
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x28], eax
sub esp, 0xc
test eax, eax
je 0x6905eb3b
mov ecx, edi
mov edx, dword [ebp - 0x24]
mov edi, eax
cmp ecx, 8
jae 0x6905eae8
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + ebx*2]
xor edi, edi
mov dword [ebp - 0x24], edx
lea esi, [edx + ecx*4]
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0x460]
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [esi + 0x45c], eax
mov eax, dword [ebp - 0x28]
sub esp, 0xc
mov dword [esi + 0x460], eax
mov edi, dword [ebp - 0x1c]
lea eax, [ebx + ebx*2]
mov dword [edx + eax*4 + 0x458], edi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, 2
jmp 0x6905ea2d
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edi, str.__p__u__i__u__p__n
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov eax, str.GdipSetImageAttributesRemapTable
mov dword [esp + 8], eax
mov eax, 0x6907a0f8
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], 3
mov dword [ebp - 0x24], edx
call sym._wine_dbg_log.constprop.0_7
mov edx, dword [ebp - 0x24]
jmp 0x6905e95d
mov dword [ebp - 0x20], edx
lea ecx, [ebx + ebx*2]
lea esi, [edx + ecx*4]
xor edx, edx
mov ecx, dword [esi + 0x460]
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov dword [esi + 0x460], ecx
sub esp, 0xc
jmp 0x6905ea1e
test al, 1
jne 0x6905eb30
test edi, 2
jne 0x6905eb18
test edi, 4
je 0x6905e9d6
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6905e9d6
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6905eaf4
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x6905eaec
mov eax, 3
jmp 0x6905ea2d
Function at 0x6905ef40
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x70
movss xmm1, dword [ecx]
movss xmm2, dword [ecx + 4]
movss xmm3, dword [ecx + 8]
movss xmm4, dword [ecx + 0xc]
movss xmm5, dword [ecx + 0x10]
movss xmm6, dword [ecx + 0x14]
test byte [0x6907a108], 8
movss dword [ebp - 0xc], xmm1
mov ebx, dword [ecx + 0x18]
movss dword [ebp - 0x10], xmm2
movss dword [ebp - 0x14], xmm3
movss dword [ebp - 0x18], xmm4
movss dword [ebp - 0x1c], xmm5
movss dword [ebp - 0x20], xmm6
jne 0x6905f028
test ebx, ebx
je 0x6905f0af
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x6905f0c0
movss xmm7, dword [ebp - 0xc]
movss xmm1, dword [ebp - 0x14]
movss xmm2, dword [ebp - 0x18]
movss dword [eax], xmm7
movss xmm3, dword [ebp - 0x1c]
movss xmm7, dword [ebp - 0x10]
movss xmm4, dword [ebp - 0x20]
movss dword [eax + 8], xmm1
movss dword [eax + 4], xmm7
movss dword [eax + 0xc], xmm2
movss dword [eax + 0x10], xmm3
movss dword [eax + 0x14], xmm4
xor eax, eax
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov dword [esp + 0x40], ebx
mov eax, str.__.2f___.2f___.2f___.2f___.2f___.2f___p__n
pxor xmm0, xmm0
mov dword [esp + 0xc], eax
mov eax, str.GdipCreateMatrix2
cvtss2sd xmm0, xmm6
mov dword [esp + 8], eax
mov eax, 0x6907a108
movsd qword [esp + 0x38], xmm0
mov dword [esp + 4], eax
pxor xmm0, xmm0
cvtss2sd xmm0, xmm5
mov dword [esp], 3
movsd qword [esp + 0x30], xmm0
pxor xmm0, xmm0
cvtss2sd xmm0, xmm4
movsd qword [esp + 0x28], xmm0
pxor xmm0, xmm0
cvtss2sd xmm0, xmm3
movsd qword [esp + 0x20], xmm0
pxor xmm0, xmm0
cvtss2sd xmm0, xmm2
movsd qword [esp + 0x18], xmm0
pxor xmm0, xmm0
cvtss2sd xmm0, xmm1
movsd qword [esp + 0x10], xmm0
call sym._wine_dbg_log.constprop.0_8
test ebx, ebx
jne 0x6905efa5
lea esp, [ebp - 8]
mov eax, 2
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov eax, 3
jmp 0x6905f016
Function at 0x6905f2e0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a108], 8
mov dword [ebp - 8], ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], ecx
jne 0x6905f370
test ebx, ebx
je 0x6905f368
test esi, esi
je 0x6905f368
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x6905f3a4
xor edx, edx
mov ecx, dword [ebx + edx]
mov dword [eax + edx], ecx
add edx, 4
cmp edx, 0x18
jb 0x6905f341
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, 2
jmp 0x6905f351
mov dword [esp + 0x14], esi
mov eax, 0x69083ec6
mov dword [esp + 0xc], eax
mov eax, str.GdipCloneMatrix
mov dword [esp + 8], eax
mov eax, 0x6907a108
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_8
jmp 0x6905f307
mov eax, 3
jmp 0x6905f351

Function at 0x6905f3b0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
test byte [0x6907a108], 8
mov ebx, dword [ecx]
jne 0x6905f440
test ebx, ebx
je 0x6905f473
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x6905f484
movss xmm0, dword [0x69084144]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
movss dword [eax], xmm0
movss dword [eax + 0xc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
xor eax, eax
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov eax, 0x69083ed0
mov dword [esp + 0xc], eax
mov eax, str.GdipCreateMatrix
mov dword [esp + 8], eax
mov eax, 0x6907a108
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_8
test ebx, ebx
jne 0x6905f3d5
lea esp, [ebp - 8]
mov eax, 2
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, 3
jmp 0x6905f434
Function at 0x6905f490
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x6907a108], 8
mov dword [ebp - 4], ebx
mov ebx, dword [ecx]
mov dword [ebp - 8], ecx
jne 0x6905f4f0
test ebx, ebx
je 0x6905f51f
mov dword [esp + 8], ebx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 8]
xor eax, eax
mov ebx, dword [ebp - 4]
sub esp, 0xc
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov eax, str.GdipDeleteMatrix
mov ecx, 0x69083ed0
mov dword [esp + 8], eax
mov eax, 0x6907a108
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_8
test ebx, ebx
jne 0x6905f4b5
mov ecx, dword [ebp - 8]
mov eax, 2
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4