joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69033420
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx]
test byte [0x6907a0d8], 8
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
movss xmm1, dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
jne 0x69033588
movss dword [ebp - 0x20], xmm1
test ebx, ebx
sete dl
cmp edi, 1
setle al
or dl, al
jne 0x69033570
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x69033570
lea edx, [edi*8]
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x690335d8
test edi, edi
mov eax, 1
cmovg eax, edi
mov edx, ebx
movss xmm1, dword [ebp - 0x20]
mov ecx, eax
mov dword [ebp - 0x24], eax
shr ecx, 1
mov eax, esi
shl ecx, 4
add ecx, ebx
lea esi, [esi]
movdqu xmm2, xmmword [edx]
cvtdq2ps xmm0, xmm2
add edx, 0x10
add eax, 0x10
movlps qword [eax - 0x10], xmm0
movhps qword [eax - 8], xmm0
cmp ecx, edx
jne 0x690334d0
mov edx, dword [ebp - 0x24]
mov eax, edx
and eax, 0xfffffffe
test dl, 1
je 0x69033517
shl eax, 3
pxor xmm0, xmm0
add ebx, eax
add eax, esi
cvtsi2ss xmm0, dword [ebx]
movss dword [eax], xmm0
pxor xmm0, xmm0
cvtsi2ss xmm0, dword [ebx + 4]
movss dword [eax + 4], xmm0
movss dword [esp + 0xc], xmm1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.gdiplus.dll_GdipAddPathCurve2
xor edx, edx
sub esp, 0x10
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea esp, [ebp - 0x10]
mov ebx, 2
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x10], eax
mov eax, str.__p___p___d___.2f__n
pxor xmm0, xmm0
mov dword [esp + 0xc], eax
mov eax, str.GdipAddPathCurve2I
cvtss2sd xmm0, xmm1
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
movss dword [ebp - 0x20], xmm1
call sym._wine_dbg_log.constprop.0_5
movss xmm1, dword [ebp - 0x20]
jmp 0x69033451
mov ebx, 3
jmp 0x69033557
Function at 0x69033c00
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
test byte [0x6907a0d8], 8
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
jne 0x69033d18
test edi, edi
jle 0x69033d53
lea edx, [edi*8]
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x69033d77
cmp edi, 1
je 0x69033d70
mov ecx, edi
mov edx, ebx
shr ecx, 1
shl ecx, 4
add ecx, ebx
nop
movdqu xmm1, xmmword [edx]
cvtdq2ps xmm0, xmm1
add edx, 0x10
add eax, 0x10
movlps qword [eax - 0x10], xmm0
movhps qword [eax - 8], xmm0
cmp ecx, edx
jne 0x69033c80
mov eax, edi
and eax, 0xfffffffe
test edi, 1
je 0x69033cc7
shl eax, 3
pxor xmm0, xmm0
add ebx, eax
add eax, esi
cvtsi2ss xmm0, dword [ebx]
movss dword [eax], xmm0
pxor xmm0, xmm0
cvtsi2ss xmm0, dword [ebx + 4]
movss dword [eax + 4], xmm0
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.gdiplus.dll_GdipAddPathLine2
xor edx, edx
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x10], eax
mov eax, str.GdipAddPathLine2I
mov esi, 0x6907fe92
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test edi, edi
jg 0x69033c34
lea esp, [ebp - 0x10]
mov ebx, 2
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
xor eax, eax
jmp 0x69033ca6
mov ebx, 3
jmp 0x69033d01
Function at 0x690343d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
test byte [0x6907a0d8], 8
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
jne 0x69034510
test ebx, ebx
je 0x690344f8
cmp edi, 2
jle 0x690344f8
lea edx, [edi*8]
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x69034548
test edi, edi
mov eax, 1
cmovg eax, edi
mov edx, ebx
mov dword [ebp - 0x20], eax
mov ecx, eax
mov eax, esi
shr ecx, 1
shl ecx, 4
add ecx, ebx
lea esi, [esi]
movdqu xmm1, xmmword [edx]
cvtdq2ps xmm0, xmm1
add edx, 0x10
add eax, 0x10
movlps qword [eax - 0x10], xmm0
movhps qword [eax - 8], xmm0
cmp ecx, edx
jne 0x69034460
mov edx, dword [ebp - 0x20]
mov eax, edx
and eax, 0xfffffffe
test dl, 1
je 0x690344a7
shl eax, 3
pxor xmm0, xmm0
add ebx, eax
add eax, esi
cvtsi2ss xmm0, dword [ebx]
movss dword [eax], xmm0
pxor xmm0, xmm0
cvtsi2ss xmm0, dword [ebx + 4]
movss dword [eax + 4], xmm0
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.gdiplus.dll_GdipAddPathPolygon
xor edx, edx
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
lea esp, [ebp - 0x10]
mov ebx, 2
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x10], eax
mov eax, str.GdipAddPathPolygonI
mov esi, 0x6907fe92
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x690343fc
mov ebx, 3
jmp 0x690344e1
Function at 0x69034f10
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a0d8], 8
mov dword [ebp - 8], ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], ecx
jne 0x69034f90
test esi, esi
je 0x69034fc7
mov edx, 0x18
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x69034fce
mov dword [eax], ebx
mov dword [eax + 0x10], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov eax, 0x6907ff35
mov dword [esp + 0xc], eax
mov eax, str.GdipCreatePath
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test esi, esi
jne 0x69034f3f
mov eax, 2
jmp 0x69034f7a
mov eax, 3
jmp 0x69034f7a
Function at 0x690353c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
test byte [0x6907a0d8], 8
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x24], eax
jne 0x690354e0
lea edx, [edi*8]
mov ecx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test edi, edi
mov esi, eax
jle 0x69035487
cmp edi, 1
je 0x69035526
mov ecx, edi
mov edx, ebx
shr ecx, 1
shl ecx, 4
add ecx, ebx
nop
movdqu xmm1, xmmword [edx]
cvtdq2ps xmm0, xmm1
add edx, 0x10
add eax, 0x10
movlps qword [eax - 0x10], xmm0
movhps qword [eax - 8], xmm0
cmp ecx, edx
jne 0x69035440
mov eax, edi
and eax, 0xfffffffe
test edi, 1
je 0x69035487
shl eax, 3
pxor xmm0, xmm0
add ebx, eax
add eax, esi
cvtsi2ss xmm0, dword [ebx]
movss dword [eax], xmm0
pxor xmm0, xmm0
cvtsi2ss xmm0, dword [ebx + 4]
movss dword [eax + 4], xmm0
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x24]
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call sym.gdiplus.dll_GdipCreatePath2
xor edx, edx
sub esp, 0x14
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x20]
mov esi, str.__p___p___d___d___p__n
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], 3
mov dword [esp + 0x14], eax
mov eax, str.GdipCreatePath2I
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0_5
jmp 0x690353f8
xor eax, eax
jmp 0x69035466
Function at 0x69035530
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x6907a0d8], 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
jne 0x690355d8
test ebx, ebx
je 0x6903560b
mov eax, dword [ebx + 8]
mov edi, dword fs:[0x18]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
xor edx, edx
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor ecx, ecx
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0xc
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, 0x6907a0d8
mov esi, 0x6907ff2f
mov dword [esp + 0x10], ebx
mov edi, str.GdipDeletePath
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test ebx, ebx
jne 0x69035563
mov eax, 2
jmp 0x690355c0
Function at 0x690363e0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 4]
test byte [0x6907a0d8], 8
mov esi, dword [ecx]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
jne 0x69036588
test ebx, ebx
jle 0x690365c3
lea edi, [ebx*8]
mov ecx, 8
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x690365d8
mov dword [esp], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [ebp - 0x20], eax
call sym.gdiplus.dll_GdipGetPathPoints
mov edx, dword [ebp - 0x20]
sub esp, 0xc
test eax, eax
mov esi, eax
jne 0x69036553
mov ebx, dword [ebp - 0x1c]
lea ecx, [edx + 4]
movsd xmm4, qword [0x690806d0]
movss xmm3, dword [0x69080668]
movsd xmm1, qword [0x690806b0]
movsd xmm2, qword [0x690806c0]
lea edi, [edx + edi + 4]
movupd xmm5, xmm4
add ebx, 4
lea esi, [esi]
movss xmm0, dword [ecx - 4]
addss xmm0, xmm3
cvtss2sd xmm0, xmm0
movupd xmm6, xmm0
andpd xmm6, xmm2
ucomisd xmm1, xmm6
jbe 0x690364e8
addsd xmm6, xmm1
movupd xmm7, xmm2
subsd xmm6, xmm1
andnpd xmm7, xmm0
orpd xmm6, xmm7
movupd xmm7, xmm6
cmpnlesd xmm7, xmm0
movupd xmm0, xmm7
andpd xmm0, xmm4
subsd xmm6, xmm0
movupd xmm0, xmm6
cvtsd2ss xmm0, xmm0
cvttss2si eax, xmm0
movss xmm0, dword [ecx]
mov dword [ebx - 4], eax
addss xmm0, xmm3
cvtss2sd xmm0, xmm0
movupd xmm6, xmm0
andpd xmm6, xmm2
ucomisd xmm1, xmm6
jbe 0x6903653a
addsd xmm6, xmm1
movupd xmm7, xmm2
subsd xmm6, xmm1
andnpd xmm7, xmm0
orpd xmm6, xmm7
movupd xmm7, xmm6
cmpnlesd xmm7, xmm0
movupd xmm0, xmm7
andpd xmm0, xmm5
subsd xmm6, xmm0
movupd xmm0, xmm6
cvtsd2ss xmm0, xmm0
cvttss2si eax, xmm0
add ecx, 8
add ebx, 8
mov dword [ebx - 8], eax
cmp edi, ecx
jne 0x690364a0
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x14], eax
mov eax, str.GdipGetPathPointsI
mov edi, 0x6907fe92
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test ebx, ebx
jg 0x69036414
lea esp, [ebp - 0x10]
mov esi, 2
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov esi, 3
jmp 0x69036575
Function at 0x69038820
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
test byte [0x6907a0d8], 8
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
jne 0x69038908
test esi, esi
je 0x69038943
test edi, edi
je 0x69038943
lea esi, [esi]
js 0x69038960
mov edx, edi
mov ecx, 8
mov dword [esp + 4], ecx
shl edx, 4
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, 1
sub esp, 0xc
test edi, edi
mov ebx, eax
cmovg ecx, edi
xor eax, eax
nop
mov edx, eax
inc eax
shl edx, 4
cmp eax, ecx
movdqu xmm1, xmmword [esi + edx]
cvtdq2ps xmm0, xmm1
movlps qword [ebx + edx], xmm0
movhps qword [ebx + edx + 8], xmm0
jb 0x690388a0
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.gdiplus.dll_GdipAddPathRectangles
xor edx, edx
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x10], eax
mov eax, str.GdipAddPathRectanglesI
mov ebx, 0x6907fe92
mov dword [esp + 8], eax
mov eax, 0x6907a0d8
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
test esi, esi
jne 0x69038854
lea esp, [ebp - 0x10]
mov esi, 2
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
lea esp, [ebp - 0x10]
mov esi, 3
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
Function at 0x69039230
Capabilities:
Get process heap flags

Disassembly:
push edi
mov ecx, str.GlobalColorTableFlag
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x420
mov eax, edx
mov dword [esp + 0x1c], esi
mov edx, 0x69082c74
call sym._get_bool_property
test eax, eax
je 0x69039390
mov dword [esp], 0x236
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
call sym._WICCreateImagingFactory_Proxy_8
sub esp, 8
test eax, eax
jne 0x69039390
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x24]
sub esp, 8
test eax, eax
jne 0x690392e2
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov dword [esp], ebx
mov dword [esp + 4], edx
call dword [eax + 0x1c]
sub esp, 8
test eax, eax
jne 0x690392d3
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 8], ecx
mov ecx, 0x100
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x24]
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x69039390
lea eax, [eax + eax*2 + 0x10]
mov dword [esp + 8], eax
mov eax, 8
mov dword [esp + 4], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x69039390
mov word [eax + 8], 1
lea edx, [eax + 0x10]
mov dword [eax], 0x5102
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x1c]
lea ecx, [eax + eax*2]
test eax, eax
mov dword [esi + 4], ecx
je 0x69039392
lea ecx, [esp + 0x20]
lea edi, [esp + eax*4 + 0x20]
lea esi, [esi]
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
add edx, 3
mov byte [edx - 2], bh
mov eax, ebx
mov byte [edx - 1], bl
shr eax, 0x10
mov byte [edx - 3], al
cmp edi, ecx
jne 0x69039360
add esp, 0x420
mov eax, esi
pop ebx
pop esi
pop edi
ret
xor esi, esi
add esp, 0x420
mov eax, esi
pop ebx
pop esi
pop edi
ret
Function at 0x69039d40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x40
mov dword [esp], 0x236
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
call sym._WICCreateImagingFactory_Proxy_8
sub esp, 8
test eax, eax
jne 0x69039f10
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
xor esi, esi
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x24]
sub esp, 8
test eax, eax
jne 0x69039ea7
test ebx, ebx
je 0x69039f20
mov edx, dword [esp + 0x30]
mov eax, dword [ebx]
mov dword [esp], ebx
mov dword [esp + 4], edx
call dword [eax + 0x18]
sub esp, 8
test eax, eax
je 0x69039dd3
test edi, edi
je 0x69039dd3
test byte [0x6907a0e8], 8
jne 0x69039ee0
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov edx, dword [esp + 0x30]
xor esi, esi
test eax, eax
mov ecx, dword [edx]
jne 0x69039e9e
mov dword [esp], edx
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call dword [ecx + 0x20]
mov eax, dword fs:[0x18]
sub esp, 8
mov edx, dword [esp + 0x3c]
lea edx, [edx*4 + 8]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x30]
lea ecx, [esi + 4]
mov edx, dword [eax]
mov dword [esp + 0xc], ecx
lea ecx, [esi + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x24]
sub esp, 0x10
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x1c]
sub esp, 8
mov eax, dword [esp + 0x34]
cmp eax, 9
jbe 0x69039ec0
sub eax, 0xa
cmp eax, 2
ja 0x69039ec5
mov dword [esi], 2
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x38]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x69039e98
or dword [esi], 1
mov edx, dword [esp + 0x30]
mov ecx, dword [edx]
mov dword [esp], edx
call dword [ecx + 8]
sub esp, 4
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, esi
sub esp, 4
add esp, 0x40
pop ebx
pop esi
pop edi
ret
cmp eax, 2
ja 0x69039ed0
mov dword [esi], 0
jmp 0x69039e76
mov dword [esi], 4
jmp 0x69039e76
mov ebx, str.using_predefined_palette__x_n
mov esi, str.get_palette
mov dword [esp + 0x10], edi
mov eax, 0x6907a0e8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_6
jmp 0x69039dba
add esp, 0x40
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
ret
test edi, edi
je 0x69039e98
jmp 0x69039dad
Function at 0x6903a2c0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x5c
mov eax, dword [eax]
lea ebp, [esp + 0x40]
mov dword [esp + 4], ebp
mov dword [esp], ebx
call dword [eax + 0xc]
sub esp, 8
test eax, eax
js 0x6903a2ec
mov eax, dword [edi]
cmp dword [esp + 0x40], eax
je 0x6903a300
xor edi, edi
add esp, 0x5c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
cmp dword [ebp + 4], eax
jne 0x6903a2ec
mov eax, dword [edi + 8]
cmp dword [ebp + 8], eax
jne 0x6903a2ec
mov eax, dword [edi + 0xc]
cmp dword [ebp + 0xc], eax
jne 0x6903a2ec
xor eax, eax
xor edi, edi
mov dword [esp + 0x28], eax
xor eax, eax
xor ebp, ebp
mov dword [esp + 0x2c], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x34], eax
xor eax, eax
cmp word [esi], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x38], eax
mov eax, esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x3c], edx
mov word [esp + 0x20], 0x1f
je 0x6903a46d
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x6903a360
sub eax, esi
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
sub esp, 4
test eax, eax
mov dword [esp + 0x28], eax
mov edi, eax
je 0x6903a2ee
xor eax, eax
lea esi, [esi]
movzx edx, word [esi + eax]
mov word [edi + eax], dx
add eax, 2
test edx, edx
jne 0x6903a390
mov eax, dword [ebx]
lea esi, [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], esi
lea ebp, [esp + 0x20]
mov dword [esp + 8], ebp
mov dword [esp + 4], ecx
mov dword [esp], ebx
call dword [eax + 0x1c]
sub esp, 0x10
test eax, eax
je 0x6903a3f0
xor edi, edi
mov dword [esp], ebp
call sym._PropVariantClear_4
sub esp, 4
mov dword [esp], esi
call sym._PropVariantClear_4
mov eax, edi
sub esp, 4
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x38]
call sym._propvariant_size.isra.0
test eax, eax
je 0x6903a3c4
lea ecx, [eax + 0x10]
mov edx, 8
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov ebx, dword fs:[0x18]
mov dword [esp + 0x1c], ecx
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
mov dword [esp], 0
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov eax, esi
call sym._propvariant_to_item
test eax, eax
je 0x6903a3c6
mov dword [esp + 8], edi
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6903a3c4
mov eax, 2
jmp 0x6903a36e