joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017cc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x100181e0
test edx, edx
je 0x100181e0
call fcn.10017cd7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10018220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10017cc0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10018291
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10018256
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x10018ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x10018c24
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x10018bfc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x10018c04
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.10018c29
Function at 0x10023a50
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10023b30
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x102966d4]
mov ebx, eax
push dword [0x102966d8]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp byte [edi + 0x20], 0
mov dword [ebp - 0x18], eax
je 0x10023ad7
push ebx
mov ecx, edi
call fcn.10023b50
push dword [edi + 0x64]
push edi
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push ebx
mov ecx, edi
call fcn.10023c30
push ebx
mov ecx, edi
call fcn.10023cf0
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.10047989
mov ecx, dword [edi + 4]
add esp, 4
mov edx, dword [edi]
mov eax, dword [edi + 0xc]
sub eax, ecx
push 0xcc0020
push ecx
push edx
push ebx
push eax
mov eax, dword [edi + 8]
sub eax, edx
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push ebx
call esi
push dword [ebp - 0x20]
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004338a
mov esp, ebp
pop ebp
ret
Function at 0x10025460
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x10282598]
mov ebx, edx
push edi
mov dword [ebp - 0x10], ecx
mov esi, dword [eax + esi*4]
mov eax, dword [0x10296708]
cmp eax, dword [esi + 4]
jg 0x10025584
mov al, byte [0x10296714]
test al, al
jne 0x1002553a
mov al, 1
mov ecx, 0x10296714
xchg byte [ecx], al
lea eax, [ebp - 4]
push eax
push str.ntdll.dll
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x100254c2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.100b7336
add esp, 4
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push str.ntdll.dll
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10255f54
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1002552f
cmp dword [ebp - 8], 0x34
jb 0x1002552f
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + 0xc]
mov word [0x10296706], ax
movzx eax, word [ecx + 0xe]
mov word [0x10296704], ax
movzx eax, word [ecx + 8]
mov word [0x10296702], ax
movzx eax, word [ecx + 0xa]
mov ecx, 0x1029670c
mov word [0x10296700], ax
mov al, 1
xchg byte [ecx], al
push esi
call fcn.100b7331
add esp, 4
jmp 0x10025547
mov al, byte [0x1029670c]
test al, al
je 0x100254b9
mov ecx, dword [ebp + 0xc]
movzx eax, word [0x10296706]
pop edi
pop esi
mov word [ecx], ax
mov ecx, dword [ebp + 8]
movzx eax, word [0x10296704]
mov word [ecx], ax
movzx eax, word [0x10296702]
mov ecx, dword [ebp - 0x10]
mov word [ebx], ax
movzx eax, word [0x10296700]
pop ebx
mov word [ecx], ax
mov eax, 1
mov esp, ebp
pop ebp
ret
push 0x10296708
call fcn.10043500
add esp, 4
cmp dword [0x10296708], 0xffffffff
jne 0x1002548e
push 0x10296708
mov byte [0x10296714], 0
mov byte [0x1029670c], 0
call fcn.100434c1
add esp, 4
jmp 0x1002548e
Function at 0x10027e50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xffffffffffffffff
push str.btn_arrow
call fcn.10058b23
mov esi, eax
test esi, esi
je 0x10027e80
mov edx, dword [esi]
mov ecx, esi
push str.comradio
call dword [edx + 4]
test eax, eax
je 0x10027e80
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x10027e93
call fcn.1004f683
mov esi, eax
jmp 0x10027e95
xor esi, esi
push ebx
push edi
push 0x2801
call fcn.100b7336
push 0x5002
mov edi, eax
call fcn.100b7336
push 0xffffffffffffffff
push str.btn_arrow
push str.comradio
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
mov ebx, eax
push 0x2800
push ebx
call fcn.10026770
add esp, 0x24
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp - 4]
cmp eax, 0x2800
jge 0x10027f0c
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
mov byte [eax + edi], 0
push ebx
call fcn.100b7331
add esp, 4
test esi, esi
je 0x10027f62
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x10027f62
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x2801
call fcn.100b7336
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.100267d0
add esp, 0x24
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10027fc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10058b23
mov esi, eax
test esi, esi
je 0x10027ff1
mov edx, dword [esi]
mov ecx, esi
push str.radio
call dword [edx + 4]
test eax, eax
je 0x10027ff1
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x10028004
call fcn.1004f683
mov esi, eax
jmp 0x10028006
xor esi, esi
push 0x2801
call fcn.100b7336
add esp, 4
mov edi, eax
push 0x5002
call fcn.100b7336
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp + 8]
push str.radio
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10026770
add esp, 0x1c
mov dword [ebp + 8], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp eax, 0x2800
jge 0x1002807f
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 8]
mov byte [eax + edi], 0
push ebx
call fcn.100b7331
add esp, 4
test esi, esi
je 0x100280d4
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x100280d4
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2801
call fcn.100b7336
add esp, 4
mov esi, eax
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.100267d0
add esp, 0x20
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x1002cb70
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e265d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10271304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CScreenMainFrame.0
lea eax, [ebx + 0x20]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x14], ebx
jb 0x1002cbdb
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebx + 0x38]
mov dword [ebp - 4], ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x1002cbf8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebx + 0x54]
call fcn.1002f2d0
lea ecx, [ebx + 0x12c]
call fcn.10023960
push 0x10255ff8
push 0x20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [ebx + 0x1a0], eax
mov byte [ebp - 4], 3
lea ecx, [ebx + 0x1f0]
mov dword [ebx + 0x1e0], 1
mov dword [ebx + 0x1e4], 0
mov dword [ebx + 0x1e8], 0
mov dword [ebx + 0x1ec], 0
call fcn.10033440
mov byte [ebp - 4], 4
push 0x102966e8
mov dword [ebx + 4], 0
mov dword [ebx + 0x1b0], 0
mov dword [ebx + 0x1ac], 0
mov dword [ebx + 0x1a8], 0
mov dword [ebx + 0x1a4], 0
call fcn.100481ba
mov eax, dword [0x102966dc]
add esp, 4
mov dword [0x102966e0], eax
push 0
push 0x10031da0
call dword [sym.imp.USER32.dll_EnumWindows]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, eax
call fcn.10031c90
call dword [sym.imp.USER32.dll_GetCursor]
push str.IDC_CURSOR1
push dword [0x10296654]
mov dword [ebx + 0x1d0], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebx + 0x1d4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebx + 0x1b4]
mov dword [ebx + 8], 0
push esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
call fcn.10047989
add esp, 4
mov ecx, ebx
call fcn.1002d840
movups xmm1, xmmword [esi]
mov edi, eax
movups xmm2, xmmword [esi]
mov dword [ebx + 0x1c4], edi
movaps xmm0, xmm1
psrldq xmm1, 4
psrldq xmm0, 0xc
movd ecx, xmm0
movaps xmm0, xmm2
movd eax, xmm1
psrldq xmm0, 8
sub ecx, eax
push ecx
movd edx, xmm0
movd ecx, xmm2
sub edx, ecx
push edx
push edi
call fcn.1002da40
mov dword [ebx + 0x1c8], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d900
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x1002d928
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
push edi
mov dword [ebp - 0x28], edi
call esi
mov edx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0xc], ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
sub edx, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 0xc]
sub eax, ecx
push eax
push edx
push edi
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 4], eax
call edi
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push ebx
mov dword [ebp - 0x20], ebx
call esi
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], esi
movups xmm1, xmmword [eax + 0x1b4]
movups xmm2, xmmword [eax + 0x1b4]
movaps xmm0, xmm1
psrldq xmm1, 4
psrldq xmm0, 0xc
movd ecx, xmm0
movaps xmm0, xmm2
movd eax, xmm1
psrldq xmm0, 8
movd edx, xmm0
sub ecx, eax
movd eax, xmm2
push ecx
sub edx, eax
push edx
push ebx
call edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push ebx
push esi
call edi
mov ecx, dword [ebp - 8]
push esi
call fcn.1002d780
push 0xcc0020
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
push dword [ebp - 4]
mov esi, dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x1c]
push esi
call edi
push dword [ebp - 0x20]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, eax
call esi
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x28]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002dfd0
Capabilities:
Get common file path
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e2790
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [ebp - 0x21c], ax
jne 0x1002e03f
xor ecx, ecx
jmp 0x1002e05f
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e050
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.100229b0
push 0xc
push str.snapshot.png
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.1002c2c0
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
push edi
call fcn.1002e1b0
mov esi, dword [sym.imp.USER32.dll_EmptyClipboard]
call esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1002e0cb
call esi
push edi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0x102966f0]
test eax, eax
jne 0x1002e0ff
push 0x520
call fcn.10043366
add esp, 4
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1002e0f8
mov ecx, eax
call fcn.100259f0
jmp 0x1002e0fa
xor eax, eax
mov dword [0x102966f0], eax
mov esi, dword [eax + 0x444]
mov eax, dword [ebx + 0xd4]
mov dword [ebp - 0x244], eax
mov eax, dword [ebx + 0xd8]
mov dword [ebp - 0x240], eax
mov eax, dword [ebx + 0xdc]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebx + 0xe0]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x24c]
sub eax, dword [ebp - 0x254]
push eax
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x250]
push eax
push 0x552
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x220]
cmp eax, 8
jb 0x1002e18d
inc eax
lea ecx, [ebp - 0x234]
push eax
push dword [ebp - 0x234]
call fcn.10022ff0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret 4
Function at 0x1002ec90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e2986
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100aeaa0
push 0
call fcn.100b7670
mov dword [ebp - 0x420], eax
xor edx, edx
lea eax, [ebp - 0x420]
mov dword [ebp - 0x41c], edx
push eax
call fcn.100b793c
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x218]
push str._d_.2d_.2d_.2d_.2d_.2d
push eax
call fcn.10023900
xor eax, eax
mov dword [ebp - 0x42c], 7
add esp, 0x34
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], ax
cmp word [ebp - 0x218], ax
je 0x1002ed5f
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002ed50
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x440]
call fcn.100229b0
push 4
push str..png
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0
call fcn.1002c2c0
push 0
push 0x10
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
cmovae eax, dword [ebp - 0x440]
push eax
lea eax, [ebp - 0x418]
push eax
sub esp, 8
lea eax, [ebp - 0x458]
push eax
call fcn.1002e490
mov byte [ebp - 4], 1
mov eax, dword [esi + 0xd4]
mov dword [ebp - 0x428], eax
mov eax, dword [esi + 0xd8]
mov dword [ebp - 0x424], eax
mov eax, dword [esi + 0xdc]
mov dword [ebp - 0x420], eax
mov eax, dword [esi + 0xe0]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x468]
mov ecx, esi
push eax
call fcn.1002d900
cmp dword [ebp - 0x444], 8
lea edx, [ebp - 0x458]
cmovae edx, dword [ebp - 0x458]
push edx
push eax
call fcn.1002e1b0
mov ecx, esi
call fcn.1002eb40
mov eax, dword [ebp - 0x444]
cmp eax, 8
jb 0x1002ee5f
inc eax
lea ecx, [ebp - 0x458]
push eax
push dword [ebp - 0x458]
call fcn.10022ff0
xor eax, eax
mov dword [ebp - 0x444], 7
mov word [ebp - 0x458], ax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x448], 0
cmp eax, 8
jb 0x1002ee9a
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.10022ff0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
Function at 0x10033820
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push str.text_content
call fcn.10058b23
mov esi, eax
test esi, esi
je 0x10033854
mov edx, dword [esi]
mov ecx, esi
push str.comedit
call dword [edx + 4]
test eax, eax
je 0x10033854
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x10033867
call fcn.1004f683
mov esi, eax
jmp 0x10033869
xor esi, esi
push 0x2801
call fcn.100b7336
add esp, 4
mov edi, eax
push 0x5002
call fcn.100b7336
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push str.text_content
push str.comedit
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10026770
add esp, 0x1c
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp - 4]
cmp eax, 0x2800
jge 0x100338e4
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
mov byte [eax + edi], 0
push ebx
call fcn.100b7331
add esp, 4
test esi, esi
je 0x1003393a
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x1003393a
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x2801
call fcn.100b7336
add esp, 4
mov esi, eax
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.100267d0
add esp, 0x20
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8