joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100022ff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x58]
call sub.MFC42.DLL_CWnd::SetFocus
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x64], 0
je 0x10002340
mov ecx, dword [ebp - 0x58]
xor edx, edx
cmp dword [ecx + 0x118], 0
sete dl
mov eax, dword [ebp - 0x58]
mov dword [eax + 0x118], edx
push 1
mov ecx, dword [ebp - 0x58]
call fcn.10001970
jmp 0x10002453
mov ecx, dword [ebp - 0x58]
cmp dword [ecx + 0x94], 0
je 0x100023fb
lea ecx, [ebp - 0x14]
call sym.STools.dll_public:_class_CFPoint_const____thiscall_CFCoor::GetOrigin_void_const
lea ecx, [ebp - 0x14]
call fcn.100017a0
push eax
mov ecx, dword [ebp - 0x58]
call fcn.10004c30
mov edx, dword [ebp - 0x58]
mov dword [edx + 0x90], 1
push 1
mov ecx, dword [ebp - 0x58]
call fcn.10001970
push 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x94]
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x18], eax
push 0
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x8c]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x182
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x90], 0
push 1
mov ecx, dword [ebp - 0x58]
call fcn.10001970
cmp dword [ebp - 4], 0
je 0x100023f9
push 0
mov edx, dword [ebp - 4]
and edx, 0xffff
push edx
push 0x111
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x8c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x10002453
mov edx, dword [ebp - 0x58]
add edx, 0x120
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jbe 0x10002453
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x400
mov dword [ebp - 0x48], 0x10055034
mov ecx, dword [ebp - 0x58]
add ecx, 0x120
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], 3
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10004ebc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005688c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
jne 0x10004efa
push 0
push 0x3c0010
push 0x10004e40
mov edx, dword [ebp - 4]
add edx, 4
push edx
call sub.USER32.dll_DdeInitializeA
test eax, eax
je 0x10004efa
xor eax, eax
jmp 0x10004f54
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10004f49
push 0
push 0x1005686c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call sub.USER32.dll_DdeCreateStringHandleA
mov dword [ebp - 8], eax
push 0
push 0x1005503c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call sub.USER32.dll_DdeCreateStringHandleA
mov dword [ebp - 0xc], eax
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call sub.USER32.dll_DdeConnect
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
xor eax, eax
cmp dword [edx], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x10005052
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1005688c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0
je 0x10005078
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x1000507c
xor eax, eax
jmp 0x100050b7
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push 0x4050
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.dll_DdeClientTransaction
test eax, eax
jne 0x100050b2
xor eax, eax
jmp 0x100050b7
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000ea0f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x10055408
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000ea96
mov ecx, dword [ebp - 8]
push ecx
push 5
push 1
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
movsx eax, byte [ebp - 0x10]
cmp eax, 0x7b
jne 0x1000ea82
movsx ecx, byte [ebp - 0xf]
cmp ecx, 0x5c
jne 0x1000ea82
movsx edx, byte [ebp - 0xe]
cmp edx, 0x72
jne 0x1000ea82
movsx eax, byte [ebp - 0xd]
cmp eax, 0x74
jne 0x1000ea82
movsx ecx, byte [ebp - 0xc]
cmp ecx, 0x66
jne 0x1000ea82
mov dword [ebp - 4], 1
jmp 0x1000ea89
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000ea9d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100376bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x240
mov eax, dword [sym.imp.JsTools3D.dll_class_CString_G_strWorkPath]
mov ecx, dword [eax]
push ecx
push str._slztmp.rtf
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1000eb51
lea ecx, [ebp - 0x248]
call sub.JsTools3D.dll_public:_void___thiscall_CRTF::constructor_void_
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x248]
call sub.JsTools3D.dll_public:_int___thiscall_CRTF::Open_char__
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x248]
call sub.JsTools3D.dll_public:_int___thiscall_CRTF::TransInTextFile_char__
lea ecx, [ebp - 0x248]
call sub.JsTools3D.dll_public:_void___thiscall_CRTF::Close_void_
mov dword [ebp - 0x24c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call sub.JsTools3D.dll_public:_void___thiscall_CRTF::destructor_void_
mov eax, dword [ebp - 0x24c]
jmp 0x1000eb53
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000fe19
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10037881
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x410
mov dword [ebp - 0x40c], ecx
lea ecx, [ebp - 0x3f8]
call fcn.10035eca
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x3fc]
push eax
mov ecx, dword [ebp - 0x40c]
mov ecx, dword [ecx + 0x1894]
mov edx, dword [ebp - 0x40c]
mov eax, dword [edx + 0x1894]
mov edx, dword [eax]
call dword [edx + 0xe4]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x410]
call dword [edx + 0x14]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::operator_2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3fc]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x3f8]
push edx
mov eax, dword [sym.imp.JsTools3D.dll_class_CString_G_strWorkPath]
mov ecx, dword [eax]
push ecx
push 0x10055494
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [sym.imp.JsTools3D.dll_class_CString_G_strWorkPath]
mov ecx, dword [eax]
push ecx
push str._stb50.tmp
lea edx, [ebp - 0x3f4]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x3f4]
push eax
mov ecx, dword [ebp - 0x40c]
mov ecx, dword [ecx + 0x1894]
mov edx, dword [ebp - 0x40c]
mov eax, dword [edx + 0x1894]
mov edx, dword [eax]
call dword [edx + 0xe4]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x41c]
call dword [edx + 0x2c]
lea eax, [ebp - 0x200]
push eax
call sub.JsTools3D.dll_int___cdecl_if_file_exist_char__
add esp, 4
test eax, eax
jne 0x1000ff8f
lea ecx, [ebp - 0x3f4]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov dword [ebp - 0x400], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x400]
jmp 0x1001000f
lea edx, [ebp - 0x3f4]
push edx
lea eax, [ebp - 0x200]
push eax
call sub.JsTools3D.dll_int___cdecl_FileCompare_char___char__
add esp, 8
test eax, eax
jne 0x1000ffdd
lea ecx, [ebp - 0x3f4]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov dword [ebp - 0x404], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x404]
jmp 0x1001000f
lea edx, [ebp - 0x3f4]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov dword [ebp - 0x408], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001001d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100378a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
mov dword [ebp - 0x408], ecx
lea ecx, [ebp - 0x3f8]
call fcn.10035eca
mov dword [ebp - 4], 0
push str.tb50.tmp
mov eax, dword [sym.imp.JsTools3D.dll_class_CString_G_strWorkPath]
mov ecx, dword [eax]
push ecx
push 0x100554b8
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x408]
mov ecx, dword [ecx + 0x1894]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + 0x1894]
mov edx, dword [eax]
call dword [edx + 0xe4]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40c]
call dword [edx + 0x2c]
push 0
lea eax, [ebp - 0x3fc]
push eax
mov ecx, dword [ebp - 0x408]
mov ecx, dword [ecx + 0x1894]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + 0x1894]
mov edx, dword [eax]
call dword [edx + 0xe4]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x410]
call dword [edx + 0x14]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::operator_2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3fc]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x3f8]
push edx
mov eax, dword [sym.imp.JsTools3D.dll_class_CString_G_strWorkPath]
mov ecx, dword [eax]
push ecx
push 0x100554c0
lea edx, [ebp - 0x3f4]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x3f4]
push eax
call sub.JsTools3D.dll_int___cdecl_if_file_exist_char__
add esp, 4
test eax, eax
je 0x100101af
lea ecx, [ebp - 0x3f4]
push ecx
lea edx, [ebp - 0x200]
push edx
call sub.JsTools3D.dll_int___cdecl_FileCompare_char___char__
add esp, 8
test eax, eax
jne 0x100101af
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov dword [ebp - 0x400], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x400]
jmp 0x100101e1
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov dword [ebp - 0x404], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100130d5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov dword [ebp - 0x4ac], ecx
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 5
mov ecx, dword [sym.imp.JsTools3D.dll_class_CString_G_strExePath]
mov edx, dword [ecx]
push edx
push str._sTbSet.exe
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x2a4], ecx
push str.TbSet.exe_1
lea edx, [ebp - 0x29c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a0], eax
lea ecx, [ebp - 0x2b4]
push ecx
lea edx, [ebp - 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x2a0]
push eax
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100131e0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x2b4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [sym.imp.JsTools3D.dll_class_CString_G_strExePath]
mov ecx, dword [eax]
push ecx
push 0x100558a4
lea edx, [ebp - 0x4a8]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x4a8]
push eax
mov ecx, dword [sym.imp.JsTools3D.dll_class_CTbEnv_G_TbEnv]
call sub.JsTools3D.dll_public:_int___thiscall_CTbEnv::LoadData_char_const__
mov ecx, dword [ebp - 0x4ac]
mov ecx, dword [ecx + 0x1894]
mov edx, dword [ebp - 0x4ac]
mov eax, dword [edx + 0x1894]
mov edx, dword [eax]
call dword [edx + 0xe0]
mov esp, ebp
pop ebp
ret

Function at 0x10014056
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov dword [ebp - 0x2bc], ecx
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 5
mov ecx, dword [sym.imp.JsTools3D.dll_class_CString_G_strExePath]
mov edx, dword [ecx]
push edx
push str._sLzXuanJin.exe
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x2a8], ecx
push str.LzXuanJin.exe
lea edx, [ebp - 0x29c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a0], eax
lea ecx, [ebp - 0x2b8]
push ecx
lea edx, [ebp - 0x44]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x2a0]
push eax
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x2a4], eax
mov esp, ebp
pop ebp
ret
Function at 0x10024d4a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038d97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.10035eca
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 1
jmp 0x10024d94
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf4240
jge 0x10024ddd
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s_04d
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
call sym.STools.dll_public:_class_CSheJiDataItem____thiscall_CSheJiData::GetItemByFileName_class_CString_
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10024ddb
jmp 0x10024ddd
jmp 0x10024d8b
push 0x18
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x24], 0
je 0x10024e01
mov ecx, dword [ebp - 0x24]
call sym.STools.dll_public:_void___thiscall_CSheJiDataItem::constructor_void_
mov dword [ebp - 0x3c], eax
jmp 0x10024e08
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 4
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x30
call fcn.10027420
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp + 0xc]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x30]
call sym.STools.dll_public:_int___thiscall_CSheJiData::AddCurID_class_CString_
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [ebp - 0x2c]
or ecx, 1
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10025415
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038ec5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x200
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push 0x1ea
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x10]
call fcn.10035eca
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x204]
push eax
push str._sTB50__d.CMD
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp - 0x208]
or al, 1
mov dword [ebp - 0x208], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x100254be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x200], ecx
lea eax, [ebp - 0x1fc]
push eax
mov ecx, dword [ebp - 0x200]
call sym.STools.dll_public:_class_CString___thiscall_CRunCmd::GetFileName_void_
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
mov edx, dword [ecx]
push edx
push 0x10055d10
lea eax, [ebp - 0x1f4]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x1fc]
call sub.MFC42.DLL_CString::CString
push 0x10055d14
lea ecx, [ebp - 0x1f4]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jne 0x10025539
xor eax, eax
jmp 0x1002560e
push 1
mov edx, dword [ebp - 0x200]
add edx, 4
push edx
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_LoadOneCString_struct__iobuf___class_CString___int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x200]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x1f8]
push edx
call sub.JsTools3D.dll_int___cdecl_LoadOneCString_struct__iobuf___class_CString___int_
add esp, 0xc
push 1
mov eax, dword [ebp - 0x200]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x1f8]
push ecx
call sub.JsTools3D.dll_int___cdecl_LoadOneCString_struct__iobuf___class_CString___int_
add esp, 0xc
push 1
mov edx, dword [ebp - 0x200]
add edx, 0x10
push edx
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_LoadOneCString_struct__iobuf___class_CString___int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x200]
add ecx, 0x14
push ecx
mov edx, dword [ebp - 0x1f8]
push edx
call sub.JsTools3D.dll_int___cdecl_LoadOneCString_struct__iobuf___class_CString___int_
add esp, 0xc
push 1
mov eax, dword [ebp - 0x200]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x1f8]
push ecx
call sub.JsTools3D.dll_int___cdecl_LoadOneCString_struct__iobuf___class_CString___int_
add esp, 0xc
mov edx, dword [ebp - 0x1f8]
push edx
push 1
push 4
mov eax, dword [ebp - 0x200]
add eax, 0x18
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, dword [ebp - 0x1f8]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10025612
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x1fc]
push eax
mov ecx, dword [ebp - 0x218]
call sym.STools.dll_public:_class_CString___thiscall_CRunCmd::GetFileName_void_
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx]
push edx
push 0x10055d18
lea eax, [ebp - 0x1f4]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x1fc]
call sub.MFC42.DLL_CString::CString
push 0x10055d1c
lea ecx, [ebp - 0x1f4]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jne 0x1002568d
xor eax, eax
jmp 0x100257e4
push 1
mov edx, dword [ebp - 0x218]
add edx, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x200], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_SaveOneCString_struct__iobuf___class_CString__int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x218]
add ecx, 8
push ecx
mov edx, esp
mov dword [ebp - 0x204], esp
push ecx
mov ecx, edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_SaveOneCString_struct__iobuf___class_CString__int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x218]
add ecx, 0xc
push ecx
mov edx, esp
mov dword [ebp - 0x208], esp
push ecx
mov ecx, edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_SaveOneCString_struct__iobuf___class_CString__int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x218]
add ecx, 0x10
push ecx
mov edx, esp
mov dword [ebp - 0x20c], esp
push ecx
mov ecx, edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_SaveOneCString_struct__iobuf___class_CString__int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x218]
add ecx, 0x14
push ecx
mov edx, esp
mov dword [ebp - 0x210], esp
push ecx
mov ecx, edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_SaveOneCString_struct__iobuf___class_CString__int_
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x218]
add ecx, 0x1c
push ecx
mov edx, esp
mov dword [ebp - 0x214], esp
push ecx
mov ecx, edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x1f8]
push eax
call sub.JsTools3D.dll_int___cdecl_SaveOneCString_struct__iobuf___class_CString__int_
add esp, 0xc
mov ecx, dword [ebp - 0x1f8]
push ecx
push 1
push 4
mov edx, dword [ebp - 0x218]
add edx, 0x18
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 0x1f8]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret