joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ab0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401b20
xor eax, eax
jmp 0x401c01
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x401b38
xor eax, eax
jmp 0x401c01
push ebp
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
add eax, 0x1474
call fcn.00401510
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x57f770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x122000]
push edi
jmp 0x57f78a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x57f791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f780
mov eax, 1
add ebx, ebx
jne 0x57f7a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x57f7b4
jne 0x57f7d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7d3
dec eax
add ebx, ebx
jne 0x57f7c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x57f798
add ebx, ebx
jne 0x57f7cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x57f825
xor ecx, ecx
sub eax, 3
jb 0x57f7eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x57f85a
sar eax, 1
mov ebp, eax
jmp 0x57f7f6
add ebx, ebx
jne 0x57f7f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7c4
inc ecx
add ebx, ebx
jne 0x57f804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7c4
add ebx, ebx
jne 0x57f811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x57f806
jne 0x57f822
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x57f806
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x57f844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x57f836
jmp 0x57f786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x57f844
add edi, ecx
jmp 0x57f786
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x57f862
cmp byte [edi], 0x11
jne 0x57f862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x57f867
lea edi, [esi + 0x178000]
mov eax, dword [edi]
or eax, eax
je 0x57f8df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21931c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x219498]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x57f894
mov ecx, edi
jns 0x57f8c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21949c]
or eax, eax
je 0x57f8d9
mov dword [ebx], eax
add ebx, 4
jmp 0x57f8b1
call dword [esi + 0x2194ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x57f910
cmp al, 0xef
ja 0x57f903
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x57f8e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x57f8f2
mov ebp, dword [esi + 0x2194a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x57f944
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x412d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UzBUtnck
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x412da2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412da9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412d98
mov eax, 1
add ebx, ebx
jne 0x412dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412db0
jne 0x412dcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412db0
xor ecx, ecx
sub eax, 3
jb 0x412de0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412e52
mov ebp, eax
add ebx, ebx
jne 0x412deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412df8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412e1c
inc ecx
add ebx, ebx
jne 0x412e08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412dfd
jne 0x412e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412dfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412e3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412e2d
jmp 0x412d9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412e3c
add edi, ecx
jmp 0x412d9e
pop esi
mov edi, esi
mov ecx, 0x2ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x412e5a
cmp byte [edi], 0
jne 0x412e5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x412e5f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412ece
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x120b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1211c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412e8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12124]
or eax, eax
je 0x412ec8
mov dword [ebx], eax
add ebx, 4
jmp 0x412ea9
call dword [esi + 0x12120]
mov ebp, dword [esi + 0x12128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412f02
sub esp, 0xffffff80
jmp 0x406f9c

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x1004c10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
push str.Cltest1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 9
jge 0x1004c73
push 0x205
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..convert.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.IsCltest1FileStamp_buffer_too_small
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0103742d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1004c99
xor eax, eax
jmp 0x1004d05
push str.Cltest1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov byte [ebp - 0x95], 0
push str.Cltest1
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1004cf0
mov dword [ebp - 0x90], 0
jmp 0x1004cfa
mov dword [ebp - 0x90], 1
mov eax, dword [ebp - 0x90]
jmp 0x1004d05
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10054f0
Capabilities:
Get graphical window text
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
lea eax, [ebp - 0x88]
mov dword [ebp - 8], eax
push 0
push pe_nt_image_headers32
push 4
push 0
push 1
push 0xc0000000
push str.Cltest.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x104c20c], eax
cmp dword [0x104c20c], 0
jne 0x1005577
push 0x225
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago.._view.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Could_not_open_log_file
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x104c2cc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x8c], eax
push 2
push 0
push 0
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1005620
Capabilities:
Get graphical window text
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
lea eax, [ebp - 0x88]
mov dword [ebp - 8], eax
cmp dword [0x104dc40], 0
jne 0x1005647
jmp 0x1005782
cmp dword [0x104c20c], 0
jne 0x1005676
push 0
push pe_nt_image_headers32
push 4
push 0
push 1
push 0xc0000000
push str.Cltest.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x104c20c], eax
cmp dword [0x104c20c], 0
jne 0x10056c6
push 0x261
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago.._view.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Could_not_open_log_file
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x8c], eax
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x104c2cc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push str._r_n_Info_for_Object__r_n
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str._r_n_Info_for_Object__r_n
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x8c]
sub eax, dword [ecx + 0x1c]
push eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x8c]
add eax, dword [ecx + 4]
push eax
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x104c20c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100e3d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0
jne 0x100e429
push 0x1ac
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..client.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Null_Object
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1053f20
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x1053f20
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xb8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov dword [ebp - 4], eax
push str.DoVerb:
mov eax, dword [ebp - 4]
push eax
call fcn.01010260
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100e4b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x100e4e5
push 0
push 0
push 0x400
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x100e596
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.010107a0
test eax, eax
jne 0x100e569
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x100e512
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
jne 0x100e52e
mov dword [ebp - 8], 0x64
mov dword [ebp - 4], 0x64
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 1
mov ebx, dword [ebp - 4]
sub ebx, dword [ebp - 0xc]
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add ebx, eax
add ebx, dword [0x1056428]
push ebx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [0x1056424]
lea eax, [eax + ecx*2]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
push 0x400
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1010400
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.01021e30
test eax, eax
je 0x10104c5
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 0
je 0x10104c0
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0103212a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10104c0
mov eax, dword [0x104d948]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0102e67f
push 0xdd
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..data.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x104d948]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10104fe
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x7c]
test ecx, ecx
je 0x10104fe
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
add eax, 0x7c
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.010105a0
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0xa4], 0
je 0x101058c
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetBkMode]
mov dword [ebp - 4], eax
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0xd
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 3
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10105a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x10105f6
push 0x114
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..data.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Null_Pitem
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
jne 0x1010646
push 0x115
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..data.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Null_Object
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0
jne 0x1010674
jmp 0x101078a
lea edi, [ebp - 0x14]
mov esi, dword [ebp + 0x1c]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
push str.GetData:
mov eax, dword [ebp - 0x1c]
push eax
call fcn.01010260
test eax, eax
je 0x10106d5
jmp 0x101078a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov cx, word [eax]
mov dword [ebp - 0x50], ecx
jmp 0x101076d
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov cx, word [eax]
xor eax, eax
mov ax, word [0x1056da0]
cmp ecx, eax
je 0x1010708
jmp 0x101078a
cmp dword [ebp - 0x18], 0
je 0x1010763
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1010763
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x940
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp + 0x24]
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x101077c
cmp dword [ebp - 0x50], 1
je 0x1010708
jmp 0x10106eb
lea eax, [ebp - 0x28]
push eax
call fcn.01010390
jmp 0x101078a
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x1013c80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x1013cd3
push 0x9f9
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..citem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Null_Pitem
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x1013cfc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x1013d25
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0
je 0x1013d4e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0
je 0x1013d77
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x2c]
cmp dword [eax + 0x30], ecx
je 0x1013dcc
push 0xa12
push str.c:_ntprivatectoleuiole2.0_appscl2testchicago..citem.c
push str.Cl32Test___ansi
push str.Assert_Failure__Module:__s__file__s__line__d_r_n
push 0x1056c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x1056c90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.External_Ref_Count_Not_Null
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104c08c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
leave
ret 4