joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a7c792a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6078], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7c79f0
mov dword [esp], 5
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7c79d6
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7c7af0
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7c7ad0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7d8958
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_policy_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6078
mov dword [esp + 0x10], eax
mov eax, 0x6a7d8a85
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6a7c7973
mov dword [esp], 0x6a7d8947
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_3
mov edx, dword [ebp - 0x3c]
jmp 0x6a7c7a6b
mov eax, 0x6a7d8940
jmp 0x6a7c7a6b
Function at 0x6a7cc9aa
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6090], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7cca70
mov dword [esp], 0xa
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7cca56
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7ccb70
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7ccb50
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7da0f8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.upnpnat_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6090
mov dword [esp + 0x10], eax
mov eax, 0x6a7da44c
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7cc9f3
mov dword [esp], 0x6a7da0e7
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
jmp 0x6a7ccaeb
mov eax, 0x6a7da0e0
jmp 0x6a7ccaeb
Function at 0x6a7ccb8a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6090], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7ccc50
mov dword [esp], 4
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7ccc36
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7ccd50
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7ccd30
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7da0f8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_ports_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6090
mov dword [esp + 0x10], eax
mov eax, 0x6a7da44c
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7ccbd3
mov dword [esp], 0x6a7da0e7
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
jmp 0x6a7ccccb
mov eax, 0x6a7da0e0
jmp 0x6a7ccccb
Function at 0x6a7ccd6a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6090], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7cce30
mov dword [esp], 3
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7cce16
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7ccf30
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7ccf10
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7da0f8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_port_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6090
mov dword [esp + 0x10], eax
mov eax, 0x6a7da44c
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7ccdb3
mov dword [esp], 0x6a7da0e7
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
jmp 0x6a7cceab
mov eax, 0x6a7da0e0
jmp 0x6a7cceab
Function at 0x6a7ccf4a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6090], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7cd010
mov dword [esp], 0xb
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7ccff6
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7cd110
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7cd0f0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7da0f8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.static_ports_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6090
mov dword [esp + 0x10], eax
mov eax, 0x6a7da44c
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7ccf93
mov dword [esp], 0x6a7da0e7
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
jmp 0x6a7cd08b
mov eax, 0x6a7da0e0
jmp 0x6a7cd08b
Function at 0x6a7cd12a
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d6090], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7cd1f0
mov dword [esp], 0xc
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7cd1d6
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7cd2f0
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7cd2d0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7da0f8
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.static_port_mapping_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d6090
mov dword [esp + 0x10], eax
mov eax, 0x6a7da44c
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6a7cd173
mov dword [esp], 0x6a7da0e7
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_4
mov edx, dword [ebp - 0x3c]
jmp 0x6a7cd26b
mov eax, 0x6a7da0e0
jmp 0x6a7cd26b
Function at 0x6a7d29ba
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ecx + 0x18]
test byte [0x6a7d60a0], 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], ebx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x38], esi
mov edi, dword [ecx + 0x20]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
movzx ebx, word [ecx + 0x10]
mov eax, dword [ecx + 8]
jne 0x6a7d2a80
mov dword [esp], 7
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
call sym._get_typeinfo
test eax, eax
mov edx, eax
js 0x6a7d2a66
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 0x1c], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edi
call dword [edx + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x20
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x24
test eax, eax
je 0x6a7d2b80
mov dword [ebp - 0x3c], edx
mov ecx, eax
shr ecx, 0x10
je 0x6a7d2b60
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [eax + 0xe]
mov dword [esp + 0x28], ecx
movzx ecx, byte [eax + 0xd]
mov dword [esp + 0x24], ecx
movzx ecx, byte [eax + 0xc]
mov dword [esp + 0x20], ecx
movzx ecx, byte [eax + 0xb]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x10], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0xc], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov dword [esp], 0x6a7dcbac
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], eax
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, str.fw_profile_Invoke
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x24], ecx
mov ecx, 0x6a7d60a0
mov dword [esp + 0x10], eax
mov eax, 0x6a7dcbf3
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x6a7d2a03
mov dword [esp], 0x6a7dcb9b
movzx eax, ax
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_5
mov edx, dword [ebp - 0x3c]
jmp 0x6a7d2afb
mov eax, 0x6a7dcb94
jmp 0x6a7d2afb
Function at 0x6a7d4730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x6a7d47a0
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x6a7d4798
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6a7df604], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x6a7d475d
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret