joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005990
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x1003a24e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x1005d1c0]
push edi
mov edi, ecx
mov dword [esp + 0x20c], eax
mov eax, dword [edi + 0x124]
test eax, eax
je 0x100059ce
mov eax, 2
jmp 0x10005b73
push ebx
push ebp
push esi
push 1
mov ecx, edi
call sym.Host71.dll_private:_void___thiscall_CDB::SetStabilityFlag_int_
mov ecx, edi
call fcn.10025ea0
push 0
push 0x4c
lea ecx, [esp + 0x120]
call sym.Host71.dll_public:_void___thiscall_String::constructor_unsigned_int__struct_HINSTANCE____
push 0
push 0x4d
lea ecx, [esp + 0x20]
mov dword [esp + 0x22c], 0
call sym.Host71.dll_public:_void___thiscall_String::constructor_unsigned_int__struct_HINSTANCE____
mov ecx, dword [esp + 0x22c]
lea eax, [esp + 0x118]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x230], 1
call fcn.10005200
mov esi, eax
lea eax, [esp + 0x124]
push eax
lea ebp, [edi + 0x12c]
lea ecx, [esp + 0x24]
push ebp
push ecx
mov byte [esp + 0x23c], 2
call fcn.10005200
add esp, 0x18
push 0
mov ecx, esi
mov ebx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
call ebx
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0x14]
inc esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test esi, esi
je 0x10005ac8
lea ecx, [esp + 0x18]
mov byte [esp + 0x224], 0
call sym.Host71.dll_public:_void___thiscall_String::destructor_void_
lea ecx, [esp + 0x118]
mov dword [esp + 0x224], 0xffffffff
call sym.Host71.dll_public:_void___thiscall_String::destructor_void_
mov eax, 2
jmp 0x10005b70
mov eax, dword [esp + 0x22c]
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10005200
mov esi, eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push ebp
push eax
mov byte [esp + 0x23c], 3
call fcn.10005200
add esp, 0x18
push 0
mov ecx, esi
mov ebp, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, ebp
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call ebx
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0x10]
inc esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
mov byte [esp + 0x224], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test esi, esi
jne 0x10005a96
mov ecx, edi
call sym.Host71.dll_public:_int___thiscall_CDB::Open_void_
lea ecx, [esp + 0x18]
mov byte [esp + 0x224], 0
call sym.Host71.dll_public:_void___thiscall_String::destructor_void_
lea ecx, [esp + 0x118]
mov dword [esp + 0x224], 0xffffffff
call sym.Host71.dll_public:_void___thiscall_String::destructor_void_
xor eax, eax
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20c]
pop edi
call fcn.10038e11
add esp, 0x218
ret 4
Function at 0x10006070
Capabilities:
Get disk information

Disassembly:
sub esp, 0x414
mov eax, dword [0x1005d1c0]
push esi
mov dword [esp + 0x414], eax
lea eax, [esp + 0x310]
push eax
lea ecx, [esp + 0x210]
push ecx
mov ecx, dword [esp + 0x424]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x114]
push eax
push ecx
call dword [sym.imp.MSVCR71.dll__splitpath]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x14
lea edx, [esp + 0x108]
push edx
call esi
test eax, eax
je 0x100060fa
push 0x1003e544
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop esi
mov ecx, dword [esp + 0x410]
call fcn.10038e11
add esp, 0x414
ret
mov al, byte [esp + 4]
push ebx
mov ebx, 0x5c
cmp al, bl
jne 0x1000620d
lea edx, [esp + 8]
push edx
call esi
cmp eax, 2
jle 0x10006128
cmp byte [esp + 8], bl
jne 0x10006128
cmp byte [esp + 9], bl
jne 0x1000620d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push edi
lea eax, [esp + 0x10]
push eax
call ebp
mov edi, eax
cmp edi, 1
jne 0x100061d5
lea ecx, [esp + 0x10]
push ecx
call esi
cmp eax, 4
jl 0x100061d5
cmp byte [esp + 0x10], bl
jne 0x100061d5
cmp byte [esp + 0x11], bl
jne 0x100061d5
cmp byte [esp + 0x12], 0x2e
jne 0x100061d5
cmp byte [esp + 0x13], bl
jne 0x100061d5
lea edx, [esp + 0x10]
push edx
call esi
cmp eax, 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jne 0x1000618c
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push ecx
call esi
lea edx, [esp + 0x14]
push ebx
push edx
call dword [sym.imp.MSVCR71.dll_strchr]
add esp, 8
test eax, eax
je 0x100061ab
mov byte [eax], 0x3a
inc eax
mov byte [eax], bl
mov byte [eax + 1], 0
jmp 0x100061b7
push 0x1003e540
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
call ebp
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0x410]
call fcn.10038e11
add esp, 0x414
ret
lea edx, [esp + 0x10]
push edx
call esi
cmp eax, 2
jl 0x100061f4
cmp byte [esp + 0x10], bl
jne 0x100061f4
cmp byte [esp + 0x11], bl
jne 0x100061f4
lea eax, [esp + 0x10]
push eax
jmp 0x100061bc
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0x410]
call fcn.10038e11
add esp, 0x414
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [esp + 0x418]
pop ebx
pop esi
call fcn.10038e11
add esp, 0x414
ret
Function at 0x10006240
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1003a36b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebp
push esi
push eax
lea ecx, [esp + 0xc]
xor ebp, ebp
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
push 0x5c
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], ebp
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
mov esi, eax
cmp esi, 0xffffffff
jg 0x1000629b
push 0x5c
lea ecx, [esp + 0xc]
call dword [0x1003d318]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
mov esi, eax
dec esi
push edi
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
mov edi, dword [section..HostSh1]
push section..HostSh1
mov byte [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc esi
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
movzx edx, di
push edx
mov ecx, eax
mov byte [esp + 0x2c], 2
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push str._s____05u.___
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call sub.MFC71.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call sym.Host71.dll_unsigned_int___cdecl_HostGetDriveType_char_const__
add esp, 4
cmp eax, 2
pop edi
jne 0x1000638e
push 0x180
push 0x102
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll__open]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x10006352
call dword [sym.imp.MSVCR71.dll__errno]
mov ebp, dword [eax]
jmp 0x1000638e
push 5
push str.Host_n
push esi
call dword [sym.imp.MSVCR71.dll__write]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10006370
call dword [sym.imp.MSVCR71.dll__errno]
mov ebp, dword [eax]
push esi
call dword [sym.imp.MSVCR71.dll__close]
add esp, 4
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_remove]
add esp, 4
mov dword [esp + 0x24], 1
call sub.MFC71.DLL_AfxTryCleanup
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x1c]
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x10007360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003a3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
mov dword [esp + 0xc], esi
call sub.MFC71.DLL_CPtrArray::CPtrArray
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x1c], 0
mov dword [esi], 0
mov dword [esi + 0x20], 0
mov dword [esi + 4], ecx
mov dword [esi + 0x1c], eax
call sub.MFC71.DLL_CWnd::GetDlgItem
mov ebx, eax
mov eax, dword [ebx + 0x20]
lea edi, [esi + 0x24]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 4]
push edi
call sub.MFC71.DLL_CWnd::ScreenToClient
mov edx, dword [edi]
mov ecx, dword [edi + 8]
sub ecx, edx
mov dword [esi + 0x2c], ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0xc]
sub edx, ecx
push 0
mov ecx, ebx
mov dword [esi + 0x30], edx
call sub.MFC71.DLL_CWnd::ShowWindow
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x100085b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003a590
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov byte [esp + 0x4c], 5
call sym.Host71.dll_protected:_void___thiscall_CFileString::GetParts_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____const
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
test eax, eax
je 0x100086a7
push 1
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
mov ebx, 1
push 0x1003e544
mov ecx, eax
mov byte [esp + 0x38], 6
mov dword [esp + 0x24], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Compare]
test eax, eax
jne 0x100086a7
push ebx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Right]
push 0x1003e544
mov ecx, eax
mov ebx, 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Compare]
test eax, eax
jne 0x100086a7
mov esi, 1
jmp 0x100086a9
xor esi, esi
test bl, 2
je 0x100086bb
lea ecx, [esp + 0x24]
and ebx, 0xfffffffd
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test bl, 1
je 0x100086ca
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x10008750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003a5e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
mov byte [esp + 0x40], 6
call sym.Host71.dll_protected:_void___thiscall_CFileString::GetParts_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____const
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 8]
call dword [0x1003d434]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 8]
call dword [0x1003d434]
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 8]
call dword [0x1003d2ec]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call dword [0x1003d434]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
call dword [0x1003d434]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
mov byte [esp + 0x2c], 7
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x100090c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003a7f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, esi
mov byte [esp + 0x40], 6
call sym.Host71.dll_protected:_void___thiscall_CFileString::GetParts_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____const
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call dword [0x1003d434]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
call dword [0x1003d434]
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 8]
call dword [0x1003d2ec]
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x34]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov byte [esp + 0x2c], 7
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x1000ad30
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x68
mov eax, dword [0x1005d1c0]
push esi
mov esi, dword [esp + 0x70]
push edi
xor edi, edi
test esi, esi
mov dword [esp + 0x6c], eax
je 0x1000ad97
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000ad97
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x1000ad99
mov ecx, dword [eax + 4]
cmp ecx, esi
je 0x1000ad99
push ecx
push esi
lea eax, [esp + 0x10]
push str.GetGrid_hWnd__X_pGrid__hWnd__X_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
call fcn.10038e11
add esp, 0x68
ret
mov eax, edi
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
call fcn.10038e11
add esp, 0x68
ret
Function at 0x1000c470
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1000c486
xor eax, eax
pop esi
add esp, 0x18
ret 4
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
xor ebx, ebx
test ax, ax
push 0x10
setl bl
call edi
mov ecx, dword [esi + 0xe8]
mov edi, dword [esp + 0x28]
xor edx, edx
test ax, ax
mov eax, dword [esi + 0xec]
setl dl
cmp word [esi + 0x198], 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
je 0x1000c51c
mov edx, dword [esi]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
test eax, eax
je 0x1000c514
lea ecx, [esp + 0xc]
mov dword [esi + 0x150], 1
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x2c]
test eax, eax
mov dword [esi + 0x150], 0
jne 0x1000c514
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x18
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov ax, word [esi + 0x19a]
test ax, ax
je 0x1000c5f1
cmp edi, 9
je 0x1000c5c5
cmp edi, 0xd
je 0x1000c58d
cmp edi, 0x1b
je 0x1000c56f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1000c509
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x110]
test eax, eax
jne 0x1000c509
mov ecx, dword [esp + 0xc]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + pe_nt_image_headers32]
pop edi
pop ebx
pop esi
add esp, 0x18
ret 4
mov edx, dword [esi]
push 0
push 0
push 0
mov ecx, esi
call dword [edx + 0x11c]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
cmp ax, 2
je 0x1000c5c5
test edx, edx
mov ecx, esi
je 0x1000c5af
mov eax, dword [esi]
call dword [eax + 0x12c]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
mov edx, dword [esi]
call dword [edx + 0x130]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
test edx, edx
mov ecx, esi
je 0x1000c5de
call sym.Host71.dll_public:_void___thiscall_IGrid::TabCursorBkwd_void_
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
call sym.Host71.dll_public:_void___thiscall_IGrid::TabCursorFwd_void_
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
cmp edi, 9
je 0x1000c646
cmp edi, 0xd
je 0x1000c625
cmp edi, 0x1b
jne 0x1000c509
mov eax, dword [esi + 0x10]
push 0
push 2
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
mov ecx, dword [esi + 0x10]
push 0
push 1
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
mov eax, dword [esi + 0x10]
push edx
mov edx, dword [esi + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x18
ret 4
Function at 0x10015fe0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
mov eax, dword [0x1005d1c0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
dec eax
push esi
xor edx, edx
mov esi, 0x1a
div esi
test ecx, ecx
mov esi, eax
sete al
dec al
and eax, 0xff
add al, dl
mov byte [esp + ecx + 4], al
mov eax, esi
inc ecx
test eax, eax
jne 0x10015ff4
test ecx, ecx
jle 0x10016031
lea esi, [esp + ecx + 3]
mov dl, byte [esi]
add dl, 0x41
mov byte [eax + 0x1005d220], dl
inc eax
dec esi
cmp eax, ecx
jl 0x10016020
mov ecx, dword [esp + 0xc]
mov byte [eax + 0x1005d220], 0
mov eax, 0x1005d220
pop esi
call fcn.10038e11
add esp, 0xc
ret

Function at 0x10016050
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x104
mov eax, dword [0x1005d1c0]
push esi
push edi
mov dword [esp + 0x108], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp esi, 0x100
ja 0x10016099
push 0x100
lea eax, [esp + 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x10016099
push edi
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100160a1
push edi
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x104]
pop esi
call fcn.10038e11
add esp, 0x104
ret