joyce8/EMBER2024-capa huggingface dataset:
Function at 0x680053c0
Capabilities:
Get graphical window text
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x6c
mov dword [ebp - 0x5c], edx
mov dword [esp + 4], 0x965
mov dword [esp], eax
call sym._GetDlgItem_8
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 8
mov dword [ebp - 0x60], eax
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
je 0x680054d0
mov ecx, dword [ebp - 0x5c]
mov ebx, eax
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 4], 0
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x680054d8
mov ecx, dword [ebp - 0x5c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov esi, dword [ebp - 0x60]
mov dword [ebx + 4], edi
mov dword [ebx], 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], esi
mov dword [ebp - 0x54], 0xd
mov dword [ebp - 0x48], 0x2000
mov dword [ebp - 0x44], 0xf000
call sym._SendMessageW_16
mov dword [ebp - 0x4c], 0
sub esp, 0x10
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1007
mov dword [esp], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], edi
call sym._SendMessageA_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x680054d0
Function at 0x680065e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x2c
mov ecx, dword [eax]
mov dword [ebp - 0x1c], eax
test ecx, ecx
jle 0x68006680
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
xor ebx, ebx
mov edi, dword fs:[0x18]
mov dword [ebp - 0x20], eax
lea esi, [esi]
mov edx, dword [esi]
lea eax, [ebx + ebx*2]
add ebx, 1
lea eax, [edx + eax*4]
mov eax, dword [eax + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov eax, dword [ebp - 0x1c]
sub esp, 0xc
cmp ebx, dword [eax]
jl 0x68006610
mov edx, dword [esi]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov eax, dword [ebp - 0x1c]
mov dword [esi], 0
sub esp, 0xc
mov dword [eax], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x20], eax
jmp 0x68006642

Function at 0x68006720
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
cmp dword [ecx + 4], 1
mov eax, dword [ecx + 8]
je 0x68006750
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, dword [eax + 0x1c]
lea edx, [ebx + 0xc]
lea eax, [ebx + 8]
call sym._free_detail_fields.isra.0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc

Function at 0x68006790
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x18
cmp dword [ecx + 4], 1
mov eax, dword [ecx]
je 0x680067c0
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._GetWindowLongW_8
sub esp, 8
mov ebx, eax
test eax, eax
je 0x680067ac
mov eax, dword [eax]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 4]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x680067ac
Function at 0x68006840
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov eax, dword [ecx]
cmp dword [ecx + 4], 1
mov dword [ebp - 0x60], eax
je 0x68006878
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 4], 0x965
lea edi, [ebp - 0x54]
xor ebx, ebx
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov esi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [ebp - 0x5c], eax
sub esp, 0x10
mov edx, dword fs:[0x18]
mov dword [ebp - 0x64], edx
test eax, eax
jle 0x68006918
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], esi
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
je 0x68006910
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x68006910
cmp dword [ecx], 0x1c
je 0x68006970
add ebx, 1
cmp dword [ebp - 0x5c], ebx
jne 0x680068d0
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], 8
mov dword [esp], eax
call sym._GetWindowLongW_8
sub esp, 8
mov ebx, eax
test eax, eax
je 0x6800685f
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._ImageList_Destroy_4
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6800685f
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x68006910
mov eax, dword [ecx + 4]
mov dword [esp + 4], 0
mov dword [ebp - 0x68], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x68006910

Function at 0x680069d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
cmp dword [ecx + 4], 1
mov eax, dword [ecx + 8]
je 0x68006a00
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, dword [eax + 0x1c]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._ImageList_Destroy_4
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
Function at 0x680070d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x6c
mov dword [ebp - 0x5c], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call sym._SendMessageW_16
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x54], 5
sub esp, 0x10
mov dword [ebp - 0x50], eax
mov edi, eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x54]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104d
mov dword [esp], esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x34], ebx
call sym._SendMessageW_16
mov eax, dword [ebp + 8]
sub esp, 0x10
test eax, eax
je 0x68007173
lea ecx, [ebp - 0x54]
mov dword [esp + 8], edi
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x1074
mov dword [esp], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x4c], 1
call sym._SendMessageW_16
sub esp, 0x10
mov eax, dword [ebx + 8]
test eax, eax
je 0x680071f8
lea eax, [eax + eax*2 + 3]
mov dword [esp + 4], 0
shl eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0xc]
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov dword [ebx + 0xc], eax
sub esp, 0x10
test eax, eax
je 0x680071e9
mov edx, dword [ebx + 8]
mov ecx, dword [ebp + 0xc]
lea edx, [edx + edx*2]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], 0
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax + 8], edx
add dword [ebx + 8], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
sub esp, 0xc
jmp 0x680071b0
Function at 0x68007230
Capabilities:
Get process heap flags

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x3c
mov dword [ebp - 0x20], eax
mov dword [esp + 8], 0
mov eax, dword [ecx]
mov dword [esp], 1
mov dword [esp + 4], eax
mov dword [ebp - 0x24], edx
call sym._CryptFindOIDInfo_12
xor edx, edx
sub esp, 0xc
mov esi, eax
mov eax, ebx
call sym._crypt_format_extension
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x680072d0
mov ecx, dword [esi + 8]
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], sym._field_format_detailed_extension
call sym._add_field_and_value_to_list
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 4], 0
mov dword [ebp - 0x2c], eax
add eax, 1
lea edi, [eax + eax]
mov dword [ebp - 0x28], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x68007414
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x28]
add eax, ecx
cmp esi, eax
setae al
add edi, esi
cmp ecx, edi
setae dl
or al, dl
je 0x680073f0
cmp dword [ebp - 0x2c], 0xe
jbe 0x680073f0
mov edi, dword [ebp - 0x28]
mov edx, ecx
mov eax, esi
pxor xmm3, xmm3
and edi, 0xfffffff0
add edi, ecx
lea esi, [esi]
movdqu xmm0, xmmword [edx]
movdqu xmm1, xmm3
add edx, 0x10
add eax, 0x20
pcmpgtb xmm1, xmm0
movdqu xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [eax - 0x20], xmm2
movups xmmword [eax - 0x10], xmm0
cmp edx, edi
jne 0x68007350
mov edi, dword [ebp - 0x28]
mov eax, edi
and eax, 0xfffffff0
and edi, 0xf
je 0x680073a0
mov edi, dword [ebp - 0x2c]
lea esi, [esi]
movsx dx, byte [ecx + eax]
mov word [esi + eax*2], dx
add eax, 1
cmp edi, eax
jae 0x68007390
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], ebx
mov ecx, esi
mov dword [esp + 4], sym._field_format_detailed_extension
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call sym._add_field_and_value_to_list
mov dword [esp + 8], esi
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
jmp 0x6800729e
mov edi, dword [ebp - 0x2c]
mov eax, esi
lea edi, [ecx + edi + 1]
lea esi, [esi]
movsx dx, byte [ecx]
add ecx, 1
add eax, 2
mov word [eax - 2], dx
cmp ecx, edi
jne 0x68007400
jmp 0x680073a0
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x6800729e
Function at 0x68007610
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov edx, 0x11
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
call sym._crypt_format_extension
mov ebx, eax
test eax, eax
je 0x68007640
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x6800762c
add eax, 7
mov dword [esp + 4], 0
shr eax, 3
imul eax, eax, 0x46
mov edx, dword fs:[0x18]
add eax, 2
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x38], eax
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6800762c
mov eax, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x680077a7
mov esi, esi
lea edi, [edi]
mov eax, dword [ebp - 0x28]
mov ecx, edi
mov dword [ebp - 0x2c], edi
add edi, 8
mov ebx, ecx
cmp edi, eax
cmovbe eax, edi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x680077f0
lea esi, [esi]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
movzx eax, byte [eax + ebx]
mov dword [esp], esi
add ebx, 1
add esi, 6
mov dword [esp + 8], 0x68017574
mov dword [esp + 0xc], eax
mov dword [esp + 4], 4
call sym._swprintf
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov eax, dword [eax + 8]
cmp eax, edi
cmovbe ecx, eax
cmp ebx, ecx
jb 0x680076c0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], eax
cmp ebx, eax
je 0x680077b8
mov ebx, 0x20
mov ecx, dword [ebp - 0x2c]
lea edx, [esi + 2]
mov word [esi], bx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
cmp ecx, ebx
jae 0x68007790
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], edi
mov eax, dword [eax + 0xc]
lea esi, [eax + ecx]
add eax, ebx
mov dword [ebp - 0x30], eax
mov esi, esi
lea edi, [edi]
movzx edi, byte [esi]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_iswprint]
mov ecx, eax
mov eax, 0x2e
test ecx, ecx
je 0x6800776a
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_iswspace]
test eax, eax
mov eax, 0x2e
cmove eax, edi
mov edx, dword [ebp - 0x24]
add esi, 1
mov word [edx], ax
add edx, 2
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x30], esi
jne 0x68007740
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
lea eax, [edx + eax*2]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0xa
mov word [eax], cx
lea esi, [eax + 2]
cmp edi, dword [ebp - 0x28]
jb 0x680076a0
xor edx, edx
mov ebx, dword [ebp - 0x38]
mov word [esi], dx
jmp 0x6800762c
test bl, 7
je 0x6800770b
mov edx, dword [0x6801756c]
movzx eax, word [0x68017570]
nop
add ebx, 1
mov dword [esi], edx
add esi, 6
mov word [esi - 2], ax
test bl, 7
jne 0x680077d0
jmp 0x6800770b
mov edx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], edx
je 0x68007810
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov eax, 0x20
mov word [esi], ax
jmp 0x68007790
test byte [ebp - 0x28], 7
je 0x680077f8
mov ebx, dword [ebp - 0x28]
jmp 0x680077c1
Function at 0x6800ab50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x68017980
sub esp, 0x1c
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], eax
lea esi, [esi]
mov ecx, ebx
mov edx, esi
mov eax, edi
add ebx, 0xc
call sym._add_v1_field
cmp ebx, 0x680179c8
jne 0x6800ab70
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x44]
test eax, eax
jne 0x6800aba0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov edx, esi
mov eax, edi
mov ecx, 0x680179c8
pop ebx
pop esi
pop edi
pop ebp
jmp sym._add_v1_field

Function at 0x6800abc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], esi
call sym._add_v1_fields
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._add_all_extensions
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp sym._add_properties

Function at 0x6800acd0
Capabilities:
Get process heap flags

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
pop ebp
jmp sym._get_cert_name_string.constprop.0
Function at 0x6800be30
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov eax, dword [ecx + 8]
test byte [0x68015140], 8
jne 0x6800be70
cmp ebx, 1
je 0x6800bea5
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p___08x___08Ix__n
mov dword [esp + 8], str.cert_prop_sheet_proc
mov dword [esp + 4], 0x68015140
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp ebx, 1
jne 0x6800be5a
mov dword [esp], esi
lea ebx, [ebp - 0x28]
mov dword [esp + 4], 2
call sym._GetDlgItem_8
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._GetWindowRect_8
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp + 0xc], 2
mov dword [esp], 0
call sym._MapWindowPoints_16
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], 2
call sym._GetDlgItem_8
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._ShowWindow_8
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 1
call sym._GetDlgItem_8
sub esp, 8
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 0x18], 0x1d
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._SetWindowPos_28
xor eax, eax
sub esp, 0x1c
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
Function at 0x6800ca90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edx, [ebp - 0x158]
lea edi, [ebp - 0x168]
push ebx
mov ebx, eax
sub esp, 0x17c
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0x50
mov dword [esp + 4], 0x1f
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov dword [esp], esi
lea esi, [ebp - 0xb8]
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
lea edx, [ebp - 0x158]
sub esp, 8
mov dword [esp + 0x14], 0x50
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetDateFormatW]
sub esp, 0x18
cmp word [ebp - 0xb8], 0
je 0x6800cb50
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x6800cb28
sub ecx, esi
sar ecx, 1
mov edx, esi
mov eax, ebx
call sym._add_unformatted_text_to_control
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x6800cb35
Function at 0x6800da50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x130]
push ebx
sub esp, 0x14c
mov dword [ebp - 0x13c], edx
mov edx, 0xa
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
mov dword [ebp - 0x140], ecx
mov word [ebp - 0x132], dx
call sym._GetDlgItem_8
lea edx, [ebp - 0x124]
mov ecx, 0x14
mov dword [ebp - 0x130], 0x5c
mov ebx, eax
mov edi, edx
xor eax, eax
sub esp, 8
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], esi
lea edi, [ebp - 0xd4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x444
mov dword [esp], ebx
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x128], 1
call sym._SendMessageW_16
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, ebx
mov dword [ebp - 0xd4], 0xbc
sub esp, 0x10
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xc8], 0x258
call sym._add_string_resource_with_paraformat_to_control
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x444
mov dword [esp], ebx
mov dword [ebp - 0x128], 0
call sym._SendMessageW_16
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x13c]
sub esp, 0x10
call sym._get_cert_name_string.constprop.0
test eax, eax
je 0x6800db92
cmp word [eax], 0
mov esi, eax
je 0x6800dbd0
mov ecx, eax
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x6800db58
sub ecx, esi
sar ecx, 1
mov edx, esi
mov eax, ebx
call sym._add_unformatted_text_to_control
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea edx, [ebp - 0x132]
mov eax, ebx
mov ecx, 1
call sym._add_unformatted_text_to_control
lea edx, [ebp - 0x132]
mov eax, ebx
mov ecx, 1
call sym._add_unformatted_text_to_control
lea edx, [ebp - 0x132]
mov eax, ebx
mov ecx, 1
call sym._add_unformatted_text_to_control
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x6800db65
Function at 0x6800f2b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x88
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov dword [ebp - 0x6c], eax
test byte [0x68015140], 8
jne 0x6800f400
lea edx, [ebp - 0x60]
mov ecx, 0x12
mov esi, ebx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x6800f395
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
mov dword [ebp - 0x70], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
mov edi, eax
sub esp, 0x18
lea esi, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6800f464
mov dword [esp + 0x14], edi
mov ecx, dword [ebp - 0x70]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0
call ecx
mov dword [ebp - 0x54], esi
lea edx, [ebp - 0x60]
sub esp, 0x18
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x6800f3b0
test byte [0x68015140], 1
jne 0x6800f438
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.cryptui.dll_CryptUIDlgViewCertificateW
sub esp, 8
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 8], str.CryptUIDlgViewCertificateA
mov dword [esp + 4], 0x68015140
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6800f2dc
mov dword [esp + 0xc], str.ignoring_additional_prop_sheet_pages_n
mov dword [esp + 8], str.CryptUIDlgViewCertificateA
mov dword [esp + 4], 0x68015140
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
lea edx, [ebp - 0x60]
jmp 0x6800f3a9
xor ebx, ebx
jmp 0x6800f3e8