joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64a71810
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, edx
sub esp, 0x20
fld dword [ebp + 8]
fld dword [ebp + 0xc]
fld dword [ebp + 0x14]
mov esi, dword [edx]
fsub st(1)
fld dword [ebp + 0x10]
fsub st(3)
fld st(1)
fmul st(2)
fld st(1)
fmul st(2)
faddp st(1)
fsqrt
fld dword [0x64abb52c]
fmul dword [ebp + 0x18]
fldz
fxch st(2)
fucomi st(2)
fstp st(2)
jp 0x64a71851
je 0x64a718d0
fld st(0)
fchs
test eax, eax
jne 0x64a718c0
fxch st(4)
fmulp st(1)
fdiv st(1)
fxch st(3)
fmulp st(2)
fdivp st(1)
faddp st(2)
fxch st(1)
mov eax, dword fs:[0x18]
fstp dword [ebp - 0xc]
faddp st(1)
fstp dword [ebp - 0x10]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x64a718b5
fld dword [ebp - 0x10]
fstp dword [eax]
fld dword [ebp - 0xc]
mov byte [eax + 8], 1
fstp dword [eax + 4]
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov dword [esi + 0xc], eax
mov dword [ebx], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
fmulp st(4)
fxch st(3)
fdiv st(1)
fxch st(3)
fmulp st(2)
fdivp st(1)
jmp 0x64a71865
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x64a718b5
fld dword [ebp + 8]
fstp dword [eax]
fld dword [ebp + 0xc]
mov byte [eax + 8], 1
fstp dword [eax + 4]
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov dword [esi + 0xc], eax
mov dword [ebx], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x64a731f0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
fld dword [ecx + 4]
mov esi, dword [ecx]
fst dword [ebp - 0x1c]
fld dword [ecx + 8]
fst dword [ebp - 0x20]
fld dword [ecx + 0xc]
fst dword [ebp - 0x24]
fld dword [ecx + 0x10]
fst dword [ebp - 0x28]
fld dword [ecx + 0x14]
fstp dword [ebp - 0x2c]
fld dword [ecx + 0x18]
fst dword [ebp - 0x30]
test byte [0x64ab50c0], 8
jne 0x64a73360
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
test esi, esi
je 0x64a733ab
fld dword [ebp - 0x30]
fstp dword [esp + 0x18]
fld dword [ebp - 0x2c]
fstp dword [esp + 0x14]
fld dword [ebp - 0x28]
fstp dword [esp + 0x10]
fld dword [ebp - 0x24]
fstp dword [esp + 0xc]
fld dword [ebp - 0x20]
fstp dword [esp + 8]
fld dword [ebp - 0x1c]
mov dword [esp], 0
fstp dword [esp + 4]
call sym._arc2polybezier
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x64a732a0
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
lea eax, [eax*8]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x64a733c0
fld dword [ebp - 0x30]
fstp dword [esp + 0x18]
fld dword [ebp - 0x2c]
fstp dword [esp + 0x14]
fld dword [ebp - 0x28]
fstp dword [esp + 0x10]
fld dword [ebp - 0x24]
fstp dword [esp + 0xc]
fld dword [ebp - 0x20]
fstp dword [esp + 8]
fld dword [ebp - 0x1c]
mov dword [esp], eax
fstp dword [esp + 4]
mov dword [ebp - 0x1c], eax
call sym._arc2polybezier
mov dword [esp], 3
mov ecx, ebx
mov eax, esi
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
call sym._extend_current_figure
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
fstp qword [esp + 0x3c]
fld dword [ebp - 0x2c]
mov dword [esp + 0x10], esi
fstp qword [esp + 0x34]
mov dword [esp + 0xc], 0x64abacc4
fstp qword [esp + 0x2c]
mov dword [esp + 8], str.GdipAddPathArc
fstp qword [esp + 0x24]
mov dword [esp + 4], 0x64ab50c0
fstp qword [esp + 0x1c]
mov dword [esp], 3
fstp qword [esp + 0x14]
call sym._wine_dbg_log.constprop.0_5
test esi, esi
jne 0x64a73249
lea esp, [ebp - 0x10]
mov ecx, 2
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov ecx, 3
jmp 0x64a73287
Function at 0x64a73d80
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
test byte [0x64ab50c0], 8
jne 0x64a73eb0
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x64a73ef1
lea eax, [ebx - 1]
mov ecx, 2
imul eax, eax, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
ja 0x64a73e9a
lea eax, [ebx*8]
mov edi, eax
mov dword [ebp - 0x20], edi
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x64a73f58
test ebx, ebx
jle 0x64a73e46
mov edx, dword [ebp - 0x1c]
lea ecx, [edi + 4]
lea eax, [edx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
lea edx, [edx + eax + 4]
mov eax, dword [ebp - 0x1c]
lea esi, [esi]
lea esi, [esi]
fild dword [eax - 4]
add eax, 8
add ecx, 8
fstp dword [ecx - 0xc]
fild dword [eax - 8]
fstp dword [ecx - 8]
cmp eax, edx
jne 0x64a73e30
test byte [0x64ab50c0], 8
jne 0x64a73f10
mov ecx, 2
test esi, esi
je 0x64a73e70
mov dword [esp], 3
mov ecx, ebx
mov edx, edi
mov eax, esi
call sym._extend_current_figure
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipAddPathBeziersI
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x1c]
test edx, edx
mov dword [ebp - 0x1c], edx
jne 0x64a73db4
lea esp, [ebp - 0x10]
mov ecx, 2
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipAddPathBeziers
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov ecx, 2
test esi, esi
jne 0x64a73e5c
jmp 0x64a73e70
mov ecx, 3
jmp 0x64a73e9a
Function at 0x64a74360
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
fld dword [ecx + 0xc]
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x64ab50c0], 8
jne 0x64a74470
test esi, esi
fstp dword [ebp - 0x1c]
sete al
cmp edi, 1
setle cl
or al, cl
jne 0x64a74458
test edx, edx
mov dword [ebp - 0x20], edx
je 0x64a74458
lea ecx, [edi*8]
mov dword [esp + 4], 8
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x64a744b8
fld dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
lea esi, [esi]
fild dword [esi + eax*8]
fstp dword [ebx + eax*8]
fild dword [esi + eax*8 + 4]
fstp dword [ebx + eax*8 + 4]
add eax, 1
cmp edi, eax
jg 0x64a743f0
mov dword [esp], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
fstp dword [esp + 0xc]
call sym.gdiplus.dll_GdipAddPathClosedCurve2
sub esp, 0x10
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea esp, [ebp - 0x10]
mov esi, 2
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
fst qword [esp + 0x1c]
fstp dword [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [ebp - 0x1c], edx
mov dword [esp + 0xc], str.__p___p___d___.2f__n
mov dword [esp + 8], str.GdipAddPathClosedCurve2I
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x1c]
fld dword [ebp - 0x20]
jmp 0x64a7438c
mov esi, 3
jmp 0x64a74442
Function at 0x64a748c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
fld dword [ecx + 0xc]
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x64ab50c0], 8
jne 0x64a749d0
test esi, esi
fstp dword [ebp - 0x1c]
sete al
cmp edi, 1
setle cl
or al, cl
jne 0x64a749b8
test edx, edx
mov dword [ebp - 0x20], edx
je 0x64a749b8
lea ecx, [edi*8]
mov dword [esp + 4], 8
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x64a74a18
fld dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
lea esi, [esi]
fild dword [esi + eax*8]
fstp dword [ebx + eax*8]
fild dword [esi + eax*8 + 4]
fstp dword [ebx + eax*8 + 4]
add eax, 1
cmp edi, eax
jg 0x64a74950
mov dword [esp], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
fstp dword [esp + 0xc]
call sym.gdiplus.dll_GdipAddPathCurve2
sub esp, 0x10
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea esp, [ebp - 0x10]
mov esi, 2
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
fst qword [esp + 0x1c]
fstp dword [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [ebp - 0x1c], edx
mov dword [esp + 0xc], str.__p___p___d___.2f__n
mov dword [esp + 8], str.GdipAddPathCurve2I
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x1c]
fld dword [ebp - 0x20]
jmp 0x64a748ec
mov esi, 3
jmp 0x64a749a2
Function at 0x64a75210
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
test byte [0x64ab50c0], 8
jne 0x64a75350
mov ecx, 2
test edi, edi
jle 0x64a752f7
lea edx, [edi*8]
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x20], edx
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x64a75388
mov edx, dword [ebp - 0x20]
lea eax, [esi + 4]
lea ecx, [ebx + 4]
lea edx, [esi + edx + 4]
nop
fild dword [eax - 4]
add eax, 8
add ecx, 8
fstp dword [ecx - 0xc]
fild dword [eax - 8]
fstp dword [ecx - 8]
cmp eax, edx
jne 0x64a75290
test byte [0x64ab50c0], 8
jne 0x64a75310
mov eax, dword [ebp - 0x1c]
mov ecx, 2
test eax, eax
je 0x64a752cd
mov dword [esp], 1
mov ecx, edi
mov edx, ebx
call sym._extend_current_figure
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.GdipAddPathLine2
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x64a752af
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipAddPathLine2I
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x64a7523c
mov ecx, 3
jmp 0x64a752f7
Function at 0x64a76280
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
test byte [0x64ab50c0], 8
jne 0x64a76378
test edi, edi
je 0x64a76360
cmp esi, 2
jle 0x64a76360
lea ecx, [esi*8]
mov dword [esp + 4], 8
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x64a763b0
xor eax, eax
lea esi, [esi]
fild dword [edi + eax*8]
fstp dword [ebx + eax*8]
fild dword [edi + eax*8 + 4]
fstp dword [ebx + eax*8 + 4]
add eax, 1
cmp esi, eax
jg 0x64a762f8
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.gdiplus.dll_GdipAddPathPolygon
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
lea esp, [ebp - 0x10]
mov esi, 2
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipAddPathPolygonI
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x64a762ac
mov esi, 3
jmp 0x64a76349

Function at 0x64a76570
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x64ab50c0], 8
jne 0x64a765e0
test esi, esi
je 0x64a76610
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x64a76628
mov dword [eax], ebx
mov eax, dword [esi]
mov dword [eax + 0x10], 1
xor eax, eax
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x64abae15
mov dword [esp + 8], str.GdipCreatePath
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test esi, esi
jne 0x64a76595
lea esp, [ebp - 0xc]
mov eax, 2
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, 3
jmp 0x64a765d0
Function at 0x64a76950
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x24], eax
test byte [0x64ab50c0], 8
jne 0x64a76a40
lea edx, [esi*8]
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x28], edx
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test esi, esi
jle 0x64a769e6
mov edx, dword [ebp - 0x28]
lea eax, [edi + 4]
lea ecx, [ebx + 4]
lea edx, [edi + edx + 4]
lea esi, [esi]
fild dword [eax - 4]
add eax, 8
add ecx, 8
fstp dword [ecx - 0xc]
fild dword [eax - 8]
fstp dword [ecx - 8]
cmp eax, edx
jne 0x64a769d0
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.gdiplus.dll_GdipCreatePath2
sub esp, 0x14
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__p___p___d___d___p__n
mov dword [esp + 8], str.GdipCreatePath2I
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x64a76988
Function at 0x64a76a90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
test byte [0x64ab50c0], 8
jne 0x64a76b30
test ebx, ebx
je 0x64a76b60
mov eax, dword [ebx + 8]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x64abae05
mov dword [esp + 8], str.GdipDeletePath
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test ebx, ebx
jne 0x64a76abb
lea esp, [ebp - 0x10]
mov eax, 2
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x64a77b30
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x24], esi
mov esi, dword [ecx + 8]
test byte [0x64ab50c0], 8
jne 0x64a77c90
mov edx, 2
test esi, esi
jle 0x64a77c76
lea eax, [esi*8]
mov ebx, eax
mov dword [ebp - 0x28], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x64a77d08
test byte [0x64ab50c0], 8
jne 0x64a77cd0
test edi, edi
je 0x64a77d20
mov eax, dword [edi + 4]
mov edx, 5
cmp esi, eax
jl 0x64a77c4c
mov edx, dword [edi + 8]
shl eax, 3
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call sym._memcpy
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
lea eax, [ebx + 4]
fnstcw word [ebp - 0x1a]
add edx, 4
lea ecx, [ebx + edi + 4]
movzx esi, word [ebp - 0x1a]
or si, 0xc00
mov word [ebp - 0x1e], si
movzx esi, word [ebp - 0x1a]
and si, 0xf3ff
or si, 0x400
mov word [ebp - 0x1c], si
fld dword [0x64abb52c]
fld dword [eax - 4]
add eax, 8
add edx, 8
fadd st(1)
fldcw word [ebp - 0x1c]
frndint
fldcw word [ebp - 0x1a]
fldcw word [ebp - 0x1e]
fistp dword [edx - 0xc]
fldcw word [ebp - 0x1a]
fadd dword [eax - 8]
fldcw word [ebp - 0x1c]
frndint
fldcw word [ebp - 0x1a]
fldcw word [ebp - 0x1e]
fistp dword [edx - 8]
fldcw word [ebp - 0x1a]
cmp eax, ecx
jne 0x64a77c10
xor edx, edx
mov dword [ebp - 0x24], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword [ebp - 0x24]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], esi
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipGetPathPointsI
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x64a77b5c
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipGetPathPoints
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x64a77bb0
lea esp, [ebp - 0x10]
mov edx, 3
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov edx, 2
jmp 0x64a77c4c
Function at 0x64a7a6a0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x64ab50c0], 8
jne 0x64a7a798
mov dword [ebp - 0x1c], edx
test ebx, ebx
je 0x64a7a7d9
test esi, esi
je 0x64a7a7d9
mov ecx, 3
js 0x64a7a782
mov ecx, esi
mov dword [esp + 4], 8
shl ecx, 4
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x1c]
mov edi, eax
sub esp, 0xc
mov eax, ebx
xor ebx, ebx
mov ecx, edi
lea esi, [esi]
nop
fild dword [eax + 0xc]
fild dword [eax + 8]
add ebx, 1
add eax, 0x10
fild dword [eax - 0xc]
fild dword [eax - 0x10]
add ecx, 0x10
fstp dword [ecx - 0x10]
fstp dword [ecx - 0xc]
fstp dword [ecx - 8]
fstp dword [ecx - 4]
cmp esi, ebx
jg 0x64a7a720
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym.gdiplus.dll_GdipAddPathRectangles
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [ebp - 0x1c], edx
mov dword [esp + 0xc], 0x64abad72
mov dword [esp + 8], str.GdipAddPathRectanglesI
mov dword [esp + 4], 0x64ab50c0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
test ebx, ebx
jne 0x64a7a6d4
lea esp, [ebp - 0x10]
mov ecx, 2
mov eax, ecx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc