joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006c671
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5d0d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.10050d26
test eax, eax
jne 0x1006c6ba
push 0x216
push str.filecore.cpp
call fcn.100b0670
test eax, eax
je 0x1006c6ba
int3
xor ecx, ecx
test ecx, ecx
jne 0x1006c692
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x1006c712
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [edx]
test eax, eax
je 0x1006c6f8
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.10051a15
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
jmp 0x1006c805
lea ecx, [ebp - 0x1c]
call fcn.100acad7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1006c818
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.100acc14
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1006c78a
lea ecx, [ebp - 0x1c]
call fcn.100acc14
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.10051a15
add esp, 8
mov dword [ebp - 0x274], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1006a0d0
mov eax, dword [ebp - 0x274]
jmp 0x1006c805
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x1006c79e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x1006c7e6
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
je 0x1006c7e6
mov ecx, dword [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x278], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1006a0d0
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1006df62
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x1006dfcd
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x1006dfcd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x1006dfcd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x1006dfcd
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x1006dfcd
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x1006dfcd
mov dword [ebp - 4], 1
jmp 0x1006dfd4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x1006f939
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
push 0x5e
push str.filest.cpp
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1006f210
push 0x21c
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10021ab0
add esp, 0xc
push 0x104
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.100acc14
push eax
mov edx, dword [ebp + 8]
add edx, 0x12
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0xffffffff
je 0x1006fac1
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1006f9b4
xor eax, eax
jmp 0x1006fac6
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0xffffffff
jne 0x1006f9d9
xor eax, eax
jmp 0x1006fac6
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.100acbf6
test eax, eax
je 0x1006f9f1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x10], 0
jmp 0x1006fa3a
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.100acc14
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x1006fa15
mov edx, dword [ebp + 8]
mov byte [edx + 0x10], 0
jmp 0x1006fa3a
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 0x10], cl
mov edx, dword [ebp - 0x1c]
and dl, 0
test edx, edx
je 0x1006fa3a
push 0x100f7dcc
push 0x100f7e64
call fcn.10051a15
add esp, 8
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.10050faf
push eax
mov ecx, dword [ebp + 8]
call fcn.100ad31a
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
call fcn.10050faf
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.100ad31a
push 0xffffffffffffffff
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.10050faf
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.100ad31a
mov ecx, dword [ebp + 8]
call fcn.100ad34c
test eax, eax
jne 0x1006faa0
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.100ad31a
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.100ad34c
test eax, eax
jne 0x1006fac1
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.100ad31a
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x10070ead
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.100b7782
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10070f06
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10070f20
push 0xeb
push str.dlgcore.cpp
call fcn.100b0670
test eax, eax
je 0x10070f20
int3
xor edx, edx
test edx, edx
jne 0x10070f06
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.10070f7b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.10018f60
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10071cce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x10071d21
call fcn.100b7782
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10071d34
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x10071dc8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x10071d7f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x10071d95
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x10071dbb
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x10071dbb
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x10071dbb
mov dword [ebp - 0x28], 1
jmp 0x10071dc2
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x10071dda
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x10071de3
mov ecx, dword [ebp - 4]
push ecx
call fcn.10018f60
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x10071df6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10071f8f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x10071fb2
push 0x339
push str.dlgcore.cpp
call fcn.100b0670
test eax, eax
je 0x10071fb2
int3
xor eax, eax
test eax, eax
jne 0x10071f98
call fcn.100b7782
mov dword [ebp - 8], eax
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1007201e
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x10072000
mov ecx, dword [ebp + 8]
push ecx
push 0x100f8e68
call fcn.10051a15
add esp, 8
jmp 0x10072017
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Cannot_find_dialog_template_with_IDD_0x_04X._n
call fcn.10051a15
add esp, 8
xor eax, eax
jmp 0x10072148
cmp dword [ebp + 0xc], 0
jne 0x1007202e
mov eax, 1
jmp 0x10072148
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10072061
push str.Warning:_LoadResource_failed_for_dialog_template._n
push 0x100f8f9c
call fcn.10051a15
add esp, 8
mov eax, 1
jmp 0x10072148
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 2]
cmp ecx, 0xffff
jne 0x1007208a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x10072092
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10018f60
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x14]
and edx, 0x10000000
test edx, edx
je 0x100720f4
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x100720d9
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Dialog_named__s_must_be_invisible._n
call fcn.10051a15
add esp, 8
jmp 0x100720f0
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Dialog_with_IDD_0x_04X_must_be_invisible._n
call fcn.10051a15
add esp, 8
xor eax, eax
jmp 0x10072148
mov eax, dword [ebp - 0x14]
and eax, 0x40000000
test eax, eax
jne 0x10072143
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
test ecx, ecx
je 0x10072129
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Dialog_named__s_must_have_the_child_style._n
call fcn.10051a15
add esp, 8
jmp 0x1007213f
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push str.ERROR:_Dialog_with_IDD_0x_04X_must_have_the_child_style._n
call fcn.10051a15
add esp, 8
xor eax, eax
jmp 0x10072148
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1007411e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1007414f
push 0x432
push str.wincore.cpp
call fcn.100b0670
test eax, eax
je 0x1007414f
int3
xor edx, edx
test edx, edx
jne 0x1007412a
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x1007419b
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1006aa3d
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.1006a9c7
jmp 0x100741b3
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [edx]
call dword [eax + 0x90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10077a11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x10077a9d
call fcn.100b7782
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10077a9d
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10077a70
xor eax, eax
jmp 0x10077ace
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10077a97
push 0xcba
push str.wincore.cpp
call fcn.100b0670
test eax, eax
je 0x10077a97
int3
xor edx, edx
test edx, edx
jne 0x10077a7d
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.10077ad7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x10077acb
cmp dword [ebp - 8], 0
je 0x10077acb
mov ecx, dword [ebp - 8]
push ecx
call fcn.10018f60
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10085920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
cmp dword [0x101082c8], 0
je 0x1008593c
mov eax, dword [0x1010a0f8]
jmp 0x10085a80
mov dword [0x101082c8], 1
xor eax, eax
mov ax, word [0x1010a0f4]
test eax, eax
jne 0x1008597f
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x1010a0f0], eax
cmp dword [0x1010a0f0], 0
jne 0x10085976
mov word [0x1010a0f4], 1
jmp 0x1008597f
mov word [0x1010a0f4], 2
xor ecx, ecx
mov cx, word [0x1010a0f4]
cmp ecx, 2
jne 0x100859da
mov dword [ebp - 4], 0
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100859da
cmp dword [0x1010a0f0], 0
je 0x100859da
push 0
push 0
mov edx, dword [0x1010a0f0]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x1010a0f8], eax
mov eax, dword [0x1010a0f8]
jmp 0x10085a80
mov dword [0x1010a0f8], 3
cmp dword [0x10109ee4], 0
jne 0x10085a61
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.Control_PanelDesktop
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10085a5f
mov dword [ebp - 0x110], 0x80
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push str.WheelScrollLines
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10085a55
push 0xa
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1002aa40
add esp, 0xc
mov dword [0x1010a0f8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10085a7b
cmp dword [0x10109ee0], 0
jne 0x10085a7b
push 0
push 0x1010a0f8
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [0x1010a0f8]
mov esp, ebp
pop ebp
ret

Function at 0x10088f60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.100acc14
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x10088fb6
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x10088fb4
push str.Warning:_File_save_with_new_name_failed._n
push 0x10103474
call fcn.10051a15
add esp, 8
xor eax, eax
jmp 0x10088ff1
jmp 0x10088fec
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.100acc14
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x10088fec
push str.Warning:_File_save_failed._n
push 0x101034b4
call fcn.10051a15
add esp, 8
xor eax, eax
jmp 0x10088ff1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10098457
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10098060
mov dword [ebp - 0x48], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x100984b6
push 0x20
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.100981f4
test eax, eax
jne 0x100984b4
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.100959f9
mov ecx, dword [ebp + 8]
call fcn.1009817f
jmp 0x100984d5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.100847a5
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x10098b45
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.100980ae
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10098bbe
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x10098b95
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.1006aa3d
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10098bb2
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.1006a88b
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.1006a9c7
jmp 0x10098bef
mov ecx, dword [ebp + 0x10]
call fcn.100acc14
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x10098bef
mov ecx, dword [ebp + 0x10]
call fcn.100acc14
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.100847a5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1009df8e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x1009dfb2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x1009dfec
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1009e006
push 0xc9
push str.dlgprop.cpp
call fcn.100b0670
test eax, eax
je 0x1009e006
int3
xor eax, eax
test eax, eax
jne 0x1009dfec
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x1009e0e1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x1009e0b1
push 0x100fa09c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1009e05e
push 0xe1
push str.dlgprop.cpp
call fcn.100b0670
test eax, eax
je 0x1009e05e
int3
xor ecx, ecx
test ecx, ecx
jne 0x1009e044
cmp dword [ebp - 0x18], 0
je 0x1009e0af
push 0x100fa0b8
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1009e0a5
mov eax, 1
test eax, eax
je 0x1009e09f
push 0xe6
push str.dlgprop.cpp
call fcn.100b0670
test eax, eax
je 0x1009e09f
int3
xor ecx, ecx
test ecx, ecx
jne 0x1009e082
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1009e0e1
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x1009e0e1
mov ecx, 1
test ecx, ecx
je 0x1009e0db
push 0xed
push str.dlgprop.cpp
call fcn.100b0670
test eax, eax
je 0x1009e0db
int3
xor edx, edx
test edx, edx
jne 0x1009e0be
call fcn.100c7293
cmp dword [eax + 0x2038], 0
je 0x1009e0fe
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.1009df43
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1009de05
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x1009e12e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x1009e143
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8