joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d31c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x4d31d7
add esp, 0xfffffff0
call fcn.004036f0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040335c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x4d31fd
cmp dword [esi + 0x58], 0x40
jb 0x4d33e3
jmp 0x4d3203
jl 0x4d33e3
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.004079c8
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.004d2ac8
cmp word [ebx + 0xc], 0x5a4d
jne 0x4d33e3
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x4d33e3
cmp ecx, 0x10000
jge 0x4d33e3
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d325e
cmp eax, dword [esi + 0x58]
ja 0x4d33e3
jmp 0x4d3264
jg 0x4d33e3
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.004079c8
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.004d2ac8
cmp dword [ebx + 0x4c], 0x4550
jne 0x4d33e3
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.004d2ac8
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x4d331b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d32df
cmp eax, dword [esi + 0x58]
ja 0x4d336c
jmp 0x4d32e5
jg 0x4d336c
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.004d2ac8
mov byte [ebx + 4], 1
jmp 0x4d336c
cmp ax, 0x14c
jne 0x4d336c
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d333c
cmp eax, dword [esi + 0x58]
ja 0x4d336c
jmp 0x4d333e
jg 0x4d336c
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.004d2ac8
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x4d33e3
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d339d
cmp eax, dword [esi + 0x58]
ja 0x4d33e3
jmp 0x4d339f
jg 0x4d33e3
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x17f8550]
call fcn.0040599c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004d2ac8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d33fa
call fcn.00403748
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d40e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x17fa19f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4d4191
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4d417a
test esi, esi
jbe 0x4d4191
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a644
test eax, eax
jne 0x4d416c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4d4191
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4d4149
jmp 0x4d4191
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4d4191
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17fa1a6
ret
Function at 0x4d4bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x17fad6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404980
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4d4bfb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4d4c14
lea eax, [ebp - 0x10]
mov edx, dword [0x185ac48]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004049e0
jmp 0x4d4c27
lea eax, [ebp - 0x10]
mov edx, dword [0x185ac48]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.004049e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4d4c33
adc edx, 0
mov edx, dword [edx*4 + 0x18488ac]
call fcn.00404bec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404bd0
push eax
call fcn.00406b4c
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4d41
mov eax, 0x40
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4d4d34
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406fcc
mov eax, edi
call fcn.00402734
mov eax, 0x18
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4d4d34
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4d4d34
cmp dx, 0x150
ja 0x4d4d34
mov eax, edi
call fcn.00402734
mov eax, 0xe0
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4d4d34
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004049bc
mov eax, edi
call fcn.00402734
push esi
call fcn.00406b04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404cf8
jne 0x4d4d59
inc ebx
cmp ebx, 0x19
jne 0x4d4bed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17fad76
lea eax, [ebp - 0x10]
call fcn.00404980
ret
Function at 0x509568
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x1867594
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x50958a
shr eax, 1
xor eax, 0xedb88320
jmp 0x50958c
shr eax, 1
dec edx
jne 0x509578
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x509571
mov byte [0x1867994], 1
pop esi
pop ebx
ret

Function at 0x5095a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x1867994], 0
jne 0x5095bf
call fcn.00509568
mov eax, edi
dec eax
test eax, eax
jl 0x5095e8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x1867594]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5095c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40611c
pop dword [ebp - 0x2c]
mov eax, 0xda8d7702
sub eax, 0xda4d15e6
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x3d89e60a
add dword [ebp - 0x3c], 0x10c85f41
mov dword [ebp - 0x38], 0x12566dc7
add dword [ebp - 0x38], 0x1fdcde7e
mov dword [ebp - 0x34], 0x8c921d48
add dword [ebp - 0x34], 0xbfba26e6
mov dword [ebp - 0x30], 0xefeb87f2
sub dword [ebp - 0x30], 0xefeb87f2
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xb306c83f
add dword [ebp - 0x3c], 0xc16ba117
mov dword [ebp - 0x38], 0x9a800f17
add dword [ebp - 0x38], 0xa6ec525e
mov dword [ebp - 0x34], 0x8ae73a5a
add dword [ebp - 0x34], 0xd8883212
mov dword [ebp - 0x30], 0x76265916
sub dword [ebp - 0x30], 0x76265916
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x33817
push 0
call eax
mov ecx, 0x3ef88e6a
sub ecx, 0x3ef852d3
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x2c]
mov edx, 0xf7d4c0e9
sub edx, 0x159cfd9a
sub dword [ebp - 0x28], 0xf5ee9697
mov esi, dword [ebx]
sub dword [ebp - 0x24], 0x73507b7
add esi, edx
add dword [ebp - 0x1c], edx
mov dword [edi], esi
xor dword [ebp - 0x1c], 0x5c8d0623
add edi, 0xe1968c6f
sub edi, 0xe1968c6b
add ebx, 0x80ac63d7
sub ebx, 0x80ac63d3
loop 0x40622e
add eax, 0x5eceec37
sub eax, 0x5ece0b08
xor ebx, ebx
add ebx, eax
add eax, 0xb85a98c1
add eax, 0x47a56744
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x64187910
Capabilities:
Delete registry key

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
test byte [0x6419a04c], 8
jne 0x64187a10
test ebx, ebx
je 0x6418794d
cmp word [ebx], 0
jne 0x641879d0
test esi, esi
je 0x64187980
test byte [0x6419a04c], 1
jne 0x64187a80
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor esi, esi
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, edi
mov dword [ebp - 0x1c], edx
call sym._WINSPOOL_OpenDriverReg
mov edx, dword [ebp - 0x1c]
test eax, eax
mov ebx, eax
je 0x64187ab0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
sub esp, 8
test eax, eax
sete al
mov dword [esp], ebx
movzx eax, al
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
test byte [0x6419a04c], 1
je 0x6418795e
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str.pName___s___unsupported_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6418795e
mov eax, edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
call sym._wine_dbgstr_wn.constprop.0
mov dword [ebp - 0x20], eax
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0
mov dword [ebp - 0x1c], eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str._s__s__s__lx__lx_n
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x24]
jmp 0x6418793f
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.dwDeleteFlag___lx___unsupported_n
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6418795e
xor esi, esi
test byte [0x6419a04c], 2
je 0x6418796d
mov dword [esp + 0xc], str.Cant_open_drivers_key_n
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x6418796d
Function at 0x6418e4d0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov esi, dword [ecx + 4]
mov edx, dword [ecx]
mov edi, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 0x4c], esi
test byte [0x6419a04c], 8
jne 0x6418e630
test edx, edx
je 0x6418e618
lea esi, [ebp - 0x3c]
mov dword [esp + 4], edx
mov dword [esp], esi
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov edx, dword [ebp - 0x38]
sub esp, 8
test ebx, ebx
je 0x6418e531
mov eax, dword [ebx + 4]
mov dword [ebp - 0x2c], 8
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x28], eax
test edi, edi
je 0x6418e680
mov eax, dword [edi]
test eax, eax
je 0x6418e600
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x54]
sub esp, 8
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x6418e57e
mov dword [ebp - 0x54], edx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GdiConvertToDevmodeW]
mov edx, dword [ebp - 0x54]
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 8]
mov dword [esp], edx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
call sym.winspool.drv_OpenPrinter2W
mov edi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov ebx, eax
mov eax, dword [ebp - 0x50]
sub esp, 0x10
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x20]
sub esp, 4
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], esi
call edi
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x50], ecx
jmp 0x6418e562
mov dword [ebp - 0x38], 0
lea esi, [ebp - 0x3c]
jmp 0x6418e51d
mov eax, edx
mov dword [ebp - 0x50], edx
call sym._wine_dbgstr_an.constprop.0
mov ecx, dword [ebp - 0x4c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__p__p__p__n
mov dword [esp + 8], str.OpenPrinter2A
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x50]
jmp 0x6418e4ff
mov eax, dword [ebp - 0x4c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call sym.winspool.drv_OpenPrinter2W
mov edi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
sub esp, 0x10
mov ebx, eax
jmp 0x6418e5de
Function at 0x64190d70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov esi, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov ebx, dword [esi + 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0x14
test ebx, ebx
je 0x64190dd7
lea eax, [ebp - 0x34]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov ebx, dword [ebp - 0x30]
sub esp, 8
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x64190f68
mov eax, dword [esi + 8]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x64190e05
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov eax, dword [ebp - 0x30]
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], eax
test eax, eax
je 0x64190f78
mov edi, dword [esi + 0xc]
test edi, edi
je 0x64190e2d
lea eax, [ebp - 0x34]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov edi, dword [ebp - 0x30]
sub esp, 8
mov dword [ebp - 0x20], edi
test edi, edi
je 0x64190f60
mov eax, dword [esi + 0x10]
xor esi, esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym.winspool.drv_StartDocDlgW
sub esp, 8
test eax, eax
je 0x64190f32
mov dword [esp + 8], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x44], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x40], eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x48], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x40]
sub esp, 0xc
mov esi, eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 8], edx
mov dword [ebp - 0x40], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
sub esp, 0x20
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], edi
mov edi, dword [sym.imp.ucrtbase.dll_free]
call edi
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call edi
mov dword [esp], ebx
call edi
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
xor esi, esi
jmp 0x64190f32
mov dword [ebp - 0x3c], 0
xor esi, esi
xor edi, edi
jmp 0x64190f32
xor esi, esi
xor edi, edi
jmp 0x64190f32
Function at 0x641922d0
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
mov edx, ecx
sub esp, 0x4c
mov dword [ebp - 0x20], ecx
test ebx, ebx
je 0x641922f2
cmp ecx, 0x9b
ja 0x641923a0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Default_DevMode
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x2c]
sub esp, 0x18
test eax, eax
je 0x64192358
cmp eax, 0xea
je 0x64192358
mov dword [ebp - 0x20], 0
xor esi, esi
xor ebx, ebx
test byte [0x6419a04c], 8
jne 0x64192408
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x20]
cmp esi, 0x9b
jbe 0x6419233a
add esi, 0x40
test ebx, ebx
je 0x64192382
cmp word [ebx + 0x24], 0x9b
ja 0x6419237b
mov eax, 0x9c
mov word [ebx + 0x24], ax
mov dword [ebp - 0x20], esi
cmp edx, esi
jae 0x641923b0
mov eax, dword [ebp + 8]
mov ebx, 1
mov dword [eax], esi
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x27
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x641922f2
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_GdiConvertToDevmodeW]
mov esi, eax
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], ebx
mov ebx, 1
mov dword [esp + 8], eax
call sym._memcpy
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
sub esp, 0xc
mov dword [eax], esi
jmp 0x6419238c
mov eax, str.Default_DevMode
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.corrupted_registry_for__s___size__ld__n
mov dword [esp + 8], str.WINSPOOL_GetDevModeFromReg
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x64193810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x3c
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x64193880
cmp eax, 0xea
je 0x64193880
test byte [0x6419a04c], 4
jne 0x641938f0
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [eax], 0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
add eax, 2
mov dword [edi], eax
mov edi, 1
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x64193870
test byte [0x6419a04c], 8
je 0x64193870
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov ebx, eax
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s:__s_n
mov dword [esp + 8], str.WINSPOOL_GetStringFromReg
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Got_ret___ld_n
mov dword [esp + 8], str.WINSPOOL_GetStringFromReg
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x64193865
Function at 0x64197650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x641976ab
cmp byte [esi + ebx - 1], 0xa
je 0x6419767f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6419a31c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret