joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x997d51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x9afd2b
sub esp, 0x24
mov eax, dword [0xa12154]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
xor ebx, ebx
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x9afd99
mov eax, dword [edi]
lea ecx, [esp + 0x18]
add eax, esi
push eax
call fcn.009984d6
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.0099a5fb
pop ecx
pop ecx
test al, al
jne 0x9afdb0
lea ecx, [esp + 0x18]
add edi, 4
call fcn.0099a57e
inc ebx
cmp ebx, dword [esp + 0x14]
jb 0x9afd64
xor esi, esi
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.009999ad
add esp, 0x24
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + esi]
lea ecx, [esp + 0x18]
call fcn.0099a57e
jmp 0x9afd9b

Function at 0x99a7b3
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9b07aa
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x9b089e
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0xa154f8
mov bl, byte [esi + edi]
push 0x9f75c8
push ebp
call fcn.00999660
xor edx, edx
mov eax, esi
div dword [esp + 0x24]
pop ecx
pop ecx
push 0x951f3c
push 0x9f75d4
mov bh, byte [edx + section..euro]
push 0xa155e0
xor bh, bl
call fcn.00999660
pop ecx
pop ecx
mov ecx, eax
call fcn.0099c70c
mov bl, byte [esi + edi]
push 0x951f3c
push 0x9f75e4
push ebp
call fcn.00999660
pop ecx
pop ecx
mov ecx, eax
call fcn.0099c70c
add byte [esi + edi], bh
push 0x951f3c
push 0x9f75f8
push ebp
call fcn.00999660
pop ecx
pop ecx
mov ecx, eax
call fcn.0099c70c
dec byte [esi + edi]
push 0x9f7618
push ebp
call fcn.00999660
add byte [esi + edi], 0xfe
push 0x9f7624
push ebp
call fcn.00999660
sub byte [esi + edi], bl
push 0x9f7638
push ebp
call fcn.00999660
inc byte [esi + edi]
push 0x9f7648
push ebp
call fcn.00999660
inc byte [esi + edi]
push 0x9f7654
push ebp
call fcn.00999660
inc byte [esi + edi]
push 0x9f7660
push ebp
call fcn.00999660
add esp, 0x30
inc esi
cmp esi, dword [esp + 0x18]
jb 0x9b07c3
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x99cb1c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x9afdf6
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0xa45f90], eax
pop edi
pop esi
ret
Function at 0x10001210
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
add eax, 0xffffffe5
cmp eax, 0x58
ja case.0x10001224.31
xor ecx, ecx
mov cl, byte [eax + 0x1000128c]
jmp dword [ecx*4 + 0x10001278]
call fcn.10001ce0
push eax
call fcn.100056d0
call fcn.10001ce0
shr eax, 1
and eax, 1
ret 0xc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x10001224.31
call fcn.10001ce0
and eax, 0xff
shr eax, 2
and eax, 1
ret 0xc
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x10001224.31
mov eax, 1
ret 0xc

Function at 0x10001243
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
add eax, 0xffffffe5
cmp eax, 0x58
ja case.0x10001224.31
xor ecx, ecx
mov cl, byte [eax + 0x1000128c]
jmp dword [ecx*4 + 0x10001278]
call fcn.10001ce0
push eax
call fcn.100056d0
call fcn.10001ce0
shr eax, 1
and eax, 1
ret 0xc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x10001224.31
call fcn.10001ce0
and eax, 0xff
shr eax, 2
and eax, 1
ret 0xc
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.0x10001224.31
mov eax, 1
ret 0xc

Function at 0x10002850
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push esi
je 0x100028ea
mov esi, dword [esp + 0x10]
push 0x200
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100028ea
push edi
mov ecx, 0x80
mov edi, esi
push 0xfe
push esi
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetClassNameA]
call fcn.10002570
test eax, eax
pop edi
je 0x100028cf
push 6
push esi
push 0x1002a8f4
call fcn.10005960
add esp, 0xc
test eax, eax
je 0x100028cf
push 0xd
push esi
push str.adesk_dlg0000
call fcn.10005960
add esp, 0xc
test eax, eax
je 0x100028cf
push 6
push esi
push str.Button
call fcn.10005960
add esp, 0xc
test eax, eax
jne 0x100028e2
add esi, 0x100
push 0xfe
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop esi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret

Function at 0x100036a0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
call fcn.10001180
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
jne 0x100036d4
push edi
push esi
push 0x10001410
push 2
call ebx
push eax
call fcn.100011a0
add esp, 4
call fcn.10001190
test eax, eax
jne 0x100036f1
push edi
push esi
push 0x10001450
push 7
call ebx
push eax
call fcn.100011b0
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x10005260
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push 0
push 0
push 0
push 0
mov dword [0x1002bc80], eax
mov dword [0x1002bc84], ecx
mov dword [0x1003fef8], edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1003fefc], eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x100051b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1003ff08], eax
mov eax, 1
ret 0xc
Function at 0x10005380
Capabilities:
Get common file path

Disassembly:
sub esp, 0x348
mov ecx, 0x82
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000544d
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
cmp byte [esp + ecx + 0xb], 0x5c
je 0x100053f1
mov edi, 0x1002bc98
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ftWndCtrl.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x214]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
pop esi
cmp eax, 0xffffffff
pop ebx
je 0x1000544d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop edi
add esp, 0x348
ret
xor eax, eax
pop edi
add esp, 0x348
ret

Function at 0x1000c540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1000c5b1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x1000c5b1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000c59a
jmp 0x1000c5b1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1000d530
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000d53c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.Afx:400000:3:10011:6:0
call fcn.10015010
push str.ToolbarWindow32
call fcn.10015010
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000d591
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret
Function at 0x1000d740
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000d74c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.ToolBarContainer
call fcn.100150c0
push str.Button
call fcn.10015010
push str.SoftelTreeControl32
call fcn.10015010
push str.DLLHOBB
call fcn.10015010
push str.FHListViewClass
call fcn.10015010
push str.MACR_PopupColorWellWrapper
call fcn.10015010
push str.MACR_PopupColorWellButton
call fcn.10015010
push str.MACR_ToolbarFlyoutButton
call fcn.10015010
add esp, 0x20
lea eax, [esp + 4]
push eax
push 0x1000d5a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000d7d3
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000d7e0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000d7ec
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.BCGMiniWrame:400000:808:10011:10
call fcn.100150c0
push str.BCGToolBar:400000:8:10011:10
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000d837
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000d850
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000d85c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.MsoCommandBar
call fcn.100150c0
push str.MsoCommandBar
call fcn.10015010
push str.VsChannel
call fcn.10015010
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000d8b1
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000da00
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000da0c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:00400000:8:00010011:00000000:00000000
call fcn.100150c0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push 0x1002ecb0
call fcn.10015010
push str.Afx:400000:8:10011:10:0
call fcn.10015010
add esp, 0x10
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000da6b
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret
Function at 0x1000dae0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000daec
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:00400000:b:00010011:00000000:00000000
call fcn.100150c0
push str.Afx:00400000:b:00010011:00000000:00000000
call fcn.10015010
push str.SysTabControl32
call fcn.10015010
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000db41
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000db50
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000db5c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.BCGToolBar:400000:8:10011:10
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000dba7
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000dbc0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000dbcc
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.ToolbarWindow32
call fcn.10015010
push str.SysTreeView32
call fcn.10015010
push str.Afx:00400000:b:00010011:00000000:00000000
call fcn.10015010
push str.Afx:00400000:3:00010011:00000000:00000000
call fcn.10015010
add esp, 0x14
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000dc35
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000dc40
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000dc4c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:10000000:8:00010011:00000000:00000000
call fcn.100150c0
push str.ToolbarWindow32
call fcn.10015010
push str.jbutton
call fcn.10015010
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000dca1
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret
Function at 0x1000dcb0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000dcbc
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.Afx:10000000:808:10011:161007d5:0
call fcn.100150c0
push str.Afx:209c0000:808:10011:110005a:0
call fcn.100150c0
push str.Afx:56510000:808:00010011:0110005A:00000000
call fcn.100150c0
push str.Afx:400000:8:10011:10:0
call fcn.10015010
push str.Afx:10000000:8:10011:10:0
call fcn.10015010
push str.Afx:209c0000:8:10011:10:0
call fcn.10015010
push str.AfxWnd42
call fcn.10015010
push str.Afx:56510000:8:00010011:00000010:00000000
call fcn.10015010
push str.AfxWnd70u
call fcn.10015010
add esp, 0x28
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000dd57
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000dd70
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000dd7c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.Afx:400000:8:10003:0:0
call fcn.100150c0
push str.TTBXFloatingWindowParent
call fcn.100150c0
push str.TTBXFloatingWindowParent.UnicodeClass
call fcn.100150c0
push str.Afx:400000:8:10011:10:0
call fcn.10015010
push str.Afx:400000:8:10003:10:0
call fcn.10015010
push str.TTBXToolbar
call fcn.10015010
push str.TTBXToolbar.UnicodeClass
call fcn.10015010
add esp, 0x20
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000de03
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000de10
Capabilities:
Enumerate gui resources

Disassembly:
call fcn.10011de0
call fcn.100150a0
call fcn.10014ff0
push str.TxpBarControl
call fcn.100150c0
push str.TxpBarControl
call fcn.10015010
push str.TPopupPanelButton
call fcn.10015010
push str.TdxTreeList
call fcn.10015010
push str.TXPDocBarButton
call fcn.10015010
add esp, 0x14
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000de7e
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000de90
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000de9c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:00400000:8:00010011:00000006:00010007
call fcn.100150c0
push str.ToolbarWindow32
call fcn.10015010
push str.Afx:00400000:8
call fcn.10015010
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000def1
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret
Function at 0x1000df00
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000df0c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.SALSUBFRAME
call fcn.100150c0
push str.SALSUBFRAME
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000df50
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000df5c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10003:0:0
call fcn.100150c0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.BCGToolBar:400000:8:10003:10
call fcn.10015010
push str.BCGToolBar:400000:8:10011:10
call fcn.10015010
add esp, 0x10
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000dfbb
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000dfd0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000dfdc
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push 0x1002ecb0
call fcn.100150c0
push str.Afx:00400000:808:00010011:0110005A:00000000
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000e027
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000e040
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000e04c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:55F30000:8:00010011:00000010:00000000
call fcn.100150c0
push str.Afx:55F30000:808:00010011:0110005A:00000000
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000e097
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000e0b0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000e0bc
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.Afx:400000:8:10003:0:0
call fcn.100150c0
push str.BCGToolBar:400000:8:10011:10
call fcn.10015010
push str.BCGToolBar:400000:8:10003:10
call fcn.10015010
add esp, 0x10
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000e11b
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret
Function at 0x1000e130
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000e13c
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:400000:8:10011:0:0
call fcn.100150c0
push str.ToolbarWindow32
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000e187
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret

Function at 0x1000e1a0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10044100]
test eax, eax
je 0x1000e1ac
xor eax, eax
ret
call fcn.100150a0
call fcn.10014ff0
push str.Afx:00400000:8:00010011:00000000:00000000
call fcn.100150c0
push str.ToolbarWindow32
call fcn.10015010
add esp, 8
lea eax, [esp + 4]
push eax
push 0x1000d420
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x1000e1f7
push eax
call fcn.1000d350
add esp, 4
mov eax, 1
mov dword [0x10044100], eax
ret