joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x20], eax
xor al, al
mov cl, 0x5f
mov byte [esp + 9], cl
mov byte [esp + 0xf], cl
mov cl, 0x6f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x14], al
mov byte [esp + 0x17], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1d], al
mov dl, 0x46
mov byte [esp + 0x11], cl
mov byte [esp + 0x13], cl
mov cl, 0x31
push 0x1e
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], 0x4d
mov byte [esp + 0x10], 0x5a
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x75
mov byte [esp + 0x14], 0x62
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x18], 0x47
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1d], 2
mov byte [esp + 0x1e], cl
mov byte [esp + 0x20], 0x30
mov byte [esp + 0x22], 0x32
mov byte [esp + 0x24], cl
call fcn.10001270
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002dd43
add esp, 0x24
ret
Function at 0x10005160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x38], eax
xor al, al
mov cl, 0x31
mov dl, 0x69
mov byte [esp + 0x15], dl
mov byte [esp + 0x18], dl
mov dl, 0x34
mov byte [esp + 9], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x20], al
mov byte [esp + 0x22], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x30], al
mov byte [esp + 0x34], al
push esi
lea eax, [esp + 4]
mov byte [esp + 0xc], 5
mov byte [esp + 0xe], 9
mov byte [esp + 0x12], 0x54
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x35
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x39
mov byte [esp + 0x17], 0x5f
mov byte [esp + 0x18], 0x46
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1b], 0x68
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x20], 4
mov byte [esp + 0x21], cl
mov byte [esp + 0x23], cl
mov byte [esp + 0x25], 0x32
mov byte [esp + 0x27], 0x35
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], 0x39
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2d], 0x33
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], dl
mov byte [esp + 0x31], 0x33
mov byte [esp + 0x33], dl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], dl
mov byte [esp + 0x37], cl
mov ecx, dword [0x47a828]
push eax
push ecx
call fcn.10001220
mov eax, dword [0x1007f0bc]
cmp eax, 3
mov esi, 0xa
ja case.default.0x1000525c
jmp dword [eax*4 + 0x100052c4]
sub dword [esp + 4], esi
jmp case.default.0x1000525c
sub dword [esp + 8], esi
jmp case.default.0x1000525c
add dword [esp + 4], esi
jmp case.default.0x1000525c
add dword [esp + 8], esi
mov eax, dword [esp + 4]
push esi
lea edx, [esp + 0x33]
push edx
push eax
call fcn.1002e215
mov edx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x45]
push ecx
push edx
call fcn.1002e215
mov al, byte [0x1007f0c0]
add byte [esp + 0x43], al
add esp, 0x18
push 0x2d
lea ecx, [esp + 0x10]
push ecx
call fcn.10001270
mov ecx, dword [esp + 0x3c]
pop esi
xor ecx, esp
call fcn.1002dd43
add esp, 0x3c
ret

Function at 0x100052e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x1c], eax
xor al, al
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov cl, 0x31
mov byte [esp + 0x13], al
mov byte [esp + 0x16], al
mov byte [esp + 0x18], al
mov dl, 0x69
push 0x19
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x54
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], 0x35
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], 0x39
mov byte [esp + 0x13], 0x5f
mov byte [esp + 0x14], 0x46
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x73
mov byte [esp + 0x17], 0x68
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1c], 1
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1f], 0x32
call fcn.10001270
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002dd43
add esp, 0x20
ret
Function at 0x10005380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x1c], eax
xor al, al
mov cl, 0x31
mov byte [esp + 7], cl
mov byte [esp + 9], cl
mov cl, 0x69
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1a], al
mov dl, 0x46
mov byte [esp + 0x10], cl
mov byte [esp + 0x13], cl
mov cl, 0x6f
push 0x1b
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x54
mov byte [esp + 0x10], 0x35
mov byte [esp + 0x12], 0x39
mov byte [esp + 0x13], 0x5f
mov byte [esp + 0x14], 0x42
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], dl
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], 0x68
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x67
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x64
call fcn.10001270
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002dd43
add esp, 0x20
ret
cmp dword [0x1007f0b0], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x100054e2
call edi
mov ecx, dword [0x1007bb24]
mov edx, dword [0x1007bb20]
lea ecx, [ecx + edx + 0x3e8]
cmp ecx, eax
jae 0x100054e2
mov dword [0x1007bb20], eax
mov eax, dword [0x1007f0b4]
sub eax, 0
je 0x100054d3
sub eax, 1
jne 0x100054e2
push 0x108
mov dword [0x1007bb24], 0
call fcn.1002ba20
mov esi, eax
push 4
add esi, 0x140
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100054e2
cmp dword [esi], eax
je 0x100054e2
mov eax, dword [0x1007bb1c]
add eax, 1
cmp eax, dword [0x1007f0c4]
mov dword [0x1007bb1c], eax
jbe 0x100054e2
call fcn.100052e0
mov dword [0x1007bb1c], 0
mov dword [0x1007f0b4], 0
jmp 0x100054e2
call fcn.10005160
mov dword [0x1007bb24], 0x1f40
cmp dword [0x1007f0b8], 0
je 0x1000552f
call edi
mov edx, dword [0x1007bb18]
add edx, 0x190
cmp edx, eax
jae 0x1000552f
push 0x100416c8
push 0x100416c0
mov dword [0x1007bb18], eax
call fcn.10023e40
test eax, eax
jne 0x1000552f
push 0x100416b0
push 0x100416c0
call fcn.10023e40
test eax, eax
jne 0x1000552f
pop edi
pop esi
jmp 0x10005380
pop edi
pop esi
ret
Function at 0x10005540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x28], eax
xor al, al
mov cl, 0x47
mov byte [esp + 6], cl
mov byte [esp + 0xd], cl
mov cl, 0x65
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov dl, 0x68
mov byte [esp + 0x1f], al
mov byte [esp + 0x22], al
mov byte [esp + 0x24], al
mov byte [esp + 0xe], cl
mov byte [esp + 0x15], cl
mov cl, 0x69
push 0x25
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x59
mov byte [esp + 0x10], 0x5f
mov byte [esp + 0x11], 0x43
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x59
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x43
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], cl
mov byte [esp + 0x28], 1
mov byte [esp + 0x29], 0x31
mov byte [esp + 0x2b], 0x33
call fcn.10001270
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1002dd43
add esp, 0x2c
ret

Function at 0x10005620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x28], eax
xor al, al
mov dl, 0x59
mov cl, 0x61
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x20], al
mov byte [esp + 0x23], al
mov byte [esp + 0x25], al
mov byte [esp + 7], dl
mov byte [esp + 0xb], cl
mov byte [esp + 0x11], cl
mov cl, 0x31
mov byte [esp + 0x16], dl
mov dl, 0x69
push 0x25
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x47
mov byte [esp + 0x10], 0x5f
mov byte [esp + 0x11], 0x43
mov byte [esp + 0x12], 0x68
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x47
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0x4c
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x46
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x68
mov byte [esp + 0x29], 1
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2c], cl
call fcn.10001270
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1002dd43
add esp, 0x2c
ret
Function at 0x10005870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov al, byte [0x1007f0e8]
mov byte [esp + 9], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], cl
mov dl, 0x53
push 0x22
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x5a
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 1
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002dd43
add esp, 0x28
ret
sub esp, 0x28
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov dl, 0x5a
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov al, byte [0x1007f0e8]
mov byte [esp + 9], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 6], dl
mov byte [esp + 0xe], dl
mov dl, 0x73
push 0x24
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x47
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x27], 1
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x2a], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002dd43
add esp, 0x28
ret
cmp dword [0x1007f0e4], 0
je 0x10005a7a
call fcn.10007540
mov ecx, dword [0x1007bb30]
add ecx, 0xee48
cmp ecx, eax
jae 0x10005a7a
cmp dword [0x1007bb2c], 0
mov dword [0x1007bb30], eax
jne 0x10005a6b
mov dword [0x1007bb2c], 1
jmp 0x10005870
mov dword [0x1007bb2c], 0
jmp 0x10005950
ret
call fcn.10004e20
call fcn.10005430
call fcn.10005700
jmp 0x10005a30
Function at 0x10005950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
mov al, byte [0x1007f0e8]
mov byte [esp + 9], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], cl
mov dl, 0x53
push 0x22
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xe], 0x5a
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0x5a
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], dl
mov byte [esp + 0x25], 1
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x28], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002dd43
add esp, 0x28
ret
sub esp, 0x28
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x24], eax
xor al, al
mov cl, 0x4f
mov dl, 0x5a
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x21], al
mov byte [esp + 0x23], al
mov al, byte [0x1007f0e8]
mov byte [esp + 9], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 6], dl
mov byte [esp + 0xe], dl
mov dl, 0x73
push 0x24
lea ecx, [esp + 4]
add al, 0x31
push ecx
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x41
mov byte [esp + 0x12], 0x57
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x17], 0x6a
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], dl
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], 0x47
mov byte [esp + 0x24], 0x44
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x27], 1
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x2a], al
call fcn.10001270
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002dd43
add esp, 0x28
ret
cmp dword [0x1007f0e4], 0
je 0x10005a7a
call fcn.10007540
mov ecx, dword [0x1007bb30]
add ecx, 0xee48
cmp ecx, eax
jae 0x10005a7a
cmp dword [0x1007bb2c], 0
mov dword [0x1007bb30], eax
jne 0x10005a6b
mov dword [0x1007bb2c], 1
jmp 0x10005870
mov dword [0x1007bb2c], 0
jmp 0x10005950
ret
call fcn.10004e20
call fcn.10005430
call fcn.10005700
jmp 0x10005a30
Function at 0x100081d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x10008221
cmp eax, 6
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x10008202
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x10073510]
push 0
push ecx
call edi
cmp esi, 6
jae 0x10008216
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x10073510]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x10008230
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x10008281
cmp eax, 5
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x10008262
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x10073588]
push 0
push ecx
call edi
cmp esi, 5
jae 0x10008276
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x10073588]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10008290
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x482
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100083e4
push ebx
push ebp
push 0x482
push esi
call edi
mov ebp, eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x4c], 0xffffffff
mov ebx, 0x10073504
jmp 0x100082e0
mov edx, dword [ebx]
mov eax, dword [ebx - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x1307
push ebp
mov dword [esp + 0x54], eax
call esi
mov eax, dword [ebx + 8]
movzx ecx, word [ebx + 4]
mov edx, dword [0x1007c3b0]
push 0
push eax
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x18]
push eax
push 0
push 0x130a
push ebp
call esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x28]
push ecx
push ebp
call esi
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, dword [esp + 0x20]
mov edi, ecx
sub edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
add edi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
jns 0x100083aa
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 0xc]
push 1
push 0
push 0
push 0x15
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 0x14
cmp ebx, 0x1007357c
jl 0x100082e0
push 0xffffffffffffffff
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebp
call fcn.100081d0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x44
ret 4
Function at 0x100083f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x484
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10008563
push ebp
push 0x484
push esi
call edi
cmp dword [0x10082038], 2
mov ebp, eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x48], 0xffffffff
mov eax, 5
jne 0x10008444
mov eax, 1
test eax, eax
jle 0x1000854f
push ebx
mov ebx, 0x1007357c
mov dword [esp + 0x58], eax
jmp 0x10008460
mov edx, dword [ebx]
mov eax, dword [ebx - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0x1307
push ebp
mov dword [esp + 0x54], eax
call esi
mov eax, dword [ebx + 8]
movzx ecx, word [ebx + 4]
mov edx, dword [0x1007c3b0]
push 0
push eax
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x18]
push eax
push 0
push 0x130a
push ebp
call esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x28]
push ecx
push ebp
call esi
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x34], edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub esi, dword [esp + 0x20]
mov edi, ecx
sub edi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
add edi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
jns 0x1000852a
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 0xc]
push 1
push 0
push 0
push 0x15
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add ebx, 0x14
sub dword [esp + 0x58], 1
jne 0x10008460
pop ebx
push 0xffffffffffffffff
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebp
call fcn.10008230
pop ebp
pop edi
pop esi
add esp, 0x44
ret 4

Function at 0x10008570
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
cmp eax, esi
je 0x100085c1
cmp eax, 9
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jae 0x100085a2
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x10073458]
push 0
push ecx
call edi
cmp esi, 9
jae 0x100085b6
lea edx, [esi + esi*4]
mov eax, dword [edx*4 + 0x10073458]
push 5
push eax
call edi
push esi
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10009ce0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.100099c0
cmp dword [esp + 0x4c], 0
je 0x10009d24
add eax, 1
cmp eax, 0xd
jb 0x10009d32
xor eax, eax
jmp 0x10009d32
test eax, eax
je 0x10009d2d
sub eax, 1
jmp 0x10009d32
mov eax, 0xc
push eax
push esi
call fcn.10009ba0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002dd43
add esp, 0x38
ret 0xc

Function at 0x10009d60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10009960
cmp dword [esp + 0x4c], 0
je 0x10009da4
add eax, 1
cmp eax, 7
jb 0x10009db2
xor eax, eax
jmp 0x10009db2
test eax, eax
je 0x10009dad
sub eax, 1
jmp 0x10009db2
mov eax, 6
push eax
push esi
call fcn.10009bd0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002dd43
add esp, 0x38
ret 0xc

Function at 0x10009de0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10009a20
cmp dword [esp + 0x4c], 0
je 0x10009e24
add eax, 1
cmp eax, 0xa
jb 0x10009e32
xor eax, eax
jmp 0x10009e32
test eax, eax
je 0x10009e2d
sub eax, 1
jmp 0x10009e32
mov eax, 9
push eax
push esi
call fcn.10009c00
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002dd43
add esp, 0x38
ret 0xc

Function at 0x10009e60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
push 0x32
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push esi
call fcn.10009a80
cmp dword [esp + 0x4c], 0
je 0x10009ea4
add eax, 1
cmp eax, 6
jb 0x10009eb2
xor eax, eax
jmp 0x10009eb2
test eax, eax
je 0x10009ead
sub eax, 1
jmp 0x10009eb2
mov eax, 5
push eax
push esi
call fcn.10009c30
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1002dd43
add esp, 0x38
ret 0xc