joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102b33b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x20
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x102b3c6
mov eax, dword [ebp + 8]
mov word [esi], ax
cmp eax, 1
je 0x102b3ce
cmp eax, 2
je 0x102b41e
push 0x106
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call edi
push str.Illegal_case
call edi
push 0x104c08c
call edi
test esi, esi
je 0x102b3c6
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
push 1
push esi
push dword [ebp + 0xc]
call fcn.01013830
mov dword [esi + 0x14], eax
test eax, eax
jne 0x102b416
push 0xef
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call edi
push str.Null_App_Pitem
jmp 0x102b39f
mov eax, dword [eax + 0xb8]
jmp 0x102b475
push 1
push esi
push dword [ebp + 0xc]
call fcn.010154b0
mov dword [esi + 0x14], eax
test eax, eax
jne 0x102b46f
push 0xfd
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call edi
push str.Null_App_Pitem
call edi
push 0x104c08c
call edi
jmp 0x102b478
mov eax, dword [eax + 0x12c]
mov dword [esi + 0x10], eax
push dword [ebp + 0xc]
push esi
call fcn.0102b9e7
push esi
push 4
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, esi
jmp 0x102b3c8
Function at 0x102b494
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ecx, dword [esp + 8]
movzx eax, word [ecx]
mov ebp, esp
cmp eax, 1
push esi
je 0x102b4ae
cmp eax, 2
je 0x102b514
jmp 0x102b579
push 0
push ecx
call fcn.0102c0f1
mov esi, dword [eax + 0xb8]
push eax
call fcn.01013bf0
call fcn.01022760
test eax, eax
je 0x102b579
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x102b579
push 0x13a
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.CItem_not_destroyed
jmp 0x102b570
push 0
push ecx
call fcn.0102c124
mov esi, dword [eax + 0x12c]
push eax
call fcn.01015880
call fcn.01015c30
test eax, eax
je 0x102b579
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x102b579
push 0x148
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.SItem_not_destroyed
call esi
push 0x104c08c
call esi
pop esi
pop ebp
ret 4
Function at 0x102b5c8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [0x1056c80]
push 0x20
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x102b6b6
push 1
mov eax, dword [0x1056c80]
push 0x10
mov ecx, dword [ebp + 8]
push eax
push str.APPITEM
push dword [ecx + 0xc0]
call fcn.010360d3
test eax, eax
jne 0x102b698
mov ax, word [edi]
mov ecx, 0xffffffff
mov word [ebx], ax
add edi, 2
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebx + 2]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 8]
push ebx
call fcn.0102dd92
test eax, eax
jne 0x102b698
movzx eax, word [ebx]
cmp eax, 1
je 0x102b6bf
cmp eax, 2
je 0x102b6ea
push 0x1bc
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Illegal_case
call esi
push 0x104c08c
call esi
test ebx, ebx
je 0x102b6b6
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0
push ebx
push dword [ebp + 8]
call fcn.01013830
mov dword [ebx + 0x14], eax
lea eax, [ebx + 2]
push eax
push dword [ebp + 8]
push dword [ebx + 0x14]
call fcn.0103f733
lea edx, [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov esi, dword [ecx + 0xb8]
jmp 0x102b713
push 0
push ebx
push dword [ebp + 8]
call fcn.010154b0
mov dword [ebx + 0x14], eax
lea eax, [ebx + 2]
push eax
push dword [ebp + 8]
push dword [ebx + 0x14]
call fcn.0103f904
lea edx, [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov esi, dword [ecx + 0x12c]
mov dword [edx], esi
test eax, eax
jne 0x102b6b6
push ebx
push 4
push dword [edx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, ebx
jmp 0x102b6b8
Function at 0x102b728
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
jne 0x102b77d
push 0x1f2
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Null_App_Pitem
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov cx, word [esi]
cmp cx, 1
jne 0x102b78c
mov eax, dword [esi + 0x14]
mov edi, dword [eax + 0x3c]
cmp dword [ebp + 0x14], 0
jne 0x102b7dd
cmp cx, 1
jne 0x102b7dd
push 1
lea eax, [esi + 2]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
call fcn.01037355
test eax, eax
jge 0x102b7b9
xor eax, eax
jmp 0x102b925
push 1
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.01035a9c
mov edi, eax
push 1
push dword [ebp - 4]
call fcn.01036b06
test edi, edi
jne 0x102b7dd
xor eax, eax
jmp 0x102b925
cmp word [esi], 1
jne 0x102b7e9
mov eax, dword [ebp + 0x14]
mov dword [edi + 0xc], eax
push 1
push 0x10
push esi
push str.APPITEM
push dword [ebp + 0x10]
call fcn.01035d7c
test eax, eax
je 0x102b806
xor eax, eax
jmp 0x102b925
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push ebx
push esi
call fcn.0102dbbb
mov dword [ebp - 4], eax
test eax, 0x80000000
je 0x102b85b
push 0x21c
mov eax, dword [0x1056d98]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push eax
push dword [0x104ed80]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.Could_not_Save_the_Moniker_For_the_AppItem
push dword [0x104ed80]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x104ed80]
push dword [ebp - 4]
call fcn.0102e6d7
movzx eax, word [esi]
cmp eax, 1
je 0x102b8b3
cmp eax, 2
je 0x102b8f2
push 0x236
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Illegal_case
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x102b925
push 1
lea eax, [esi + 2]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
call fcn.01037355
test eax, eax
jge 0x102b8d1
xor eax, eax
jmp 0x102b925
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push edi
push ebx
push dword [esi + 0x14]
call fcn.0103f5f4
mov esi, eax
push 1
push dword [ebp - 4]
call fcn.01036b06
jmp 0x102b904
lea eax, [esi + 2]
push eax
push dword [ebp + 0x10]
push ebx
push dword [esi + 0x14]
call fcn.0103f877
mov esi, eax
test edi, edi
je 0x102b91e
cmp dword [ebp + 0x14], 0
jne 0x102b91e
push 0
push 0
push edi
call fcn.0103651f
push edi
call fcn.01035cf7
cmp esi, 1
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x102b959
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x102b9a2
push 0x28c
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Null_Window_Id
call esi
push 0x104c08c
call esi
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
pop edi
pop esi
pop ebp
ret 4

Function at 0x102b9e7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp eax, 1
je 0x102ba4b
cmp eax, 2
je 0x102ba65
cmp eax, 3
je 0x102ba7f
cmp eax, 4
je 0x102ba99
push 0x30a
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Illegal_case
call esi
push 0x104c08c
call esi
jmp 0x102bacf
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0xac]
push eax
push str.OTC_03X
lea edx, [eax + 1]
mov dword [ecx + 0xac], edx
jmp 0x102bab1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0xac]
push eax
push str.OTS_03X
lea edx, [eax + 1]
mov dword [ecx + 0xac], edx
jmp 0x102bab1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0xac]
push eax
push str.OTD_03X
lea edx, [eax + 1]
mov dword [ecx + 0xac], edx
jmp 0x102bab1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0xac]
push eax
push str.OTB_03X
lea edx, [eax + 1]
mov dword [ecx + 0xac], edx
push dword [0x1056c80]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [0x1056c80]
add esi, 2
push eax
push esi
call fcn.01036cce
pop esi
pop ebp
ret 8

Function at 0x102bca9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov esi, dword [ebp + 8]
cmp esi, edi
jne 0x102bcf5
push 0x479
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call ebx
push str.Null_Doc
call ebx
push 0x104c08c
call ebx
push esi
call fcn.0102bc27
mov ebx, eax
test ebx, ebx
je 0x102bd16
inc edi
push ebx
call fcn.0102bc62
mov esi, eax
push ebx
mov ebx, esi
call fcn.010322f4
test esi, esi
jne 0x102bd01
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x102bfbb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp esi, ebx
je 0x102bfce
mov dword [esi], edi
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x102bfd9
xor eax, eax
jmp 0x102c04f
movzx eax, word [ecx]
cmp eax, 1
je 0x102c02b
cmp eax, 2
je 0x102c033
push 0x5f7
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Illegal_case
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x102c047
mov eax, dword [ecx + 0x14]
mov ebx, dword [eax + 0x44]
jmp 0x102c039
mov eax, dword [ecx + 0x14]
mov ebx, dword [eax + 0x50]
cmp dword [ebx + 0x108], 0
jne 0x102c047
mov edi, 1
test esi, esi
je 0x102c04d
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x102c056
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp esi, ebx
je 0x102c069
mov dword [esi], edi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x102c074
xor eax, eax
jmp 0x102c0ea
movzx ecx, word [eax]
cmp ecx, 1
je 0x102c0c6
cmp ecx, 2
je 0x102c0ce
push 0x634
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Illegal_case
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x102c0e2
mov eax, dword [eax + 0x14]
mov ebx, dword [eax + 0x44]
jmp 0x102c0e2
mov eax, dword [eax + 0x14]
cmp dword [eax + 0xd8], 0
mov ebx, dword [eax + 0x50]
je 0x102c0e2
mov edi, 1
test esi, esi
je 0x102c0e8
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x102c124
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp esi, ebx
je 0x102c137
mov dword [esi], edi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x102c142
xor eax, eax
jmp 0x102c19f
cmp word [eax], 2
jne 0x102c197
mov edi, dword [eax + 0x14]
test edi, edi
jne 0x102c194
push 0x686
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Null_App_Pitem
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x102c197
mov ebx, dword [edi + 0x50]
test esi, esi
je 0x102c19d
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x102c28d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
push ebx
push esi
push edi
je 0x102c2ef
cmp dword [ebp + 0x1c], 0
jne 0x102c2b0
xor eax, eax
jmp 0x102c381
mov esi, dword [ebp + 0xc]
push esi
call fcn.0102b92e
mov ebx, eax
test ebx, ebx
je 0x102c37e
mov edi, dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push 0
push esi
push ebx
call fcn.0102c28d
test eax, eax
jne 0x102c37b
push ebx
call fcn.0102b9b1
mov ebx, eax
test ebx, ebx
jne 0x102c2c6
jmp 0x102c37e
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 1
je 0x102c343
cmp ecx, 2
je 0x102c37e
push 0x7af
push str.c:_ntprivatectoleuiole2.0_appscommonchicago.._appitem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Illegal_case
call esi
push 0x104c08c
call esi
mov eax, 0x80004005
jmp 0x102c381
push 0
push eax
call fcn.0102c0f1
mov esi, eax
push 0x10546b0
push dword [esi + 0xb8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x18]
push 0x10546b0
push dword [esi + 0xb8]
push 0
push esi
mov eax, dword [ecx]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
call dword [eax + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x102cff4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov eax, dword [esp + 0x10]
mov ebp, esp
sub esp, 8
cmp eax, 2
push esi
push edi
mov esi, dword [ebp + 0x18]
mov dword [esi], 0
je 0x102d063
cmp eax, 3
je 0x102d074
cmp eax, 0xa
je 0x102d0b8
push 0xd5
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..moniker.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Illegal_case
call esi
push 0x104c08c
call esi
mov eax, 0x80004005
jmp 0x102d1c8
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0102e52c
jmp 0x102d1c8
mov ecx, dword [ebp + 8]
lea edi, [ecx + 0x1c]
mov eax, dword [edi]
test eax, eax
je 0x102d08f
push eax
mov dword [esi], eax
mov esi, dword [eax]
call dword [esi + 4]
xor eax, eax
jmp 0x102d1c8
push edi
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0xc]
call fcn.0102c61b
test eax, 0x80000000
jne 0x102d1c8
mov eax, dword [edi]
push eax
mov dword [esi], eax
mov esi, dword [eax]
call dword [esi + 4]
xor eax, eax
jmp 0x102d1c8
xor eax, eax
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.0102e52c
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], 1
je 0x102d1c3
mov ecx, dword [ecx + 0xa8]
test eax, eax
mov ecx, dword [ecx + 0x40]
jne 0x102d1c3
test ecx, ecx
je 0x102d1c3
lea eax, [ebp - 8]
mov edi, dword [ecx]
push eax
push 2
push 1
push ecx
call dword [edi + 0x10]
mov edi, eax
test edi, edi
jne 0x102d161
cmp dword [ebp - 8], 0
je 0x102d161
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CreateGenericComposite]
mov edi, eax
mov esi, eax
test esi, 0x80000000
je 0x102d19d
push 0xc7
mov eax, dword [0x1056d98]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..moniker.c
push eax
push dword [0x104ed80]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.Error_Moniker:
push dword [0x104ed80]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x104ed80]
push esi
jmp 0x102d198
push 0xbf
mov eax, dword [0x1056d98]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..moniker.c
push eax
push dword [0x104ed80]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.Error_Moniker:
push dword [0x104ed80]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x104ed80]
push edi
call fcn.0102e6d7
cmp dword [ebp - 4], 0
je 0x102d1ae
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 8], 0
je 0x102d1bf
mov eax, dword [ebp - 8]
push dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 8]
mov eax, edi
jmp 0x102d1c8
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x102d322
Capabilities:
Print debug messages

Disassembly:
push ebp
mov edx, dword [esp + 0x10]
mov ebp, esp
push esi
mov dword [edx], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x102d39a
cmp eax, 1
je 0x102d3a1
cmp eax, 2
je 0x102d39a
cmp eax, 3
je 0x102d3ba
cmp eax, 4
jl 0x102d356
cmp eax, 5
jle 0x102d3ae
push 0x17f
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..moniker.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call esi
push str.Illegal_case
call esi
push 0x104c08c
call esi
mov eax, 0x80004005
jmp 0x102d3c1
mov eax, 0x80004005
jmp 0x102d3c1
cmp dword [ebp + 0xc], 4
je 0x102d3ba
mov eax, 0x80004005
jmp 0x102d3c1
push edx
push dword [ebp + 0xc]
push ecx
call fcn.0102d3c6
jmp 0x102d3c1
push edx
push ecx
call fcn.0102d1d0
pop esi
pop ebp
ret 0xc

Function at 0x102dbbb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [0x104eac8], 0
mov dword [ebp - 4], 0
push ebx
push esi
push edi
jne 0x102dbdb
xor eax, eax
jmp 0x102dcc1
mov edi, dword [ebp + 8]
test edi, edi
jne 0x102dc23
push 0x43d
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..moniker.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call esi
add esp, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1056c90
call ebx
push str.Null_App_Pitem
call ebx
push 0x104c08c
call ebx
jmp 0x102dc29
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 4]
push eax
push dword [0x104ead0]
push dword [0x104ead4]
push dword [ebp + 0xc]
push edi
call fcn.0102cff4
test eax, eax
jne 0x102dcc1
add edi, 2
mov eax, dword [0x1056c80]
push edi
push 0x104eb60
push eax
call esi
add esp, 0xc
mov edx, dword [ebp + 0x10]
push dword [ebp - 4]
push dword [0x1056c80]
push dword [edx]
call fcn.0102df00
test eax, 0x80000000
mov edi, eax
je 0x102dcae
push 0x447
mov eax, dword [0x1056d98]
push str.c:_ntprivatectoleuiole2.0_appscommonchicago..moniker.c
push eax
push dword [0x104ed80]
call esi
add esp, 0x10
push str.Error_in_SaveMoniker
push dword [0x104ed80]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x104ed80]
push edi
call fcn.0102e6d7
cmp dword [ebp - 4], 0
je 0x102dcbf
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc