joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002cd70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x1002cd86
mov al, 1
jmp 0x1002ce29
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002cda6
push 0x4f
push 0x101d80c8
push 0x101d82d8
call fcn.10173a10
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1002cdb0
xor al, al
jmp 0x1002ce29
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0xffffffff
jne 0x1002cdbd
xor al, al
jmp 0x1002ce29
cmp dword [ebp + 8], 0
jne 0x1002cdd7
push 0x56
push 0x101d81e8
push 0x101d83d8
call fcn.10173a10
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x1002cde1
xor al, al
jmp 0x1002ce29
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1002ce1f
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jne 0x1002ce1f
mov dword [ebp - 0x10], 1
jmp 0x1002ce26
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002ce30
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x1002ce53
push 0x62
push 0x101d82e8
push 0x101d84d8
call fcn.10173a10
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x1002ce60
xor al, al
jmp 0x1002cf2e
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x1002ce80
push 0x67
push 0x101d83e8
push str.self
call fcn.10173a10
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1002ce8d
xor al, al
jmp 0x1002cf2e
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x1002ce9d
xor al, al
jmp 0x1002cf2e
mov dword [ebp - 0xc], 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1002cf23
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jb 0x1002cf21
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1002cf18
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x14]
je 0x1002cf12
push 0x74
push str.C:UsersAKINCIDesktop2383000004.0.RPGuarDv2383_ClientSourceRPGuarDv2383discord_rpc_master_srcconnection_win.cpp
push str.bytesToRead__bytesRead
call fcn.10173a10
add esp, 0xc
mov al, 1
jmp 0x1002cf2e
mov ecx, dword [ebp - 8]
call fcn.1002cd30
nop
jmp 0x1002cf2c
mov ecx, dword [ebp - 8]
call fcn.1002cd30
nop
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x1002d170
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x1002d1d1
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx]
test ecx, ecx
je 0x1002d1d1
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002d1cb
mov eax, dword [ebp - 8]
jmp 0x1002d20c
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1002d209
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
je 0x1002d209
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002d590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa0
mov eax, dword [0x10226180]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
lea eax, [ebp - 0x84]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x20
lea edx, [ebp - 0x44]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0xa9c]
push ecx
push 0x20019
push 0
push str.SoftwareValveSteam
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
je 0x1002d622
push str.Error_opening_Steam_key_n
push 2
call fcn.1016d310
add esp, 4
push eax
call fcn.1002cfe0
add esp, 8
jmp 0x1002d72c
mov dword [ebp - 0xa98], 0x208
lea edx, [ebp - 0xa98]
push edx
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
mov ecx, dword [ebp - 0xa9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xa94], eax
mov edx, dword [ebp - 0xa9c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [ebp - 0xa94], 0
jne 0x1002d676
cmp dword [ebp - 0xa98], 1
jae 0x1002d693
push str.Error_reading_SteamExe_key_n
push 2
call fcn.1016d310
add esp, 4
push eax
call fcn.1002cfe0
add esp, 8
jmp 0x1002d72c
mov eax, dword [ebp - 0xa98]
shr eax, 1
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xa90], 0
jmp 0x1002d6bc
mov ecx, dword [ebp - 0xa90]
add ecx, 1
mov dword [ebp - 0xa90], ecx
mov edx, dword [ebp - 0xa90]
cmp edx, dword [ebp - 0xaa0]
jae 0x1002d6f2
mov eax, dword [ebp - 0xa90]
movzx ecx, word [ebp + eax*2 - 0x28c]
cmp ecx, 0x2f
jne 0x1002d6f0
mov edx, 0x5c
mov eax, dword [ebp - 0xa90]
mov word [ebp + eax*2 - 0x28c], dx
jmp 0x1002d6ad
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x28c]
push edx
push str.__s__steam:__rungameid__s
push 0x800
lea eax, [ebp - 0xa8c]
push eax
call fcn.1002d020
add esp, 0x14
lea ecx, [ebp - 0xa8c]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.1002d210
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10150c60
mov esp, ebp
pop ebp
ret
Function at 0x1002f630
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aa967
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10226180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1002fd40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.1002fe20
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.10015d80
nop
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jne 0x1002f6f8
push 0x14
call fcn.10150df0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x1002f6d5
push 0
push 0x10000
mov ecx, dword [ebp - 0x14]
call fcn.1002fb10
mov dword [ebp - 0x18], eax
jmp 0x1002f6dc
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10030d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aa9dd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10226180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.10031270
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.100312e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10030f10
nop
mov dword [ebp - 0x20], 0x10031320
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.10005060
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0
call fcn.10173f10
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x10030da8
lea ecx, [ebp - 0x14]
call fcn.1000f410
nop
jmp 0x10030dba
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
push 6
call fcn.1014f6a0
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10030f10
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100716d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac5a5
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10226180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
push 2
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x1a8]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c6220
nop
mov edx, dword [0x10229c40]
mov eax, dword [edx + 0x43e0]
mov ecx, dword [ebp - 0x30]
movzx edx, word [ecx + 0x1be]
cmp dword [eax + 0x30], edx
jl 0x1007173c
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax + 0x1be]
test ecx, ecx
jne 0x10071762
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x1bc]
test eax, eax
jg 0x10071762
push 7
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x1a4]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c6220
nop
push 7
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x1a0]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c6220
push 1
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c4070
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3880
nop
mov dword [ebp - 0x38], 0
jmp 0x100717b2
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x64
jge 0x1007188f
mov cl, byte [ebp - 0x38]
mov byte [ebp - 0x31], cl
lea edx, [ebp - 0x31]
push edx
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [0x10229c40]
add ecx, 0x4388
call fcn.10072310
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, dword [0x10229c40]
add ecx, 0x4388
call fcn.10015630
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x50]
call fcn.10015a50
mov byte [ebp - 0x32], al
lea ecx, [ebp - 0x5c]
call fcn.10014780
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1007182b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.10014780
nop
jmp 0x1007188f
lea ecx, [ebp - 0x50]
call fcn.10015470
mov ecx, dword [eax + 4]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c8610
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + edx*4 + 0x10]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100af4b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10008ea0
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.10014780
nop
jmp 0x100717a9
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x1c0], 0xff
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1ad], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10150c60
mov esp, ebp
pop ebp
ret
Function at 0x1008b310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ad34d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10226180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x40], 0
jne 0x1008b356
push 0
push str.Unknown_version_type
push 0x10229498
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
push 0x101d129a
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.10008e10
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 4
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
cmp dword [ebp - 0x14], 0
jle 0x1008b3fd
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0xe]
call fcn.100072f0
push eax
lea ecx, [ebp - 0xd]
push ecx
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
lea ecx, [ebp - 0x2c]
call fcn.100215f0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x2c]
call fcn.1001a010
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0x2c]
call fcn.1001a010
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.10008e10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1001a0f0
nop
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1008b800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
add ecx, 8
call fcn.10008c40
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
cmp dword [ebp - 4], 0
jle 0x1008b85c
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 8
call fcn.10008c60
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x10092120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10096ff0
movzx ecx, al
test ecx, ecx
jne 0x10092143
xor al, al
jmp 0x100921db
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 0x10]
push edx
push 4
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
cmp dword [ebp - 8], 0
jle 0x100921d9
mov byte [ebp - 1], 0
lea ecx, [ebp - 2]
call fcn.100072f0
push eax
lea edx, [ebp - 1]
push edx
mov eax, dword [ebp - 8]
add eax, 1
push eax
lea ecx, [ebp - 0x20]
call fcn.100215f0
nop
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.1001a010
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x158], 0
je 0x100921d0
push 0x1a4
push 0x101ebc50
push 0x101ebcb4
push 0x101ebcc0
call fcn.10051890
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.1001a0f0
nop
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x100921f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ad95d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10226180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10229898], 0
je 0x1009222a
cmp dword [0x102298a0], 0
jne 0x1009222c
jmp 0x1009228b
push 0x200
push 0x102298b0
mov eax, dword [0x102298a0]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
push 0x102298b0
lea ecx, [ebp - 0x2c]
call fcn.10008f80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [0x10229898]
mov eax, dword [edx]
mov ecx, dword [0x10229898]
mov edx, dword [eax + 0x6c]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10008ea0
nop
mov eax, dword [0x102a7ebc]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10150c60
mov esp, ebp
pop ebp
ret
Function at 0x10092330
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.IMM32.dll_ImmIsIME]
test eax, eax
je 0x100923b5
mov ecx, dword [0x102298a0]
push ecx
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov dword [ebp - 4], eax
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x1009238d
push 0
push 2
push 0x282
mov eax, dword [0x102298a0]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.IMM32.dll_ImmSetStatusWindowPos]
nop
jmp 0x100923a3
push 0
push 1
push 0x282
mov eax, dword [0x102298a0]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
nop
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x102298a0]
push edx
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
nop
mov eax, dword [0x102a7ebc]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
nop
mov esp, ebp
pop ebp
ret
Function at 0x100954c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101adc8d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10226180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.1008d880
mov byte [ebp - 0xe], al
mov dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
cmp dword [ebp - 0x18], 0
jg 0x10095537
push 0x10b
push str.C:UsersAKINCIDesktop2383000004.0.RPGuarDv2383_ClientSourceRPGuarDv2383N3BASEN3UIList.cpp
push 0x101ecbec
push 0x101ecbfc
call fcn.10051890
add esp, 0x10
cmp dword [ebp - 0x18], 0
jle 0x100955e7
push 0x20
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x134
call fcn.100923d0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x134
call fcn.10054380
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
mov eax, dword [ebp - 0x14]
add eax, 0x150
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
mov eax, dword [ebp - 0x14]
add eax, 0x15c
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
mov eax, dword [ebp - 0x14]
add eax, 0x154
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
mov eax, dword [ebp - 0x14]
add eax, 0x158
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0xd8
call fcn.100833d0
mov dword [ebp - 4], 0
jmp 0x1009560b
lea ecx, [ebp - 0x30]
call fcn.100831d0
nop
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xd8
call fcn.100833a0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.10083210
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x3c]
call fcn.10014780
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x10095667
lea ecx, [ebp - 0x30]
call fcn.100831f0
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.1008cf90
cmp eax, 5
jne 0x10095665
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x130], edx
jmp 0x10095602
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10014780
nop
movzx eax, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10096ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101add4d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10226180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.1008d880
movzx ecx, al
test ecx, ecx
jne 0x10097032
xor al, al
jmp 0x10097172
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0xd8
call fcn.100833d0
mov dword [ebp - 4], 0
jmp 0x10097056
lea ecx, [ebp - 0x30]
call fcn.100831d0
nop
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xd8
call fcn.100833a0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.10083210
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x3c]
call fcn.10014780
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x100970cd
lea ecx, [ebp - 0x30]
call fcn.100831f0
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.1008cf90
cmp eax, 4
jne 0x100970b2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x124], edx
jmp 0x100970cb
mov ecx, dword [ebp - 0x18]
call fcn.1008cf90
cmp eax, 6
jne 0x100970cb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x120], ecx
jmp 0x1009704d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10014780
nop
mov dword [ebp - 0x1c], 0
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
cmp dword [ebp - 0x1c], 0
jle 0x10097170
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0xf]
call fcn.100072f0
push eax
lea edx, [ebp - 0xe]
push edx
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x4c]
call fcn.100215f0
nop
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp - 0x4c]
call fcn.1001a010
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x128], 0
je 0x10097167
push 0x3d
push str.C:UsersAKINCIDesktop2383000004.0.RPGuarDv2383_ClientSourceRPGuarDv2383N3BASEN3UIStatic.cpp
push str.memory_leak
push 0x101ed900
call fcn.10051890
add esp, 0x10
lea ecx, [ebp - 0x4c]
call fcn.1001a0f0
nop
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4