joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f2445d0
Capabilities:
Log keystrokes via polling

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x4c
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x6f2665a8], 8
jne 0x6f2446b0
mov ebx, esi
shr ebx, 0x10
je 0x6f244648
call dword [sym.imp.user32.dll_GetActiveWindow]
cmp bx, ax
je 0x6f244648
lea eax, [ebp - 0x34]
mov dword [esp + 0x10], 0x400001
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_PeekMessageW]
xor eax, eax
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
movzx esi, si
mov dword [esp], esi
call dword [sym.imp.user32.dll_GetAsyncKeyState]
sub esp, 4
test al, 1
je 0x6f244607
mov dword [ebp - 0x34], ebx
mov eax, ebx
lea esi, [ebp - 0x34]
mov ebx, dword [sym.imp.user32.dll_PeekMessageW]
jmp 0x6f244673
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x109
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
mov dword [esp], esi
call ebx
sub esp, 0x14
test eax, eax
je 0x6f244670
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._0x_04x__0x_08lx__n
mov dword [esp + 8], str.MCI_DefYieldProc
mov dword [esp + 4], 0x6f2665a8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6f2445f5
Function at 0x6f244780
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
mov dword [ebp - 0x1c], ecx
and ch, 4
jne 0x6f244890
mov eax, dword [ebp - 0x1c]
and eax, 0xa00
cmp eax, 0x200
je 0x6f2447f0
test dword [ebp - 0x1c], 0x2000
je 0x6f244800
mov edi, dword [ebx + 8]
test edi, edi
je 0x6f244800
mov dword [esp + 4], 0x6f2733c0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x6f2447dc
mov eax, edi
call sym._MCI_GetDriverFromString.part.0
test eax, eax
je 0x6f2448bb
mov eax, 0x109
jmp 0x6f244884
mov edi, dword [edx + 0xc]
test edi, edi
jne 0x6f2447b8
lea esi, [esi]
nop
mov eax, dword [ebx]
mov dword [esi + 4], eax
mov edi, dword [ebx]
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x6f2663a0]
sub esp, 4
test ebx, ebx
jne 0x6f24483b
jmp 0x6f244938
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
je 0x6f244938
cmp edi, dword [ebx]
jne 0x6f244830
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x20]
mov eax, 0x107
sub esp, 4
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
jne 0x6f244884
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x801
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.winmm.dll_DrvSendMessage
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [edx + 0x10]
test edi, edi
je 0x6f244800
mov dword [esp + 4], 0x6f2733c0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x6f244928
mov eax, edi
call sym._MCI_GetDriverFromString.part.0
test eax, eax
jne 0x6f244928
cmp word [edi], 0
mov eax, edi
je 0x6f244955
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x6f2448d0
sub eax, edi
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0xc], eax
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x6f24495f
xor eax, eax
nop
movzx edx, word [edi + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x6f244910
jmp 0x6f244800
lea esp, [ebp - 0xc]
mov eax, 0x121
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, 0x101
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x6f2448de
mov eax, 0x108
jmp 0x6f244884
Function at 0x6f244970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
mov eax, 0x6f2663c0
push ebx
xor ebx, ebx
sub esp, 0x6c
lea esi, [esi]
mov edx, dword [eax + 8]
test edx, edx
je 0x6f244997
cmp dword [eax], esi
je 0x6f244a4c
inc ebx
add eax, 0x14
cmp ebx, 0x14
jne 0x6f244988
lea eax, [esi - 0x201]
cmp eax, 0xa
jbe 0x6f244a10
test esi, esi
jne 0x6f244a3c
mov edi, 0x6f273374
mov eax, dword [0x6f267188]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x6f244a98
mov dword [esp + 4], eax
mov eax, dword [0x6f267188]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x6f244a98
mov edx, esi
call sym._MCI_SetCommandTable
mov ebx, eax
movzx eax, byte [0x6f2665a8]
jmp 0x6f244a48
mov eax, dword [0x6f267188]
lea edi, [ebp - 0x58]
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x6f2449b8
movzx eax, byte [0x6f2665a8]
mov ebx, 0xffff
test al, 8
jne 0x6f244a60
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.___d_n
mov dword [esp + 8], str.MCI_GetCommandTable
mov dword [esp + 4], 0x6f2665a8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [0x6f2665a8]
mov ebx, 0xffff
test al, 4
je 0x6f244a48
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.No_command_table_found_in_resource__p__s__n
mov dword [esp + 0x14], eax
mov eax, dword [0x6f267188]
mov dword [esp + 8], str.MCI_GetCommandTable
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x6f2665a8
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
movzx eax, byte [0x6f2665a8]
jmp 0x6f244a48
Function at 0x6f244c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
sub esp, 0x30
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x6f244c6d
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionMCI_Extensions
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x6f244c80
test byte [0x6f2665a8], 8
jne 0x6f244cd8
mov eax, 0x119
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
lea eax, [ebx + 2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], 0x100
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
test esi, esi
je 0x6f244c72
test byte [0x6f2665a8], 8
je 0x6f244c6d
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.No_...MCI_Extensions_entry_for__s_found._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MCI_GetDevTypeFromFileName
mov dword [esp + 4], 0x6f2665a8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x6f244c6d
Function at 0x6f2471a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym.winmm.dll_CloseDriver
mov eax, dword [ebx + 0x14]
sub esp, 0xc
test eax, eax
je 0x6f2471dd
test byte [0x6f2665a8], 4
jne 0x6f2472a0
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6f2663a0]
sub esp, 4
test eax, eax
je 0x6f247211
cmp ebx, eax
jne 0x6f247208
jmp 0x6f2472c9
cmp ebx, eax
je 0x6f247290
mov edx, eax
mov eax, dword [eax + 0x2c]
test eax, eax
jne 0x6f247200
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 8]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 4
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add edx, 0x2c
mov eax, dword [ebx + 0x2c]
mov dword [edx], eax
jmp 0x6f247211
mov dword [esp + 0xc], str.Unloading_mci_driver_with_non_nul_dwPrivate_field_n
mov dword [esp + 8], str.MCI_UnLoadMciDriver
mov dword [esp + 4], 0x6f2665a8
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_3
jmp 0x6f2471dd
mov edx, 0x6f2663a0
jmp 0x6f247293

Function at 0x6f2472d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
test eax, eax
je 0x6f247380
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6f247376
mov dword [esp + 0x14], edi
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x18
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x6f247390
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x1c]
test byte [0x6f266618], 8
jne 0x6f247488
mov dword [esp + 8], esi
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6f24743a
xor eax, eax
jmp 0x6f2473ea
inc eax
cmp eax, 0x28
je 0x6f2474d8
mov edx, dword [eax*4 + 0x6f266300]
test edx, edx
jne 0x6f2473e0
mov dword [eax*4 + 0x6f266300], esi
or ah, 0x80
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov dword [esp], eax
call sym._MMDRV_GetNum
cmp ebx, eax
jae 0x6f247448
test byte [0x6f266618], 2
jne 0x6f24745b
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
shr eax, 0x10
mov word [esi + 0x10], ax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [edi]
mov dword [esi + 0x18], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shr eax, 0x10
je 0x6f247421
test byte [0x6f266618], 2
je 0x6f247421
mov dword [esp + 0xc], str.Shouldnt_happen._Bad_allocation_scheme_n
mov dword [esp + 8], str.MMDRV_Alloc
mov dword [esp + 4], 0x6f266618
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f247421
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], str.__d___04x___p___p___p___p__n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], str.MMDRV_Alloc
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x6f266618
mov dword [esp + 0x14], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f2473ac
test byte [0x6f266618], 2
jne 0x6f247511
mov dword [esp + 8], esi
xor esi, esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Too_many_open_drivers_n
mov dword [esp + 8], str.MMDRV_Alloc
mov dword [esp + 4], 0x6f266618
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f2474e1
Function at 0x6f2475b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
test byte [0x6f266618], 8
jne 0x6f2477ba
xor ebx, ebx
jmp 0x6f2475d6
inc ebx
cmp ebx, 0x28
je 0x6f247614
mov eax, dword [ebx*4 + 0x6f266300]
test eax, eax
je 0x6f2475d0
test byte [0x6f266618], 1
je 0x6f2475d0
mov dword [esp + 0xc], 0x6f272c88
inc ebx
mov dword [esp + 8], str.MMDRV_Exit
mov dword [esp + 4], 0x6f266618
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_2
cmp ebx, 0x28
jne 0x6f2475d6
mov ebx, 0x6f26628c
mov edi, 0x6f266040
nop
mov eax, ebx
xor edx, edx
mov esi, ebx
call sym._MMDRV_ExitPerType.isra.0
mov eax, ebx
mov edx, 1
call sym._MMDRV_ExitPerType.isra.0
mov eax, ebx
mov edx, 2
call sym._MMDRV_ExitPerType.isra.0
mov eax, ebx
mov edx, 3
call sym._MMDRV_ExitPerType.isra.0
mov eax, ebx
mov edx, 4
call sym._MMDRV_ExitPerType.isra.0
mov eax, ebx
mov edx, 5
sub ebx, 0x54
call sym._MMDRV_ExitPerType.isra.0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x54]
mov dword [esp], eax
call sym.winmm.dll_CloseDriver
sub esp, 0xc
cmp edi, esi
jne 0x6f247620
mov eax, dword [0x6f270228]
test eax, eax
je 0x6f2476bd
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f270238]
test eax, eax
je 0x6f2476ee
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f270248]
test eax, eax
je 0x6f24771f
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f270258]
test eax, eax
je 0x6f247750
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f270268]
test eax, eax
je 0x6f247781
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [0x6f270278]
test eax, eax
je 0x6f2477b2
sub eax, 0x1c
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x6f272944
mov dword [esp + 8], str.MMDRV_Exit
mov dword [esp + 4], 0x6f266618
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f2475c6
Function at 0x6f2478d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x6f266618], 8
jne 0x6f247900
test bh, 0x80
je 0x6f2478f2
mov eax, ebx
and ah, 0x7f
cmp eax, 0x27
jbe 0x6f247970
test byte [0x6f266618], 2
jne 0x6f247938
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6f272b4d
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.MMDRV_Free
mov dword [esp + 4], 0x6f266618
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6f2478e3
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Bad_Handle__p_at__p__not_freed__n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.MMDRV_Free
mov dword [esp + 4], 0x6f266618
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
mov ebx, dword [ebp - 4]
leave
ret
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [eax*4 + 0x6f266300], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
Function at 0x6f2490c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6f2662e4]
sub esp, 4
test eax, eax
je 0x6f2490fd
cmp eax, ebx
jne 0x6f2490f4
jmp 0x6f249153
cmp ebx, eax
je 0x6f249120
mov edx, eax
mov eax, dword [eax + 0x48]
test eax, eax
jne 0x6f2490f0
test ebx, ebx
sete bl
movzx ebx, bl
mov dword [esp], 0x6f266580
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
add edx, 0x48
mov eax, dword [eax + 0x48]
mov dword [edx], eax
mov dword [esp + 8], ebx
mov ebx, 1
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6f249105
mov edx, 0x6f2662e4
jmp 0x6f249123
Function at 0x6f2492b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
test byte [0x6f2665c8], 8
je 0x6f24930e
mov ecx, dword [ebp + 8]
mov eax, str.unicode
mov edx, str.ansi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
test ecx, ecx
mov dword [esp + 0x10], ebx
cmove eax, edx
mov dword [esp + 0xc], str.__08lx___p___08lX___s__n
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 0x1c], eax
mov dword [esp + 4], 0x6f2665c8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
test edi, 0x10000000
je 0x6f249323
test byte [0x6f2665c8], 1
jne 0x6f249468
and edi, 0x70000
cmp edi, 0x20000
je 0x6f2493e0
cmp edi, 0x40000
je 0x6f2493b0
cmp edi, 0x10000
je 0x6f249358
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6f249345
mov edx, dword [ebp + 8]
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edx
mov edx, dword [0x6f2702c8]
mov dword [eax + 0x10], 0
mov dword [eax], edx
mov dword [0x6f2702c8], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x6f2702c8]
test eax, eax
jne 0x6f2493ca
jmp 0x6f249345
mov eax, dword [eax]
test eax, eax
je 0x6f249345
cmp ebx, dword [eax + 4]
jne 0x6f2493c0
mov esi, dword [eax + 8]
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x6f2702c8]
mov ecx, 0x6f2702c8
test eax, eax
jne 0x6f249409
jmp 0x6f249345
cmp dword [eax + 4], ebx
je 0x6f249412
mov ecx, eax
mov eax, dword [eax]
test eax, eax
je 0x6f249345
test ebx, ebx
jne 0x6f2493f8
cmp dword [eax + 8], esi
jne 0x6f2493fd
mov edx, dword [eax + 0x10]
test edx, edx
jne 0x6f249498
cmp eax, 0x6f2666e0
jb 0x6f2494d0
cmp eax, 0x6f266708
jae 0x6f2494d0
test byte [0x6f2665c8], 4
je 0x6f249345
mov dword [esp + 0xc], str.Tried_to_remove_built_in_mmio_proc._Skipping_n
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 4], 0x6f2665c8
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_4
jmp 0x6f249345
mov dword [esp + 0xc], str.Global_procedures_not_implemented_n
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 4], 0x6f2665c8
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_4
jmp 0x6f249323
test byte [0x6f2665c8], 2
je 0x6f249345
mov dword [esp + 0xc], str.Cannot_remove_a_mmIOProc_while_in_use_n
xor esi, esi
mov dword [esp + 8], str.MMIO_InstallIOProc
mov dword [esp + 4], 0x6f2665c8
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_4
jmp 0x6f249347
mov edx, dword [eax]
mov esi, dword [eax + 8]
mov dword [ecx], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6f249347
Function at 0x6f249bd0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x3c
test byte [0x6f2665c8], 8
jne 0x6f249c60
cmp edi, 0xffff
jle 0x6f249bfd
test byte [0x6f2665c8], 4
jne 0x6f249d10
xor edx, edx
mov eax, ebx
call sym._MMIO_Flush
mov ecx, eax
test eax, eax
jne 0x6f249cf8
test dword [ebx], 0x10000
jne 0x6f249ca0
test esi, esi
je 0x6f249ce2
mov dword [ebx + 0x18], esi
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
add esi, edi
cmp dword [ebx + 4], 0x204d454d
mov dword [ebx + 0x28], eax
movzx eax, byte [ebx + 0x50]
sete dl
add edx, edx
mov dword [ebx + 0x14], edi
and eax, 0xfffffffd
mov dword [ebx + 0x24], esi
or eax, edx
mov byte [ebx + 0x50], al
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__ld__u__n
mov dword [esp + 8], str.MMIO_SetBuffer
mov dword [esp + 4], 0x6f2665c8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6f249be8
mov edx, dword [ebx + 0x18]
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
and dword [ebx], 0xfffeffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebx + 0x18], 0
sub esp, 0xc
test esi, esi
jne 0x6f249c24
test edi, edi
jne 0x6f249d40
mov dword [ebx + 0x18], 0
jmp 0x6f249c27
lea esp, [ebp - 0xc]
mov ecx, 0x106
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Untested_handling_of_huge_mmio_buffers___ld___64k__n
mov dword [esp + 8], str.MMIO_SetBuffer
mov dword [esp + 4], 0x6f2665c8
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_4
jmp 0x6f249bfd
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx + 0x18], eax
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6f249d7e
or dword [ebx], 0x10000
mov ecx, dword [ebp - 0x1c]
jmp 0x6f249c27
mov ecx, 0x102
jmp 0x6f249c53