joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42baf0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4688f8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.004263f0
test eax, eax
je 0x42bbf8
lea ecx, [esp + 0xc]
call fcn.004027a0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.004263f0
mov ecx, eax
call fcn.00423ad0
test eax, eax
je 0x42bbdf
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x42bbdf
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42bbdf
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.004029a0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x42bbc1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x42bbdf
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x5ba078]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x590840
call fcn.004029a0
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x42bc40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.004263f0
test eax, eax
je 0x42bd2f
mov ecx, edi
call fcn.004263f0
mov ecx, eax
call fcn.00423980
test eax, eax
jne 0x42bd2f
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42bd2f
mov eax, dword [0x5ba078]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x42bca2
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.004263f0
mov ecx, eax
call fcn.00423bb0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x42bd2f
cmp ebx, eax
jne 0x42bd2f
cmp dword [esp + 0x10], eax
jne 0x42bd15
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x42e970
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x468b88
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x42e9a9
inc eax
mov dword [esi + 0x10], eax
jmp 0x42eabc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x42e9bd
mov eax, 0xffffffc7
jmp 0x42eabe
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x42e9ce
cmp dword [esi + 8], eax
jne 0x42e9bd
cmp dword [esi + 8], eax
jne 0x42e9e7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x42e9e7
mov eax, 0xffffffc7
jmp 0x42eabe
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x42e9fb
push eax
mov ecx, ebx
call fcn.0042e1a0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004027a0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x42ea2c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004027c0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042d910
test eax, eax
mov dword [esp + 0x38], eax
je 0x42ea5f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x590840
call fcn.004029a0
mov eax, dword [esp + 0x38]
jmp 0x42eabe
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0042e7d0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x42eaa3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0042e7f0
mov esi, eax
test esi, esi
jne 0x42ead3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0042e7d0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x42ea75
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x590840
call fcn.004029a0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x590840
call fcn.004029a0
mov eax, esi
jmp 0x42eabe

Function at 0x431ba0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x431c00
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x431c00
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x431c00
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x431c00
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x431c40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x6b6c15c0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
je 0x6b6c15f8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7018], 8
jne 0x6b6c1638
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6b6d9000
mov dword [esp + 8], str.CategoryMgr_Destructor
mov dword [esp + 4], 0x6b6d7018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6b6c1601
Function at 0x6b6c1e20
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x2c], eax
test byte [0x6b6d7018], 8
jne 0x6b6c1f40
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x6b6c2009
mov dword [ebp - 0x1c], 0
lea ebx, [ebp - 0x1c]
lea esi, [esi]
mov dword [esp + 4], ebx
mov dword [esp], 0x30
call sym._enumerate_Cookie
mov edi, eax
test eax, eax
jne 0x6b6c1ef8
mov edx, dword fs:[0x18]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x30], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [esi]
sub esp, 0xc
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x30
call sym._generate_Cookie
mov edx, dword [ebp - 0x30]
test eax, eax
je 0x6b6c2013
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp], eax
call sym._get_Cookie_data
mov edx, dword [eax]
cmp dword [esi], edx
jne 0x6b6c1e68
mov ecx, dword [eax + 4]
cmp dword [esi + 4], ecx
jne 0x6b6c1e68
mov ecx, dword [eax + 8]
cmp dword [esi + 8], ecx
jne 0x6b6c1e68
mov eax, dword [eax + 0xc]
cmp dword [esi + 0xc], eax
jne 0x6b6c1e68
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ecx], edi
jmp 0x6b6c1ee4
test esi, esi
je 0x6b6c2002
mov eax, esi
shr eax, 0x10
je 0x6b6c1fed
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x6b6d9040
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str.__p___s__p_n
mov dword [esp + 8], str.CategoryMgr_RegisterGUID
mov dword [esp + 4], 0x6b6d7018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6b6c1e4c
movzx eax, si
mov dword [esp], 0x6b6d9031
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
jmp 0x6b6c1fb5
mov eax, 0x6b6d902a
jmp 0x6b6c1fb5
mov eax, 0x80070057
jmp 0x6b6c1ee4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 0x80004005
sub esp, 0xc
jmp 0x6b6c1ee4
Function at 0x6b6c2ad0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6b6c2b70
mov dword [esp + 8], 8
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c2b77
mov edx, dword [ebp + 0xc]
mov dword [eax], str.__lk
xor ebx, ebx
mov dword [eax + 4], 1
mov dword [edx], eax
test byte [0x6b6d7018], 8
jne 0x6b6c2b38
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6b6d90b9
mov dword [esp + 8], str.CategoryMgr_Constructor
mov dword [esp + 4], 0x6b6d7018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, 0x80040110
jmp 0x6b6c2b2b
mov ebx, 0x8007000e
jmp 0x6b6c2b2b

Function at 0x6b6c2fa0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
mov esi, 0xffffffff
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
lock xadd dword [ebx + 8], esi
dec esi
je 0x6b6c2fd8
lea esp, [ebp - 0xc]
mov eax, esi
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7028], 8
jne 0x6b6c3030
lea eax, [ebx + 0x10]
mov dword [esp], eax
call dword [sym.imp.oleaut32.dll_VariantClear]
lea eax, [ebx + 0x24]
sub esp, 4
mov dword [esp], eax
call sym._free_sinks
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6d94de
mov dword [esp + 8], str.Compartment_Destructor
mov dword [esp + 4], 0x6b6d7028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x6b6c2fe1

Function at 0x6b6c32d0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
mov eax, dword fs:[0x18]
sub esp, 0x20
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c3371
mov edx, dword [esi]
mov ecx, 0
mov dword [ebx], eax
mov dword [eax], sym._CompartmentEnumGuid_QueryInterface_12
cmp esi, edx
mov dword [eax + 4], 1
cmove edx, ecx
mov dword [eax + 8], esi
xor ebx, ebx
mov dword [eax + 0xc], edx
test byte [0x6b6d7028], 8
jne 0x6b6c3340
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6b6d950d
mov dword [esp + 8], str.CompartmentEnumGuid_Constructor
mov dword [esp + 4], 0x6b6d7028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x8007000e
jmp 0x6b6c3334
Function at 0x6b6c3380
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
je 0x6b6c33b8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7028], 8
jne 0x6b6c33f8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6b6d94de
mov dword [esp + 8], str.CompartmentEnumGuid_Destructor
mov dword [esp + 4], 0x6b6d7028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x6b6c33c1
Function at 0x6b6c36c0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
test byte [0x6b6d7028], 8
jne 0x6b6c37a8
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0xc]
cmp ebx, eax
je 0x6b6c3790
mov esi, dword [edi]
jmp 0x6b6c370a
mov ebx, dword [ebx]
cmp ebx, eax
je 0x6b6c3790
cmp esi, dword [ebx + 8]
jne 0x6b6c3700
mov edx, dword [ebx + 0xc]
cmp dword [edi + 4], edx
jne 0x6b6c3700
mov edx, dword [ebx + 0x10]
cmp dword [edi + 8], edx
jne 0x6b6c3700
mov edx, dword [ebx + 0x14]
cmp dword [edi + 0xc], edx
jne 0x6b6c3700
mov eax, dword [ebx + 0x18]
xor esi, esi
cmp eax, dword [ebp - 0x1c]
je 0x6b6c3739
test eax, eax
jne 0x6b6c3871
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov eax, dword [ebx + 0x1c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov esi, 0x80040200
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test edi, edi
je 0x6b6c386a
mov eax, edi
shr eax, 0x10
je 0x6b6c3855
movzx eax, byte [edi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], 0x6b6d9490
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__p___li__s_n
mov dword [esp + 8], str.CompartmentMgr_ClearCompartment
mov dword [esp + 4], 0x6b6d7028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x6b6c36ec
movzx eax, di
mov dword [esp], 0x6b6d9480
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x6b6c381d
mov eax, 0x6b6d9521
jmp 0x6b6c381d
mov esi, 0x8000ffff
jmp 0x6b6c3795
Function at 0x6b6c4170
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword fs:[0x18]
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 0x1c], eax
mov esi, dword [ebx]
cmp ebx, eax
je 0x6b6c41d7
lea esi, [esi]
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov ecx, dword [ebx]
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov ecx, dword [eax]
mov dword [esp], eax
call dword [ecx + 8]
sub esp, 4
mov dword [esp + 8], ebx
mov ebx, esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [esi]
sub esp, 0xc
cmp dword [ebp - 0x1c], ebx
jne 0x6b6c4198
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6b6c4270
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x6b6c43db
test esi, esi
je 0x6b6c4350
mov eax, dword [0x6b6e3778]
cmp dword [edi], eax
je 0x6b6c42b0
mov edi, 0x80040110
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x6b6e377c]
cmp dword [edi + 4], eax
jne 0x6b6c429b
mov eax, dword [0x6b6e3780]
cmp dword [edi + 8], eax
jne 0x6b6c429b
mov eax, dword [0x6b6e3784]
cmp dword [edi + 0xc], eax
jne 0x6b6c429b
mov dword [esp + 8], 0x14
xor edi, edi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6b6c43e5
lea edx, [eax + 0xc]
mov dword [eax], sym._CompartmentMgr_QueryInterface_12
mov dword [eax + 8], esi
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], edx
mov dword [ebx], eax
test byte [0x6b6d7028], 8
je 0x6b6c42a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6b6d950d
mov dword [esp + 8], str.CompartmentMgr_Constructor
mov dword [esp + 4], 0x6b6d7028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x6b6c43e5
lea eax, [edx + 0xc]
mov dword [edx], sym._CompartmentMgr_QueryInterface_12
mov dword [edx + 8], 0
mov dword [edx + 0x10], eax
mov dword [edx + 0xc], eax
mov dword [esp + 4], edi
mov dword [esp], edx
mov dword [esp + 8], ebx
mov dword [ebp - 0x1c], edx
call sym._CompartmentMgr_QueryInterface_12.part.0
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
jns 0x6b6c42a0
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6b6c42a0
mov edi, 0x80004003
jmp 0x6b6c42a0
mov edi, 0x8007000e
jmp 0x6b6c42a0
Function at 0x6b6c4e10
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0xffffffff
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
lock xadd dword [ebx + 0x1c], esi
dec esi
je 0x6b6c4e48
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
test byte [0x6b6d7038], 8
jne 0x6b6c4f00
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x6b6c4e67
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x6b6c4e79
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebx + 0x2c]
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
test eax, eax
jne 0x6b6c4f30
lea eax, [ebx + 0x48]
mov dword [esp], eax
call sym._free_sinks
lea eax, [ebx + 0x50]
mov dword [esp], eax
call sym._free_sinks
lea eax, [ebx + 0x58]
mov dword [esp], eax
call sym._free_sinks
lea eax, [ebx + 0x60]
mov dword [esp], eax
call sym._free_sinks
lea eax, [ebx + 0x68]
mov dword [esp], eax
call sym._free_sinks
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sym._CompartmentMgr_Destructor
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6b6d9896
mov dword [esp + 8], str.Context_Destructor
mov dword [esp + 4], 0x6b6d7038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6b6c4e55
mov dword [esp], eax
call sym._remove_Cookie
mov dword [esp + 4], 0
mov edx, eax
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov dword [ebx + 0x2c], 0
sub esp, 0xc
jmp 0x6b6c4e8a