MSHTML!CPasteCommand::ConvertBitmaptoPng( VOID* poBitmap, UINT uBitmapSize, BYTE[]** ppoPngImage, UINT* puPngImageSize): -50 STATSTG oStatStg { -50 00 04 LPOLESTR pwcsName; -4C 04 04 DWORD type; -48 08 08 ULARGE_INTEGER cbSize; -40 10 08 FILETIME mtime; -38 18 08 FILETIME ctime; -30 20 08 FILETIME atime; -28 28 04 DWORD grfMode; -24 2C 04 DWORD grfLocksSupported; -20 30 10 CLSID clsid; -10 34 04 DWORD grfStateBits; -0C 38 04 DWORD reserved; } size = 3C -54 CMemStm* poCMemStm -58 VOID* poWicBitmap -5C UCHAR[]* poPngImage (TSmartArray) -60 UINT uReadSize -64 BYTE[]** ppoPngImage -70 DWORD pPositionLow // lower DWORD of 64 bit position in stream. 6f3818fd 8bff mov edi,edi 6f3818ff 55 push ebp 6f381900 8bec mov ebp,esp 6f381902 83ec74 sub esp,74h 6f381905 a13c03436f mov eax,dword ptr [MSHTML!__security_cookie (6f43033c)] 6f38190a 33c5 xor eax,ebp 6f38190c 8945fc mov dword ptr [ebp-4],eax 6f38190f 8b4510 mov eax,dword ptr [ebp+10h] ppoPngImage = ppoPngImage 6f381912 8d4dac lea ecx,[ebp-54h] &poCMemStm = &poCMemStm 6f381915 53 push ebx //save reg 6f381916 8b5d14 mov ebx,dword ptr [ebp+14h] puPngImageSize = puPngImageSize 6f381919 56 push esi //save reg 6f38191a 8b7508 mov esi,dword ptr [ebp+8] poBitmap = poBitmap 6f38191d 57 push edi //save reg 6f38191e 33ff xor edi,edi = 0 6f381920 89459c mov dword ptr [ebp-64h],eax ppoPngImage = ppoPngImage 6f381923 897da8 mov dword ptr [ebp-58h],edi poWicBitmap = 0 poWicBitmap = 0 6f381926 897dac mov dword ptr [ebp-54h],edi poCMemStm = 0 poCMemStm = 0 6f381929 e8566827ff call 6e5f8184 pSmartStreamPointer = MSHTML!TSmartPointer< pSmartStreamPointer = &(TSmartPointer<...>(&poCMemStm)) Windows::Foundation::IAsyncOperation< Windows::Storage::Streams::IRandomAccessStream * > >::operator&( &poCMemStm) 6f38192e 50 push eax larg3 = pSmartStreamPointer 6f38192f 6a01 push 1 larg2 = 1 6f381931 57 push edi larg1 = 0 6f381932 ff1520c0426f call dword ptr [6f42c020] HRESULT hResult = combase!CreateStreamOnHGlobal( if (FAILED(hResult = combase!CreateStreamOnHGlobal(NULL, True, pSmartStreamPointer))) hGlobal = NULL, fDeleteOnRelease = True, ppstm = pSmartStreamPointer); 6f381938 8bf8 mov edi,eax hResult = hResult 6f38193a 85ff test edi,edi if (hResult < 0) 6f38193c 0f88b8000000 js 6f3819fa goto exit_label_1 goto exit_label_1; 6f381942 8b550c mov edx,dword ptr [ebp+0Ch] larg1 = uBitmapSize 6f381945 8d45a8 lea eax,[ebp-58h] &poWicBitmap = &(poWicBitmap) 6f381948 50 push eax larg3 = &poWicBitmap 6f381949 6860147a6e push 6e7a1460 larg2 = &GUID_ContainerFormatBmp 6f38194e 8bce mov ecx,esi larg1 = poBitmap 6f381950 e8c8325dff call 6e954c1d hResult = MSHTML!InitializeFromMemory( if (FAILED(hResult = InitializeFromMemory(poBitMap, uBitmapSize, &GUID_ContainerFormatBmp, &poWicBitmap))) poBitmap, uBitmapSize, &GUID_ContainerFormatBmp, &poWicBitmap); 6f381955 8bf8 mov edi,eax hResult = hResult 6f381957 85ff test edi,edi if (hResult < 0) 6f381959 0f889b000000 js 6f3819fa goto exit_label_1 goto exit_label_1; 6f38195f ff75ac push dword ptr [ebp-54h] larg3 = poCMemStm 6f381962 8b4da8 mov ecx,dword ptr [ebp-58h] larg1 = poWicBitmap 6f381965 ba24a4736e mov edx,6e73a424 larg2 = &GUID_ContainerFormatPng 6f38196a e8e4f6e6ff call 6f1f1053 hResult = MSHTML!WriteWicBitmapToStream( if (FAILED(hResult = WriteWicBitmapToStream(poWicBitmap, &GUID_ContainerFormatPng, poCMemStm))) poWicBitmap, &GUID_ContainerFormatPng, poCMemStm) 6f38196f 8bf8 mov edi,eax hResult = hResult 6f381971 85ff test edi,edi if (hResult < 0) 6f381973 0f8881000000 js 6f3819fa goto exit_label_1 goto exit_label_1; 6f381979 8b45ac mov eax,dword ptr [ebp-54h] poCMemStm = poCMemStm 6f38197c 8d55b0 lea edx,[ebp-50h] &oStatStg = &(oStatStg) 6f38197f 33f6 xor esi,esi 0 = 0 6f381981 56 push esi larg3 = 0 6f381982 52 push edx larg2 = &oStatStg 6f381983 8b08 mov ecx,dword ptr [eax] afVFTable = poCMemStm->afVFTable 6f381985 50 push eax larg1 = poCMemStm 6f381986 ff5130 call dword ptr [ecx+30h] hResult = poCMemStm->Stat(&oStatStg, 0) if (FAILED(hResult = poCMemStm->Stat(&oStatStg, 0))) 6f381989 8bf8 mov edi,eax hResult = hResult 6f38198b 85ff test edi,edi if (hResult < 0) 6f38198d 786b js 6f3819fa goto exit_label_1 goto exit_label_1; 6f38198f 8b45b8 mov eax,dword ptr [ebp-48h] uPngImageSize = oStatStg.cbSize.LowPart 6f381992 8d4da4 lea ecx,[ebp-5Ch] &poPngImage = &(poPngImage) 6f381995 ff750c push dword ptr [ebp+0Ch] uBitmapSize = uBitmapSize 6f381998 8903 mov dword ptr [ebx],eax *puPngImageSize = uPngImageSize *puPngImageSize = oStatStg.cbSize.LowPart 6f38199a 8975a4 mov dword ptr [ebp-5Ch],esi poPngImage = 0 ppoPngImage = NULL 6f38199d e8c34453ff call 6e8b5e65 MSHTML!TSmartArray::New( if (FAILED(hResult = poPngImage->New(uBitmapSize))) uBitmapSize) 6f3819a2 8bf8 mov edi,eax hResult = hResult 6f3819a4 85ff test edi,edi if (hResult >= 0) 6f3819a6 7905 jns 6f3819ad goto skip_1 free_and_exit_label_2: 6f3819a8 8b4da4 mov ecx,dword ptr [ebp-5Ch] poPngImage = poPngImage goto free_poPngImage_and_exit 6f3819ab eb48 jmp 6f3819f5 goto free_and_exit_label_1 skip_1: 6f3819ad 8b45ac mov eax,dword ptr [ebp-54h] poCMemStm = poCMemStm 6f3819b0 8d5590 lea edx,[ebp-70h] &pPositionLow = &(pPositionLow) 6f3819b3 52 push edx larg3.2 = &pPositionLow 6f3819b4 56 push esi larg3.1 = 0 6f3819b5 56 push esi larg2.2 = 0 6f3819b6 8b08 mov ecx,dword ptr [eax] afVFTable = poCMemStm->afVFTable 6f3819b8 56 push esi larg2.1 = 0 6f3819b9 50 push eax larg1 = poCMemStm 6f3819ba ff5114 call dword ptr [ecx+14h] hResult = poCMemStm->Seek( if (FAILED(hResult = poCMemStm->Seek(0, STREAM_SEEK_SET, NULL, &pPositionLow))) 0, STREAM_SEEK_SET, NULL, &pPositionLow) 6f3819bd 8bf8 mov edi,eax hResult = hResult 6f3819bf 85ff test edi,edi if (hResult < 0) 6f3819c1 78e5 js 6f3819a8 goto free_and_exit_label_2 goto free_poPngImage_and_exit 6f3819c3 8b45ac mov eax,dword ptr [ebp-54h] poCMemStm = poCMemStm 6f3819c6 8d55a0 lea edx,[ebp-60h] &uReadSize = &(uReadSize) 6f3819c9 8b75a4 mov esi,dword ptr [ebp-5Ch] poPngImage = poPngImage 6f3819cc 52 push edx larg4 = &uReadSize 6f3819cd ff33 push dword ptr [ebx] larg3 = *puPngImageSize 6f3819cf 8b08 mov ecx,dword ptr [eax] afVFTable = poCMemStm->afVFTable 6f3819d1 56 push esi larg2 = poPngImage 6f3819d2 50 push eax larg1 = 6f3819d3 ff510c call dword ptr [ecx+0Ch] hResult = poCMemStm->Read( if (FAILED(poCMemStm->Read(poPngImage, *puPngImageSize, &uReadSize))) poPngImage, ************** *puPngImageSize, &uReadSize) 6f3819d6 8bf8 mov edi,eax hResult = hResult 6f3819d8 85ff test edi,edi if (hResult >= 0) goto free_poPngImage_and_exit 6f3819da 7904 jns 6f3819e0 goto skip_label_2 6f3819dc goto free_and_exit_label_3 skip_label_2: 6f3819e0 8b03 mov eax,dword ptr [ebx] uPngInfoSize = *puPngImageSize 6f3819e2 3b45a0 cmp eax,dword ptr [ebp-60h] if (uPngInfoSize == uReadSize) if (uPngInfoSize != uReadSize) { 6f3819e5 7407 je 6f3819ee goto skip_label_3 6f3819e7 bfffff0080 mov edi,8000FFFFh hResult = 0x8000FFFF (Error: Catastrophic failure) hResult = 0x8000FFFF (Error: Catastrophic failure) 6f3819ec ebee jmp 6f3819dc goto free_and_exit_label_3 goto free_poPngImage_and_exit free_and_exit_label_3: } 6f3819dc 8bce mov ecx,esi poPngImage = poPngImage 6f3819de eb15 jmp 6f3819f5 goto free_and_exit_label_1 skip_label_3: 6f3819ee 8b459c mov eax,dword ptr [ebp-64h] ppoPngImage = ppoPngImage 6f3819f1 33c9 xor ecx,ecx poPngImage = NULL 6f3819f3 8930 mov dword ptr [eax],esi *ppoPngImage = poPngImage *ppoPngImage = poPngImage, poPngImage = NULL free_and_exit_label_1: free_poPngImage_and_exit: 6f3819f5 e881f620ff call 6e59107b MSHTML!ProcessHeapFree(poPngImage) ProcessHeapFree(poPngImage) exit_label_1: 6f3819fa 8d4dac lea ecx,[ebp-54h] &poCMemStm = &(poCMemStm) 6f3819fd e89f4b25ff call 6e5d65a1 MSHTML!SP::~SP( &poCMemStm) 6f381a02 8d4da8 lea ecx,[ebp-58h] &poWicBitmap = &(poWicBitmap) 6f381a05 e8974b25ff call 6e5d65a1 MSHTML!SP::~SP( &poWicBitmap) 6f381a0a 8b4dfc mov ecx,dword ptr [ebp-4] 6f381a0d 8bc7 mov eax,edi return hResult 6f381a0f 5f pop edi 6f381a10 5e pop esi 6f381a11 33cd xor ecx,ebp 6f381a13 5b pop ebx 6f381a14 e8f7f520ff call MSHTML!__security_check_cookie (6e591010) 6f381a19 8be5 mov esp,ebp 6f381a1b 5d pop ebp 6f381a1c c21000 ret 10h 6f381a1f 90 nop 6f381a20 90 nop 6f381a21 90 nop 6f381a22 90 nop 6f381a23 90 nop