joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69060f70
Capabilities:
Get process heap flags

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x30], esi
mov esi, dword [eax + 0x64]
mov dword [esp + 0x38], ebp
mov ebp, eax
mov dword [esp + 0x10], edx
mov edx, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], edi
test esi, esi
je 0x69060fe0
mov eax, dword [eax + 0x68]
lea ecx, [edx + eax]
cmp ecx, esi
ja 0x6906104a
mov ebx, dword [ebp + 0x60]
add ebx, eax
mov eax, dword [esp + 0x40]
mov dword [eax], ebx
mov eax, dword [esp + 0x10]
mov dword [ebp + 0x68], ecx
mov dword [ebx + 4], edx
sub edx, 0xc
mov word [ebx + 2], 0
mov word [ebx], ax
xor eax, eax
mov dword [ebx + 8], edx
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov dword [esp + 0x14], ecx
lea esi, [ecx + ecx + 4]
mov eax, 0x100
cmp esi, 0x100
mov ecx, 8
mov dword [esp + 4], ecx
cmovb esi, eax
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp + 0x60], eax
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x14]
je 0x69061139
mov dword [eax], 0x2b464d45
mov eax, 4
mov dword [ebp + 0x64], esi
lea ecx, [edx + eax]
mov dword [ebp + 0x68], 4
cmp ecx, esi
jbe 0x69060fa0
mov dword [esp + 0x1c], edx
lea eax, [ecx + ecx]
mov edx, 8
mov dword [esp + 4], edx
mov edi, eax
mov dword [esp + 8], edi
mov dword [esp + 0x18], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x69061139
mov ecx, dword [ebp + 0x68]
mov edi, ebx
mov eax, dword [ebp + 0x60]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
cmp ecx, 8
mov esi, eax
jae 0x690610e8
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov ecx, dword fs:[0x18]
mov edi, dword [esp + 0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp + 0x64], edi
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x60], ebx
sub esp, 0xc
mov edx, dword [esp + 0x1c]
lea ecx, [edx + eax]
jmp 0x69060fa3
test bl, 1
jne 0x69061128
test edi, 2
jne 0x69061110
test edi, 4
je 0x6906109d
mov ecx, dword [esi]
add edi, 4
add esi, 4
mov dword [edi - 4], ecx
sub dword [esp + 0x14], 4
jmp 0x6906109d
movzx ecx, word [esi]
add edi, 2
add esi, 2
mov word [edi - 2], cx
sub dword [esp + 0x14], 2
jmp 0x690610f5
movzx ecx, byte [eax]
lea edi, [ebx + 1]
lea esi, [eax + 1]
mov byte [ebx], cl
dec dword [esp + 0x14]
jmp 0x690610ed
mov eax, 3
jmp 0x69060fc6
Function at 0x69062f60
Capabilities:
Get process heap flags

Disassembly:
push esi
push ebx
xor ebx, ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov eax, dword fs:[0x18]
mov edx, dword [esi + 0x60]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 0x58]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_CloseEnhMetaFile]
mov ebx, dword [sym.imp.gdi32.dll_DeleteEnhMetaFile]
sub esp, 4
mov dword [esp], eax
call ebx
mov eax, dword [esi + 0x54]
sub esp, 4
test eax, eax
je 0x69063031
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x69062fd0
test byte [0x6907a118], 4
jne 0x69063005
mov dword [eax + 0x14], 0
mov dword [eax + 0x5c], 1
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x69062fe2
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
xor ebx, ebx
lea esi, [esi]
lea esi, [esi]
nop
mov edx, ebx
mov eax, esi
call sym._metafile_free_object_table_entry
inc ebx
cmp ebx, 0x40
jne 0x69062ff0
add esp, 0x14
pop ebx
pop esi
ret
mov eax, str.metafile_closed_while_recording_n
mov edx, str.METAFILE_Free
mov dword [esp + 0xc], eax
mov ecx, 0x6907a118
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_9
mov eax, dword [esi + 0x5c]
jmp 0x69062fc2
mov eax, dword [esi + 0x50]
mov dword [esp], eax
call ebx
sub esp, 4
jmp 0x69062fb2
Function at 0x6906c520
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a128], 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
jne 0x6906c5c8
test ebx, ebx
je 0x6906c5fb
mov eax, dword [ebx + 8]
mov edi, dword fs:[0x18]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 4]
xor edx, edx
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor ecx, ecx
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0xc
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, 0x6907a128
mov esi, 0x69084faa
mov dword [esp + 0x10], ebx
mov edi, str.GdipDeletePathIter
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_10
test ebx, ebx
jne 0x6906c553
mov eax, 2
jmp 0x6906c5b0
Function at 0x6906d780
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a138], 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
jne 0x6906d850
test ebx, ebx
je 0x6906d883
mov eax, dword [ebx + 0x38]
mov edi, dword fs:[0x18]
mov dword [esp], eax
call sym.gdiplus.dll_GdipDeleteBrush
mov eax, dword [ebx + 0x18]
sub esp, 4
mov dword [esp], eax
call sym.gdiplus.dll_GdipDeleteCustomLineCap
mov eax, dword [ebx + 0x1c]
sub esp, 4
mov dword [esp], eax
call sym.gdiplus.dll_GdipDeleteCustomLineCap
mov eax, dword [ebx + 0x58]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 4
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x2c]
xor edx, edx
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor ecx, ecx
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0xc
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, 0x6907a138
mov esi, str.__p__n
mov dword [esp + 0x10], ebx
mov edi, str.GdipDeletePen
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_11
test ebx, ebx
jne 0x6906d7b3
mov eax, 2
jmp 0x6906d83a
Function at 0x6906ee60
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x48
test byte [0x6907a138], 8
mov dword [ebp - 0xc], ebx
mov edx, dword [ecx]
mov dword [ebp - 8], esi
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 4]
mov dword [ebp - 4], edi
jne 0x6906efa0
test edx, edx
sete cl
test esi, esi
sete al
or cl, al
jne 0x6906ef80
cmp ebx, 1
jle 0x6906ef80
test bl, 1
jne 0x6906ef80
movss xmm0, dword [esi]
pxor xmm1, xmm1
comiss xmm1, xmm0
ja 0x6906ef80
movss xmm2, dword [0x690856f8]
comiss xmm0, xmm2
ja 0x6906ef80
mov eax, 1
lea esi, [esi]
movss xmm0, dword [esi + eax*4]
movss xmm1, dword [esi + eax*4 - 4]
comiss xmm1, xmm0
ja 0x6906ef80
comiss xmm0, xmm2
ja 0x6906ef80
inc eax
cmp ebx, eax
jg 0x6906eee0
mov dword [ebp - 0x20], edx
lea eax, [ebx*4]
mov edx, 8
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x6906f02c
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 0x58]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x58], edi
sub esp, 0xc
cmp ecx, 8
jae 0x6906efe0
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [edx + 0x5c], ebx
jmp 0x6906ef85
mov eax, 2
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ecx, str.__p___p___i__n
mov eax, 0x6907a138
mov dword [esp + 0x10], edx
mov edi, str.GdipSetPenCompoundArray
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 3
mov dword [ebp - 0x1c], edx
call sym._wine_dbg_log.constprop.0_11
mov edx, dword [ebp - 0x1c]
jmp 0x6906ee91
test edi, 1
jne 0x6906f00f
test edi, 2
jne 0x6906f01a
test edi, 4
je 0x6906ef75
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6906ef75
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x6906efe8
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6906eff0
mov eax, 3
jmp 0x6906ef85
Function at 0x6906f2d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a138], 8
mov dword [ebp - 8], ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], ecx
jne 0x6906f3b8
test ebx, ebx
je 0x6906f3ef
cmp esi, 5
jne 0x6906f338
mov dword [ebx + 0x28], 5
mov eax, dword [ebx]
and eax, 0xfffffff0
mov edx, dword [esi*4 + 0x690852f0]
or eax, edx
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 8
mov edx, dword [ebx + 0x2c]
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x28], esi
and eax, 0xfffffff0
mov dword [ebx], eax
sub esp, 0xc
cmp esi, 5
jbe 0x6906f314
test byte [0x6907a138], 2
je 0x6906f31d
mov eax, str.Not_a_member_of_GpDashStyle_enumeration_n
mov edx, str.gdip_to_gdi_dash
mov dword [esp + 0xc], eax
mov ecx, 0x6907a138
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_11
mov eax, dword [ebx]
jmp 0x6906f31d
mov dword [esp + 0x14], esi
mov eax, str.__p___d__n
mov dword [esp + 0xc], eax
mov eax, str.GdipSetPenDashStyle
mov dword [esp + 8], eax
mov eax, 0x6907a138
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_11
test ebx, ebx
jne 0x6906f303
mov eax, 2
jmp 0x6906f321
Function at 0x6906f400
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
test byte [0x6907a138], 8
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
jne 0x6906f520
test edx, edx
je 0x6906f508
test esi, esi
je 0x6906f508
test edi, edi
lea esi, [esi]
nop
jle 0x6906f590
xor ebx, ebx
pxor xmm0, xmm0
lea esi, [esi]
comiss xmm0, dword [esi + ebx*4]
jae 0x6906f508
inc ebx
cmp edi, ebx
jne 0x6906f450
mov dword [ebp - 0x1c], edx
mov eax, dword [edx + 0x2c]
xor edx, edx
mov dword [esp + 4], edx
shl edi, 2
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x20], ecx
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x1c]
mov ecx, 8
mov dword [edx + 0x2c], 0
sub esp, 0xc
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esp + 8], edi
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x2c], eax
sub esp, 0xc
test eax, eax
je 0x6906f5a8
mov dword [esp], edx
mov eax, 5
mov dword [esp + 4], eax
mov dword [ebp - 0x1c], edx
call sym.gdiplus.dll_GdipSetPenDashStyle
mov edx, dword [ebp - 0x1c]
mov ecx, edi
mov edi, dword [edx + 0x2c]
sub esp, 8
cmp ecx, 8
jae 0x6906f560
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [edx + 0x30], ebx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, 2
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x10], edx
mov eax, str.GdipSetPenDashArray
mov ebx, str.__p___p___d__n
mov dword [esp + 8], eax
mov eax, 0x6907a138
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
mov dword [ebp - 0x1c], edx
call sym._wine_dbg_log.constprop.0_11
mov edx, dword [ebp - 0x1c]
jmp 0x6906f429
test edi, 1
jne 0x6906f5cb
test edi, 2
jne 0x6906f5b9
test edi, 4
je 0x6906f4ec
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6906f4ec
lea esp, [ebp - 0x10]
mov eax, 3
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [edx + 0x30], 0
mov eax, 3
jmp 0x6906f50d
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6906f570
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x6906f568
Function at 0x6906fbb0
Capabilities:
Get process heap flags

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x24
mov eax, dword [edx]
test eax, eax
je 0x6906fca0
mov edx, dword [ebx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x6906fc60
ja 0x6906fc00
cmp edx, 0x10000000
jne 0x6906fc18
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov edx, dword [ebx + 8]
mov dword [eax + 8], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x10], edx
add esp, 0x24
xor eax, eax
pop ebx
pop esi
ret
sub edx, 0x10000002
cmp edx, 1
ja 0x6906fc18
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax + 8], 0
mov eax, dword [esi]
lea edx, [eax + 4]
mov eax, dword [ebx + 4]
call sym._clone_element
test eax, eax
je 0x6906fc80
mov dword [esp + 0x1c], eax
mov edx, dword [esi]
mov dword [esp], edx
call sym._delete_element
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
add esp, 0x24
pop ebx
pop esi
ret
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
test eax, eax
jne 0x6906fc39
jmp 0x6906fc0b
mov eax, dword [esi]
lea edx, [eax + 8]
mov eax, dword [ebx + 8]
call sym._clone_element
test eax, eax
jne 0x6906fc39
jmp 0x6906fc0b
mov edx, 0x14
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
jne 0x6906fbc3
mov eax, 3
jmp 0x6906fc0d
Function at 0x69072a40
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
test byte [0x6907a148], 8
mov ebx, dword [ecx]
jne 0x69072ac0
test ebx, ebx
je 0x69072af3
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x69072b3a
test byte [0x6907a148], 8
jne 0x69072b08
mov dword [eax + 4], 0x10000003
mov dword [eax], 0
xor eax, eax
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov eax, 0x690858d9
mov dword [esp + 0xc], eax
mov eax, str.GdipCreateRegion
mov dword [esp + 8], eax
mov eax, 0x6907a148
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_12
test ebx, ebx
jne 0x69072a65
lea esp, [ebp - 8]
mov eax, 2
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], eax
mov edx, str.GdipCreateRegion
mov eax, str.___p_n
mov dword [esp + 0xc], eax
mov ecx, 0x6907a148
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_12
mov eax, dword [ebx]
jmp 0x69072aa2
mov eax, 3
jmp 0x69072ab1

Function at 0x69072b50
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a148], 8
mov dword [ebp - 8], ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], ecx
jne 0x69072bf0
test ebx, ebx
je 0x69072be0
test esi, esi
je 0x69072be0
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
movq xmm0, qword [ebx]
movhps xmm0, qword [ebx + 8]
mov dword [esi], eax
movlps qword [eax + 8], xmm0
movhps qword [eax + 0x10], xmm0
mov dword [eax + 4], 0x10000000
sub esp, 0xc
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, 2
jmp 0x69072bca
mov dword [esp], ebx
call sym._debugstr_rectf
mov dword [esp + 0x14], esi
mov dword [esp], 3
mov dword [esp + 0x10], eax
mov eax, str._s___p_n
mov dword [esp + 0xc], eax
mov eax, str.GdipCreateRegionRect
mov dword [esp + 8], eax
mov eax, 0x6907a148
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0_12
jmp 0x69072b77
Function at 0x69072cd0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
test byte [0x6907a148], 8
mov ebx, dword [ecx]
jne 0x69072d30
test ebx, ebx
je 0x69072d5f
lea eax, [ebx + 4]
mov dword [esp], eax
call sym._delete_element
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov eax, str.GdipDeleteRegion
mov ecx, 0x690858d9
mov dword [esp + 8], eax
mov eax, 0x6907a148
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_12
test ebx, ebx
jne 0x69072cf1
lea esp, [ebp - 8]
mov eax, 2
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4

Function at 0x69072d70
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a148], 8
mov dword [ebp - 8], ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], ecx
jne 0x69072e20
test ebx, ebx
je 0x69072e18
test esi, esi
je 0x69072e18
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x69072e67
mov dword [eax + 4], 0x10000001
add eax, 8
mov dword [eax - 8], 0
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
test eax, eax
mov ebx, eax
jne 0x69072e58
mov ecx, dword [ebp - 0xc]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 8
mov ebx, 2
jmp 0x69072dfd
mov dword [esp + 0x14], esi
mov eax, str._p___p_n
mov dword [esp + 0xc], eax
mov eax, str.GdipCreateRegionPath
mov dword [esp + 8], eax
mov eax, 0x6907a148
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_12
jmp 0x69072d9b
mov eax, dword [esi]
mov dword [esp], eax
call sym.gdiplus.dll_GdipDeleteRegion
sub esp, 4
jmp 0x69072dfd
mov ebx, 3
jmp 0x69072dfd
Function at 0x69077220
Capabilities:
Get process heap flags

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x30], esi
mov esi, edx
mov dword [esp], eax
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], edi
mov edi, ecx
mov dword [esp + 0x38], ebp
call sym.gdiplus.dll_GdipCloneRegion
sub esp, 8
test eax, eax
mov ebx, eax
je 0x69077270
mov eax, ebx
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov dword [esp + 4], esi
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.gdiplus.dll_GdipTransformRegion
sub esp, 8
test eax, eax
mov ebx, eax
je 0x690772a0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.gdiplus.dll_GdipDeleteRegion
sub esp, 4
jmp 0x69077250
lea eax, [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.gdiplus.dll_GdipGetRegionHRgn
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x69077289
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x69077340
mov dword [esp], eax
xor esi, esi
xor ebp, ebp
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov ebp, dword [sym.imp.gdi32.dll_GetRegionData]
call ebp
mov edx, 8
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [edi], eax
sub esp, 0xc
test eax, eax
je 0x690773c8
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
jmp 0x69077289
mov edx, 0x30
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [edi], eax
sub esp, 0xc
test eax, eax
je 0x690773d2
mov dword [eax], 0x20
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax + 0xc], 0x10
mov dword [eax + 0x14], 0xffc00000
mov dword [eax + 0x10], 0xffc00000
mov dword [eax + 0x1c], 0x400000
mov dword [eax + 0x18], 0x400000
mov dword [eax + 0x20], 0xffc00000
mov dword [eax + 0x24], 0xffc00000
mov dword [eax + 0x28], 0x400000
mov dword [eax + 0x2c], 0x400000
jmp 0x69077289
mov ebx, 3
jmp 0x6907732a
mov ebx, 3
jmp 0x69077289