joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019da71
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push dword [0x1065a1cc]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1019da92
mov eax, dword [eax + 0x74]
mov dword [ebp - 4], eax
jmp 0x1019da97
mov eax, edi
mov dword [ebp - 4], edi
test eax, eax
jne 0x1019daab
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dbab
push eax
push edi
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.101f90a3
test eax, eax
jne 0x1019dace
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dba3
push ebx
mov ebx, dword [ebp + 0x1c]
mov eax, ebx
and eax, 0x31f
cmp eax, ebx
je 0x1019daed
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dba2
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1019db03
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x1019db05
mov esi, edi
test esi, esi
jne 0x1019db13
push 0x80070057
jmp 0x1019db9b
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 8]
je 0x1019db22
push 0x8004001e
jmp 0x1019db9b
cmp dword [eax + 0x10], edi
je 0x1019db4a
mov ecx, esi
call fcn.1019b4c2
test eax, eax
je 0x1019db4a
mov ecx, esi
call fcn.1019b4c2
mov eax, dword [eax + 0x54]
shr eax, 5
test al, 1
je 0x1019db4a
push 0x8004001f
jmp 0x1019db9b
test dword [esi + 0x38], 0x200000
je 0x1019db58
test bl, 1
jne 0x1019db09
mov ecx, dword [ebp + 0x14]
mov eax, ebx
mov edx, dword [ebp + 0x18]
shr eax, 1
test al, 1
je 0x1019db72
xor eax, eax
test ecx, ecx
cmovs ecx, eax
test edx, edx
cmovs edx, eax
mov eax, ebx
shr eax, 8
test al, 1
je 0x1019db81
and ebx, 0xfffffeff
push ebx
push edx
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.101fc1a7
test eax, eax
js 0x1019db9a
xor edi, edi
inc edi
jmp 0x1019dba1
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
lea ecx, [ebp - 0x10]
call fcn.101f8f0d
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1019dbb4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [0x1065a1cc]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1019dbd3
mov ebx, dword [eax + 0x74]
jmp 0x1019dbd5
mov ebx, edi
test ebx, ebx
jne 0x1019dbe9
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dc84
push ebx
push edi
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
call fcn.101f90a3
test eax, eax
jne 0x1019dc09
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dc7c
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1019dc1f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x1019dc21
mov esi, edi
test esi, esi
je 0x1019dc70
test dword [esi + 0x38], 0x200000
je 0x1019dc7b
cmp ebx, dword [esi + 8]
je 0x1019dc3a
push 0x8004001e
jmp 0x1019dc75
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1019dc70
cmp dword [ecx], 0x14
jne 0x1019dc70
mov eax, dword [ecx + 4]
and eax, 7
cmp eax, dword [ecx + 4]
jne 0x1019dc70
mov eax, dword [ecx + 8]
and eax, 1
cmp eax, dword [ecx + 8]
jne 0x1019dc70
push ecx
mov ecx, esi
call fcn.101fe11f
test eax, eax
js 0x1019dc6d
xor edi, edi
inc edi
jmp 0x1019dc7b
push eax
jmp 0x1019dc75
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
lea ecx, [ebp - 0xc]
call fcn.101f8f0d
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1019dc8e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [0x1065a1cc]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1019dcad
mov ebx, dword [eax + 0x74]
jmp 0x1019dcaf
mov ebx, esi
test ebx, ebx
jne 0x1019dcc3
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dd7d
push ebx
push esi
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.101f90a3
test eax, eax
jne 0x1019dce6
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019dd75
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1019dcfc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x1019dcfe
mov edi, esi
test edi, edi
jne 0x1019dd09
push 0x80070057
jmp 0x1019dd6e
cmp ebx, dword [edi + 8]
je 0x1019dd15
push 0x8004001e
jmp 0x1019dd6e
mov eax, dword [ebp + 0xc]
mov ecx, 0x1fffff
and eax, ecx
cmp eax, dword [ebp + 0xc]
jne 0x1019dd02
mov eax, dword [ebp + 0x10]
and eax, ecx
cmp eax, dword [ebp + 0x10]
jne 0x1019dd02
cmp dword [ebx + 0x10], esi
je 0x1019dd56
mov ecx, edi
call fcn.1019b4c2
test eax, eax
je 0x1019dd56
mov ecx, edi
call fcn.1019b4c2
mov eax, dword [eax + 0x54]
shr eax, 5
test al, 1
je 0x1019dd56
push 0x8004001f
jmp 0x1019dd6e
push esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.101faf49
test eax, eax
js 0x1019dd6d
xor esi, esi
inc esi
jmp 0x1019dd74
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
lea ecx, [ebp - 0xc]
call fcn.101f8f0d
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1019dd87
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1019dda3
mov edi, dword [eax + 0x74]
jmp 0x1019dda5
xor edi, edi
test edi, edi
jne 0x1019ddb6
push 0x80040014
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019de2f
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push edi
push 0
push 0
call fcn.101f90a3
test eax, eax
jne 0x1019ddd8
push 0x80070057
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019de27
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1019ddee
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
shr eax, 2
test al, 1
jne 0x1019ddf0
xor esi, esi
test esi, esi
jne 0x1019ddfb
push 0x80070057
jmp 0x1019de05
cmp edi, dword [esi + 8]
je 0x1019de0d
push 0x8004001e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1019de26
mov ecx, esi
call fcn.1019b4c2
mov ecx, dword [eax + 0x50]
test ecx, ecx
je 0x1019de26
push dword [ebp + 0x10]
mov eax, dword [ecx]
push dword [ebp + 0xc]
call dword [eax + 0x3c]
pop esi
lea ecx, [ebp - 0xc]
call fcn.101f8f0d
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x101a00a3
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x101a0127
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x101a0127
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push SysReAllocString
push ebx
push 2
push dword [ebp + 8]
call fcn.10113ed3
push eax
call fcn.1016c893
push eax
push 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x101a0126
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x101a0120
push dword [ebp - 4]
push dword [ebp + 8]
push eax
call fcn.1027ad2a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x101a011e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x101a2cd7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x101a2d51
mov eax, dword [esi]
mov ecx, esi
push 0x10658f48
call dword [eax + 0x20]
test al, al
je 0x101a2d51
push dword [0x10658524]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x101a2d51
push edi
lea edi, [eax + 0x40]
movzx ecx, word [edi]
cmp ecx, 0x23
jae 0x101a2d32
mov edx, ecx
xor eax, eax
test edx, edx
jle 0x101a2d3f
mov ecx, dword [edi + 4]
cmp esi, dword [ecx + eax*8]
je 0x101a2d27
jb 0x101a2d3f
inc eax
cmp eax, edx
jl 0x101a2d19
jmp 0x101a2d3f
lea eax, [eax*8 + 4]
add eax, ecx
jmp 0x101a2d3b
mov edx, esi
mov ecx, edi
call fcn.101a3637
test eax, eax
jne 0x101a2d50
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov ecx, edi
push esi
call fcn.1017f3ca
mov byte [esi + 0x1c], 1
pop edi
pop esi
pop ebp
ret 8
Function at 0x101a44b2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
mov esi, ecx
xorps xmm0, xmm0
push 8
push eax
xor ebx, ebx
push dword [esi + 0x3c]
inc ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.1019c884
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.101a4652
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
test eax, eax
jle 0x101a4641
test edi, edi
jle 0x101a4641
cmp dword [esi + 0xa0], 0
je 0x101a460e
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
call fcn.100de5cf
test eax, eax
jns 0x101a4530
xor bl, bl
jmp 0x101a460e
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.101a51f6
test eax, eax
je 0x101a4557
push eax
call fcn.10178d84
and eax, 0xffffff
push eax
push dword [ebp - 0x18]
call fcn.100de739
mov ecx, dword [ebp - 0x18]
call fcn.100de360
mov dword [ebp - 0x24], eax
test eax, eax
je 0x101a4600
push 0x3e
push eax
push 0x317
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x24]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x1c]
test edi, edi
jle 0x101a45b0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jle 0x101a45a8
mov edx, ecx
or dword [eax], 0xff000000
add eax, 4
sub edx, 1
jne 0x101a459a
sub edi, 1
jne 0x101a4594
mov ecx, dword [ebp - 0x18]
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.100de716
test eax, eax
js 0x101a4600
cmp dword [ebp - 0x20], 0
je 0x101a4600
xor eax, eax
push eax
push ebx
push ebx
push eax
push eax
push 0xffffffffffffffff
push 3
push dword [ebp - 0x20]
call fcn.1017781a
mov ecx, dword [esi + 0x98]
mov dword [esi + 0x98], eax
test ecx, ecx
je 0x101a45f0
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
push 0
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x101a4602
xor bl, bl
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x101a460e
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
cmp dword [ebp - 0x18], 0
je 0x101a461d
lea eax, [ebp - 0x18]
push eax
call fcn.100de6ee
test bl, bl
jne 0x101a4641
push 0x336a7038
call fcn.10153dc1
mov ecx, dword [esi + 0x98]
and dword [esi + 0x98], 0
test ecx, ecx
je 0x101a4641
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret
Function at 0x101a52f2
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x101a534b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x11c]
test byte [esi + 0x86], 8
je 0x101a533d
call fcn.101739f0
test eax, eax
je 0x101a533d
push dword [esi + 0xa4]
mov ecx, eax
call fcn.1017ff02
neg al
sbb al, al
or byte [esi + 0xd1], 0x10
add al, 1
je 0x101a534b
push 0
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.10191c5f

Function at 0x101a69ae
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x101a6ac2
test byte [esi + 0x32], 4
jne 0x101a6ac2
test byte [esi + 0xc8], 8
je 0x101a6ac2
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
lea edi, [ebp - 0x84]
cmp ebx, 0x40
jl 0x101a6a11
push 2
push ebx
call fcn.1016c874
mov edi, eax
test edi, edi
je 0x101a6ac0
test ebx, ebx
jle 0x101a6a28
lea ecx, [ebx + 1]
push ecx
push edi
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x101a6a2d
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.1018d408
test eax, eax
mov ebx, 0x1033341c
cmovne ebx, eax
push ebx
push edi
call fcn.10114dc2
test eax, eax
je 0x101a6aa5
push ebx
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.1018a0ce
mov ebx, eax
test ebx, ebx
je 0x101a6aa5
mov edx, dword [0x1057c2f8]
push 0
mov cx, word [edx + 4]
and cx, 3
movzx eax, cx
mov ecx, ebx
push eax
push edx
call fcn.10180af3
mov esi, eax
push esi
call fcn.101697e2
test al, al
jne 0x101a6a9a
push 0
mov ecx, ebx
call fcn.101c8223
test esi, esi
je 0x101a6aa5
mov ecx, esi
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
mov ecx, dword [ebp - 0x88]
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x101a6ac0
push edi
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret

Function at 0x101a6ad1
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push 3
mov esi, ecx
call fcn.101a5f6b
test byte [esi + 0x32], 4
jne 0x101a6b35
test byte [esi + 0x7d], 0x10
je 0x101a6b0f
mov ecx, esi
call fcn.101a5679
test al, al
je 0x101a6b0b
test byte [esi + 0x7d], 0x80
jne 0x101a6b0b
mov ecx, esi
call fcn.101a525b
test al, al
jne 0x101a6b0f
test byte [esi + 0x7e], 8
je 0x101a6b0f
mov cl, 1
jmp 0x101a6b11
xor cl, cl
mov al, cl
add al, al
xor al, byte [esi + 0xd1]
and al, 2
xor byte [esi + 0xd1], al
test cl, cl
jne 0x101a6b35
push 0
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x101a78e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0xd4]
test eax, eax
je 0x101a7907
cmp dword [eax + 0xb8], 0
jne 0x101a7907
xor eax, eax
jmp 0x101a7995
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
inc ecx
cmp dword [esi + 4], 0x100
jne 0x101a798d
test eax, eax
je 0x101a792b
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x101a792b
mov eax, dword [edx]
push esi
push edx
call dword [eax + 0x14]
mov ecx, eax
push 9
pop edx
cmp dword [esi + 8], edx
jne 0x101a798d
test ecx, ecx
je 0x101a798d
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor eax, eax
push edi
push 8
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
and dword [ebp - 0x18], eax
push 0x10
mov dword [ebp - 0x14], 1
mov word [ebp - 8], dx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x20], ebx
call esi
mov edi, 0x8000
test di, ax
je 0x101a7972
or dword [ebp - 0xc], 0xc
push 0x11
call esi
test di, ax
pop edi
je 0x101a7980
or dword [ebp - 0xc], 3
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.1018ec31
xor ecx, ecx
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x101abb2e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x101abb4e
xor eax, eax
jmp 0x101abbd5
push esi
push 0x101aaf8a
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
cmp dword [esi], eax
je 0x101abbd5
push ebx
push edi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 3
push dword [esi + 0x10]
jmp 0x101abbc2
cmp ebx, dword [esi + 0x14]
je 0x101abbbf
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.101807ff
test eax, eax
js 0x101abbbf
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x101abbbf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
jne 0x101abbe4
push 3
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
mov dword [ebp - 0x38], ebx
test ebx, ebx
jne 0x101abb7d
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret
mov eax, ebx
jmp 0x101abbd3
Function at 0x101ae481
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10658fa4]
push esi
mov esi, dword [ebp + 8]
push edi
cmp eax, 0xffffffff
jne 0x101ae51f
push 0x105
lea eax, [ebp - 0x214]
xor edi, edi
push eax
mov dword [0x10658fa4], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x107
lea eax, [ebp - 0x214]
push eax
push str.msctf.dll
call fcn.102ded4b
mov eax, dword [0x10669e0c]
test eax, eax
jne 0x101ae4f3
push edi
push edi
lea eax, [ebp - 0x214]
push eax
call fcn.10012074
mov dword [0x10669e0c], eax
test eax, eax
je 0x101ae51a
push str.SetInputScope
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10658fa4], eax
test eax, eax
jne 0x101ae527
push dword [0x10669e0c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10669e0c], edi
mov eax, dword [0x10658fa4]
test eax, eax
jne 0x101ae527
xor al, al
jmp 0x101ae534
push dword [ebp + 0xc]
push esi
call eax
xor ecx, ecx
test eax, eax
setns al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8

Function at 0x101b2b4b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 8
mov eax, 0x1032b6a5
call fcn.102790e7
mov esi, ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push dword [ebp + 8]
call fcn.101afce7
push 0xffffffffffffffff
xor ebx, ebx
lea ecx, [ebp - 0x14]
push 0x2e
mov dword [ebp - 4], ebx
call fcn.10192dab
cmp eax, 0xffffffff
je 0x101b2bbf
mov ecx, esi
call fcn.101b36bc
test eax, eax
je 0x101b2bd1
cmp word [eax], bx
je 0x101b2bd1
mov esi, dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push eax
call fcn.101c8ff5
test eax, eax
js 0x101b2bbf
cmp dword [esi], ebx
mov eax, 0x1033341c
cmovne eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x101b2bbf
test al, 0x10
jne 0x101b2bbf
mov bl, 1
lea ecx, [ebp - 0x14]
call fcn.10192551
mov al, bl
call fcn.102790b8
ret 0xc
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
call fcn.101931d9
jmp 0x101b2b9f
Function at 0x101d925c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x64], edi
jne 0x101d92c6
push 0x105
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x107
lea eax, [ebp - 0x214]
push eax
push 0x1057f51c
call fcn.102ded4b
push edi
push edi
lea eax, [ebp - 0x214]
push eax
call fcn.10012074
mov dword [esi + 0x64], eax
test eax, eax
jne 0x101d92c6
push edi
push edi
push 0x1057f534
call fcn.10012074
mov dword [esi + 0x64], eax
mov edx, dword [esi + 0x64]
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
test edx, edx
je 0x101d92fd
mov eax, dword [ebp + 8]
sub eax, edi
je 0x101d92ef
push 2
pop ecx
sub eax, ecx
je 0x101d92ea
sub eax, 1
jne 0x101d92f2
push 4
jmp 0x101d92ec
push 3
pop ecx
jmp 0x101d92f2
xor ecx, ecx
inc ecx
movzx eax, cx
push eax
push edx
call esi
test eax, eax
jne 0x101d9311
cmp dword [ebp + 8], edi
je 0x101d9309
push 0x7f00
jmp 0x101d930e
push 0x7f88
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4

Function at 0x101f8eb9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 2
pop ebx
mov dword [edi], 0x105884d8
lea esi, [edi + 0x18]
cmp dword [esi], 0
je 0x101f8ed9
push dword [esi]
call fcn.101f8e41
and dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x101f8eca
cmp dword [edi + 0xc], ebx
je 0x101f8eee
push dword [edi + 0xc]
call fcn.101936e7
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
mov ecx, eax
call fcn.101f90f5
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.1024c88b
Function at 0x101f92f2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebx], esi
call fcn.1019b4f0
test eax, eax
je 0x101f9326
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
inc dword [eax + 0x98]
mov eax, dword [eax + 0x74]
mov dword [ebx], eax
xor eax, eax
jmp 0x101f93ab
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x101f9345
call fcn.101f92de
test eax, eax
jne 0x101f933e
mov eax, 0x8007000e
jmp 0x101f93aa
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1000
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
lea ecx, [ebp + 8]
push ecx
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
push eax
push esi
push esi
call fcn.101935a1
test eax, eax
jns 0x101f93b3
mov esi, 0x8007000e
cmp dword [ebp + 0xc], 0
je 0x101f938a
push dword [ebp + 0xc]
call fcn.101f949e
and dword [ebp + 0xc], 0
cmp dword [ebp + 8], 0
je 0x101f9398
push dword [ebp + 8]
call fcn.101936e7
test edi, edi
jne 0x101f93a8
call fcn.101f92de
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.1024caa0
mov esi, eax
test esi, esi
js 0x101f9378
test edi, edi
je 0x101f93d1
mov eax, dword [ebp + 0xc]
mov dword [0x10669ec8], eax
jmp 0x101f93e7
mov esi, dword [ebp + 0xc]
call fcn.101f92ca
push esi
mov ecx, eax
call fcn.1024c89e
inc dword [0x10669ed0]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.101f8f94
mov esi, eax
test esi, esi
js 0x101f9378
mov esi, dword [ebp - 4]
test edi, edi
jne 0x101f9410
call fcn.101f92de
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebx], esi
xor eax, eax
jmp 0x101f93aa

Function at 0x101f949e
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push dword [0x1065a1cc]
mov edi, dword [esi + 0x9c]
and edi, 1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x74]
test eax, eax
je 0x101f94cb
push dword [eax + 0xc]
call fcn.10193751
test edi, edi
jne 0x101f94dc
call fcn.101f92ca
push esi
mov ecx, eax
call fcn.1024c8c7
push esi
call fcn.101f91ed
push 0
call fcn.10193751
push 0
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, edi
pop edi
pop esi
jne 0x101f9503
dec dword [0x10669ed0]
pop ebp
ret 4