joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, edx
push ebx
lea edx, [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x30
mov dword [ebp - 0xc], 0
call dbg.registry_get_handle
test eax, eax
je 0x404fd0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
shl ebx, 2
mov dword [esp + 0x14], 4
add esi, ebx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
mov dword [esp + 0x14], 4
add ebx, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegSetValueExW_24
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x405060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [eax*4]
lea eax, [ebp - 0x24]
lea esi, [ecx + ebx]
mov ecx, edx
lea edx, [ebp - 0x20]
sub esp, 0x3c
add ebx, dword [ebp + 8]
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp - 0x20], 0
call dbg.registry_get_handle
test eax, eax
jne 0x4050bf
cmp dword [ebp - 0x20], 2
je 0x4050d0
mov dword [esi], 0xf
xor eax, eax
test edi, edi
sete al
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._RegQueryValueExW_24
lea edx, [ebp - 0x1c]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x405118
mov dword [esi], 0xf
cmp eax, 2
jne 0x4050a8
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
je 0x4050b1
jmp 0x4050a8
Function at 0x405160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Options
mov ebp, esp
sub esp, 0x68
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
call dbg.registry_get_handle
test eax, eax
je 0x4051c0
mov ecx, str.Settings
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
call dbg.registry_get_handle
test eax, eax
je 0x4051a0
leave
ret
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dbg.registry_set_previewpages
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetWindowPlacement_8
xor eax, eax
sub esp, 8
cmp dword [ebp - 0x2c], 3
sete al
mov dword [esp + 0x14], 0x10
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call sym._RegSetValueExW_24
lea eax, [ebp - 0x38]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call sym._RegSetValueExW_24
mov eax, dword [ebp - 0x40]
sub esp, 0x18
mov dword [esp], eax
call dbg.registry_set_pagemargins
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x405181

Function at 0x405270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
call dbg.registry_get_handle
test eax, eax
je 0x4052d0
test ebx, ebx
je 0x4052ba
mov dword [ebx], 0
mov dword [ebx + 8], 0x258
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0x12c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegCloseKey_4
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x40529b
cmp dword [ebp - 0xc], 0x10
jne 0x40529b
jmp 0x4052ba

Function at 0x405310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 4
call dbg.registry_get_handle
test eax, eax
je 0x405358
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegCloseKey_4
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x40533b
cmp dword [ebp - 0xc], 4
jne 0x40533b
jmp 0x405341
Function at 0x405940
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Recent_file_list
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x6c]
push ebx
sub esp, 0x9c
mov edi, dword [ebp + 8]
call dbg.registry_get_handle
test eax, eax
je 0x405980
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.registry_read_filelist
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov esi, 0x3ed
mov dword [esp], eax
call sym._GetMenu_4
mov dword [ebp - 0x48], 0x30
mov dword [ebp - 0x44], 0x20
sub esp, 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x7c], ebx
mov ebx, esi
mov esi, eax
lea eax, [ebp - 0x48]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._GetMenuItemInfoW_16
sub esp, 0x10
test eax, eax
je 0x4059fd
mov eax, dword [ebp - 0x28]
mov dword [ebp + ebx*4 - 0x100c], eax
add ebx, 1
cmp ebx, 0x3f1
jne 0x4059c6
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x7c]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x405ad8
xor edx, edx
mov dword [ebp - 0x80], ebx
mov ebx, edx
mov eax, dword [ebp + ebx*4 - 0x58]
test eax, eax
je 0x405a4b
mov dword [esp + 4], edi
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x405af7
add ebx, 1
cmp ebx, 4
jne 0x405a27
mov eax, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x80]
test eax, eax
je 0x405a67
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x54], eax
lea esi, [ebp - 0x64]
test edi, edi
je 0x405ad8
add ebx, 1
mov dword [esp + 4], str.File_d
mov dword [esp + 8], ebx
mov dword [esp], esi
call sym._wsprintfW
cmp word [edi], 0
je 0x405af0
mov eax, edi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405a90
sub eax, edi
add eax, 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
cmp ebx, 4
je 0x405ad8
mov edi, dword [ebp + ebx*4 - 0x58]
jmp 0x405a6a
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x405963
mov eax, 2
jmp 0x405a9e
mov edx, ebx
mov ebx, dword [ebp - 0x80]
test edx, edx
je 0x405a67
lea eax, [ebp - 0x58]
shl edx, 2
mov dword [esp + 4], eax
lea eax, [ebp - 0x54]
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._memmove
jmp 0x405a67

Function at 0x405bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call dbg.registry_read_formatopts
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp dbg.registry_read_formatopts
Function at 0x405c10
Capabilities:
Set registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call dbg.registry_set_formatopts
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp dbg.registry_set_formatopts

Function at 0x406570
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x4065c1
cmp dword [ebp - 0x1c], ebx
je 0x4065d0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi], ebx
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10

Function at 0x4067c0
Capabilities:
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x406813
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
Function at 0x4069b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 8]
movzx ecx, word [esi + 0x1c]
mov dword [ebp - 0x1c], eax
cmp cx, 0x40
je 0x406b44
mov ebx, dword [edi + 4]
mov edx, dword [edi + 8]
lea eax, [ebx + 1]
cmp edx, eax
jae 0x406a90
cmp eax, 0x1fffffff
ja 0x406b44
mov ebx, 4
cmp edx, ebx
cmovae ebx, edx
cmp ebx, eax
jae 0x406a32
cmp edx, 0xfffffff
jbe 0x406a2c
jmp 0x406b60
cmp ebx, 0xfffffff
ja 0x406b60
add ebx, ebx
cmp ebx, eax
jb 0x406a20
lea edx, [ebx*8]
mov eax, dword [edi]
test eax, eax
je 0x406b80
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov dword [ebp - 0x24], eax
sub esp, 0x10
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x406b44
mov dword [edi + 8], ebx
mov ebx, dword [edi + 4]
mov dword [edi], eax
movzx ecx, word [esi + 0x1c]
jmp 0x406a95
mov eax, dword [edi]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
and eax, 1
mov dword [ebp - 0x28], eax
je 0x406aae
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
sub eax, dword [edx + 0xc]
shl eax, 0x10
mov dword [ebp - 0x28], eax
lea edx, [esi + 0x1c]
test cx, cx
je 0x406bb0
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x406ac0
sub eax, edx
add eax, 2
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
lea edx, [ebx*8]
mov dword [ebp - 0x24], edx
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [edx], eax
mov eax, dword [edi]
mov edx, dword [ebp - 0x24]
mov ebx, dword [eax + ebx*8]
xor eax, eax
lea esi, [esi]
movzx ecx, word [esi + eax + 0x1c]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x406b20
movzx eax, word [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
mov ecx, dword [edi]
or eax, esi
mov dword [ecx + edx + 4], eax
add dword [edi + 4], 1
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp ebx, eax
jae 0x406a32
mov edx, 0xfffffff8
mov ebx, 0x1fffffff
jmp 0x406a39
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x24], eax
sub esp, 0xc
jmp 0x406a6f
mov dword [ebp - 0x2c], 2
jmp 0x406ad1
Function at 0x4075e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x6f8]
push ebx
sub esp, 0x71c
mov dword [esp + 4], 0x7d4
mov eax, dword [0x41a708]
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call sym._SendMessageW_16
mov ecx, 0x1c
lea edx, [ebp - 0x6fc]
mov dword [ebp - 0x6fc], 0x74
mov esi, eax
xor eax, eax
sub esp, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], edx
lea edi, [ebp - 0x612]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov eax, dword [0x41a704]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], esi
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
jne 0x4076b8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.kernel32.dll_lstrcmpW]
lea ecx, [ebp - 0x6e2]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [ebp - 0x70c], eax
call eax
sub esp, 8
test eax, eax
je 0x407720
lea ecx, [ebp - 0x6e2]
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
call sym._SendMessageW_16
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 4], 0x7de
call sym._GetDlgItem_8
sub esp, 8
call dbg.populate_size_list
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x710], eax
lea edi, [ebp - 0x684]
lea ebx, [ebp - 0x688]
mov dword [esp + 4], 0x7d4
mov eax, dword [0x41a708]
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call sym._SendMessageW_16
mov ecx, 0x1c
mov dword [ebp - 0x688], 0x74
mov esi, eax
mov eax, dword [ebp - 0x710]
sub esp, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], ebx
lea edi, [ebp - 0x414]
lea ebx, [ebp - 0x216]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov eax, dword [0x41a704]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], esi
call sym._SendMessageW_16
mov ecx, dword [ebp - 0x67c]
mov eax, 0x66666667
sub esp, 0x10
imul ecx
sar ecx, 0x1f
mov dword [esp + 4], 0x411cf8
mov dword [esp], ebx
sar edx, 3
sub edx, ecx
mov dword [esp + 8], edx
call sym._wsprintfW
mov dword [esp + 4], ebx
mov dword [esp], edi
mov eax, dword [ebp - 0x70c]
call eax
sub esp, 8
test eax, eax
je 0x4076aa
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], esi
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x4076aa
Function at 0x407850
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [0x41a708]
mov dword [esp + 4], 0x7d0
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
test ebx, ebx
je 0x4078b0
mov dword [esp + 4], 5
mov dword [esp], eax
call sym._ShowWindow_8
mov eax, dword [0x410284]
sub esp, 8
mov dword [esp], eax
call sym._reg_formatindex
mov ebx, dword [ebp - 4]
mov edx, dword [eax*4 + 0x41a6e8]
or edx, 2
mov dword [eax*4 + 0x41a6e8], edx
leave
ret
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._ShowWindow_8
mov eax, dword [0x410284]
sub esp, 8
mov dword [esp], eax
call sym._reg_formatindex
mov ebx, dword [ebp - 4]
mov edx, dword [eax*4 + 0x41a6e8]
and edx, 0xfffffffd
mov dword [eax*4 + 0x41a6e8], edx
leave
ret

Function at 0x4078f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
test eax, eax
je 0x407a70
cmp word [eax], 0
je 0x407a94
mov edx, eax
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x407910
cmp eax, edx
jb 0x40792a
jmp 0x407abd
mov edx, ebx
movzx ecx, word [edx]
cmp cx, 0x5c
je 0x407a88
cmp cx, 0x2f
je 0x407a88
lea ebx, [edx - 2]
cmp eax, ebx
jb 0x407928
movzx eax, word [edx - 2]
test ax, ax
je 0x407ab3
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x407960
sub eax, ebx
add eax, 0x20
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x407a69
cmp word [ebx], 0
je 0x407aac
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4079b0
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._memcpy
cmp word [ebx], 0
je 0x407aa0
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x4079e0
sub eax, ebx
lea edx, [eax + 6]
add eax, esi
mov ecx, 0x20
mov dword [eax], 0x2d0020
xor ebx, ebx
mov word [eax + 4], cx
lea eax, [esi + edx]
mov dword [eax], 0x690057
mov dword [eax + 4], 0x65006e
mov dword [eax + 8], 0x570020
mov dword [eax + 0xc], 0x72006f
mov dword [eax + 0x10], 0x700064
mov dword [eax + 0x14], 0x640061
mov word [eax + 0x18], bx
mov dword [esp + 4], esi
mov eax, dword [0x41a708]
mov dword [esp], eax
call sym._SetWindowTextW_8
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
movzx eax, word [0x419aa0]
mov ebx, 0x419aa0
jmp 0x40794c
movzx eax, word [edx + 2]
lea ebx, [edx + 2]
jmp 0x40794c
mov ebx, eax
mov eax, 0x20
jmp 0x40796e
mov eax, esi
mov edx, 6
jmp 0x4079f0
xor eax, eax
jmp 0x4079bb
mov eax, 0x20
jmp 0x40796e
mov ebx, edx
mov eax, 0x20
jmp 0x40796e
Function at 0x407bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x5c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x407db8
mov edi, eax
lea edx, [ebp - 0x24]
cmp ebx, 0x11
je 0x407d70
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], dbg.stream_out
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x44a
mov eax, dword [0x41a704]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov dword [ebp - 0x3c], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x41a704]
sub esp, 4
mov dword [esp], eax
call sym._SetFocus_4
mov edx, dword [ebp - 0x3c]
sub esp, 4
test edx, edx
je 0x407d20
xor eax, eax
lea esi, [esi]
lea esi, [esi]
movzx edx, word [esi + eax]
add eax, 2
mov word [eax + 0x41a4de], dx
test dx, dx
jne 0x407c90
mov eax, 0x41a4e0
call dbg.set_caption
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov eax, dword [0x41a704]
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [0x410284], ebx
sub esp, 0x10
call dbg.set_bar_states
call dbg.set_default_font
mov eax, dword [0x410284]
mov dword [esp], eax
call sym._reg_formatindex
mov eax, dword [eax*4 + 0x41a6f0]
mov dword [esp + 4], eax
mov eax, dword [0x41a708]
mov dword [esp], eax
call dbg.target_device
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x45f
mov eax, dword [0x41a704]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
je 0x407c84
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], global_unicode
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea edx, [ebp - 0x24]
sub esp, 0x14
cmp dword [ebp - 0x24], 2
je 0x407c30
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
sub esp, 4
jmp 0x407d5f
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x411d18
movzx eax, al
add eax, 0x6ab
mov dword [esp + 4], eax
mov eax, dword [0x41a708]
mov dword [esp], eax
call sym._MessageBoxW_16
xor eax, eax
sub esp, 0x10
jmp 0x407d5f
Function at 0x407fc0
Capabilities:
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x41a704]
cmp word [0x41a4e0], 0
jne 0x408017
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 0x4b0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call sym._SendMessageW_16
mov edx, eax
sub esp, 0x10
mov eax, dword [0x41a704]
test edx, edx
je 0x408136
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb8
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
je 0x408136
cmp word [0x41a4e0], 0
movzx eax, word [0x419aa0]
mov ebx, 0x419aa0
jne 0x408148
test ax, ax
je 0x4081a0
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x408070
sub eax, ebx
sar eax, 1
cmp word [0x4198a0], 0
je 0x4080a3
mov edx, 0x4198a0
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x408090
sub edx, 0x4198a0
sar edx, 1
add eax, edx
add eax, eax
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x408190
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4198a0
mov dword [esp], eax
call sym._wsprintfW
mov dword [esp + 0xc], 0x33
mov dword [esp + 8], 0x411d18
mov dword [esp + 4], esi
mov eax, dword [0x41a708]
mov dword [esp], eax
call sym._MessageBoxW_16
sub esp, 0x10
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp ebx, 6
je 0x4081b0
cmp ebx, 7
jne 0x408190
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x41a4e0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x408150
cmp eax, 0x41a4e0
ja 0x40816a
jmp 0x4081f4
mov eax, ebx
movzx edx, word [eax]
cmp dx, 0x5c
je 0x4081d8
cmp dx, 0x2f
je 0x4081d8
lea ebx, [eax - 2]
cmp ebx, 0x41a4e0
ja 0x408168
movzx eax, word [eax - 2]
jmp 0x40805c
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40807d
cmp word [0x41a4e0], 0
je 0x4081e8
mov edx, dword [0x410284]
lea esp, [ebp - 0xc]
mov eax, 0x41a4e0
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.DoSaveFile
lea ebx, [eax + 2]
movzx eax, word [eax + 2]
jmp 0x40805c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.DialogSaveFile
mov ebx, eax
xor eax, eax
jmp 0x40807d