joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100108d0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x10050050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0xa8], eax
mov dword [eax], edx
mov eax, dword [ebp + 8]
movzx eax, word [eax]
push edi
xor edi, edi
mov dword [ebp - 0xac], ecx
cmp eax, 0x61
jb 0x10010912
cmp eax, 0x7a
jbe 0x10010924
cmp eax, 0x41
jb 0x10010a49
cmp eax, 0x5a
ja 0x10010a49
push ebx
push esi
xor ebx, ebx
xor ecx, ecx
xor esi, esi
test ax, ax
je 0x100109e2
cmp ax, 0x3d
je 0x100109e2
cmp ax, 0x5b
jne 0x1001094c
mov edx, 1
jmp 0x10010950
test edx, edx
je 0x10010968
cmp ecx, 0x3f
jge 0x1001095e
mov word [ebp + edi*2 - 0xa4], ax
inc edi
cmp ax, 0x5d
jne 0x100109d0
xor edx, edx
jmp 0x100109d0
cmp ax, 0x61
jb 0x10010974
cmp ax, 0x7a
jbe 0x100109ba
cmp ax, 0x41
jb 0x10010980
cmp ax, 0x5a
jbe 0x100109ba
cmp ax, 0x5f
jne 0x10010990
test esi, esi
je 0x10010a47
jmp 0x100109c0
cmp ax, 0x3a
jne 0x100109a0
test esi, esi
je 0x10010a47
jmp 0x100109c5
cmp ax, 0x30
jb 0x100109b0
cmp ax, 0x39
ja 0x100109b0
test ebx, ebx
jne 0x100109ba
cmp ax, 0x3b
jne 0x10010a47
cmp ax, 0x5f
jne 0x100109c5
mov ebx, 1
cmp ecx, 0xf
jge 0x100109d0
mov word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp + 8]
movzx eax, word [eax + esi*2 + 2]
inc esi
test ax, ax
jne 0x10010935
mov edx, dword [ebp + 8]
cmp word [edx + esi*2], 0x3d
jne 0x10010a47
mov edx, dword [ebp - 0xb0]
xor eax, eax
mov word [ebp + ecx*2 - 0x24], ax
xor ecx, ecx
lea eax, [ebp - 0x24]
mov word [ebp + edi*2 - 0xa4], cx
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10010a10
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa4]
mov ecx, eax
sub edx, ecx
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10010a30
mov edx, dword [ebp - 0xa8]
mov dword [edx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1002656f
mov esp, ebp
pop ebp
ret
Function at 0x10010fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10050050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10755018]
cmp dword [eax + 0x21a864], 0
push ebx
push esi
push edi
je 0x10010ffa
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002656f
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea esp, [esp]
mov ecx, dword [0x107cb6b0]
lea edi, [ebx + ecx + 0x433c]
call fcn.10010f60
lea esi, [ebp - 0x418]
test eax, eax
je 0x10011023
call fcn.10015090
jmp 0x10011028
call fcn.100150d0
test eax, eax
je 0x1001103f
lea eax, [ebp - 0x210]
mov ecx, edi
lea edx, [ebp - 0x418]
call fcn.10015110
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10011092
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011060
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x212], 0x69
jne 0x10011092
cmp word [ebp + eax*2 - 0x214], 0x6e
jne 0x10011092
lea eax, [ebp - 0x210]
call fcn.10010ed0
jmp 0x100110bf
mov edx, dword [0x107cb6b0]
mov eax, 0x10045a28
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + edx + 0x433c]
jmp 0x100110b0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100110b0
add ebx, 0x200
cmp ebx, 0x4000
jl 0x10011000
mov ecx, dword [0x10755018]
mov eax, 1
mov dword [ecx + 0x21a864], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002656f
mov esp, ebp
pop ebp
ret
Function at 0x10012a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
xor edi, edi
cmp dword [0x10755018], edi
jne 0x10012aa8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
and ecx, 0x1f
cmp ecx, 0x19
ja 0x10012cb7
mov edx, dword [ebp + 8]
mov eax, edx
shr eax, 5
and eax, 0x3f
cmp eax, 0x23
ja 0x10012cb7
push esi
xor esi, esi
cmp si, cx
je 0x10012ae7
mov esi, 0x18
cmp si, cx
je 0x10012ae7
mov esi, 0x19
cmp si, cx
jne 0x10012b0e
xor ecx, ecx
cmp cx, ax
je 0x10012c4d
mov ecx, 0x22
cmp cx, ax
je 0x10012c4d
mov ecx, 0x23
cmp cx, ax
je 0x10012c4d
mov ecx, dword [0x10755018]
xor eax, eax
mov word [ebx], ax
mov eax, dword [ecx + 0x2254e8]
xor esi, esi
mov dword [ebp - 8], eax
test eax, eax
jle 0x10012ca9
movzx edx, dx
and edx, 0x1f
add ecx, 0x21a878
mov dword [ebp - 4], ecx
jmp 0x10012b40
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, eax
shr ecx, 8
and ecx, 0x1f
cmp edx, ecx
jne 0x10012b61
movzx ecx, word [ebp + 8]
shr eax, 8
xor eax, ecx
test eax, 0x7e0
je 0x10012b79
add dword [ebp - 4], 0x60
inc esi
cmp esi, dword [ebp - 8]
jl 0x10012b40
xor edx, edx
pop esi
mov word [ebx + edi*2], dx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], edi
mov dword [ebp - 8], 1
movzx edx, word [ebp + 8]
shr edx, 0xb
test byte [ebp - 8], dl
je 0x10012bed
mov ecx, edi
inc edi
test ecx, ecx
je 0x10012ba8
mov edx, dword [ebp + 0xc]
push 0x10046cd4
push edx
push ebx
call fcn.10026be2
add esp, 0xc
mov ecx, dword [0x10755018]
lea eax, [esi + esi*2]
shl eax, 5
lea edx, [eax + ecx + 0x21a868]
mov eax, dword [ebp + 0xc]
push edx
push eax
push ebx
call fcn.10026be2
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, 1
xor edx, edx
call fcn.1003cd10
mov ecx, dword [eax*4 + 0x1005a320]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push ebx
call fcn.10026be2
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
rol ecx, 1
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp eax, 3
jle 0x10012b83
test edi, edi
jne 0x10012c25
mov eax, dword [0x10755018]
lea edx, [esi + esi*2]
shl edx, 5
lea ecx, [edx + eax + 0x21a868]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push ebx
call fcn.10026c57
add esp, 0xc
mov eax, ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012c30
sub eax, edx
sar eax, 1
mov edi, eax
xor edx, edx
pop esi
mov word [ebx + edi*2], dx
pop edi
mov esp, ebp
pop ebp
ret
movzx eax, dx
mov ecx, eax
and ecx, 0x1f
mov edx, dword [ecx*4 + 0x1005a228]
movzx ecx, word [edx]
shr eax, 5
and eax, 0x3f
mov eax, dword [eax*4 + 0x1005a290]
test cx, cx
je 0x10012c89
mov esi, dword [ebp + 0xc]
dec esi
cmp edi, esi
jge 0x10012c89
add edx, 2
mov word [ebx + edi*2], cx
movzx ecx, word [edx]
inc edi
test cx, cx
jne 0x10012c75
movzx ecx, word [eax]
test cx, cx
je 0x10012ca9
mov edx, dword [ebp + 0xc]
dec edx
cmp edi, edx
jge 0x10012ca9
add eax, 2
mov word [ebx + edi*2], cx
movzx ecx, word [eax]
inc edi
test cx, cx
jne 0x10012c95
xor edx, edx
pop esi
mov word [ebx + edi*2], dx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0x3f
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100147f0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10050050]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
mov edi, ecx
push edi
push ebx
push 0x10046e98
push 0x10046ebc
call fcn.10014390
add esp, 0x14
push 0x10046ed4
push edi
call fcn.10027381
mov esi, eax
add esp, 8
test esi, esi
jne 0x100148c7
push 0x10046e5c
push 0x10046ebc
call fcn.10014390
lea edx, [ebp - 0x214]
add esp, 8
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10014853
xor ecx, ecx
cmp word [ebp - 0x214], cx
je 0x100148f6
lea eax, [ebp - 0x214]
cmp word [eax], 0x5c
jne 0x1001487f
mov esi, ecx
inc ecx
cmp word [ebp + ecx*2 - 0x214], 0
lea eax, [ebp + ecx*2 - 0x214]
jne 0x10014877
test esi, esi
je 0x100148f6
xor ecx, ecx
push ecx
lea edx, [ebp - 0x214]
push edx
push ecx
mov word [ebp + esi*2 - 0x214], cx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x100148f6
push 0x10046ed4
push edi
call fcn.10027381
mov esi, eax
add esp, 8
test esi, esi
je 0x100148f6
mov eax, dword [ebp + 8]
push esi
push eax
push 1
push ebx
call fcn.10029ac6
push esi
mov edi, eax
call fcn.100277b9
add esp, 0x14
cmp edi, dword [ebp + 8]
je 0x10014908
push 0x10046edc
push 0x10046ebc
call fcn.10014390
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002656f
mov esp, ebp
pop ebp
ret
push 0x10046eec
push 0x10046ebc
call fcn.10014390
mov ecx, dword [ebp - 8]
add esp, 8
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1002656f
mov esp, ebp
pop ebp
ret

Function at 0x10014930
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
jne 0x1001495d
push edi
push 0x10046efc
push str.GetSharedMemory
call fcn.10014390
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x1001498c
push esi
push edi
push 0x10046f3c
push str.GetSharedMemory
call fcn.10014390
add esp, 0x10
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
push edi
push 0x10046f68
push str.GetSharedMemory
call fcn.10014390
add esp, 0xc
xor eax, eax
cmp dword [eax*8 + 0x10755024], 0
je 0x100149b9
inc eax
cmp eax, 0x400
jl 0x100149a1
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
mov dword [eax*8 + 0x10755020], esi
mov dword [eax*8 + 0x10755024], ebx
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x100149d0
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
jne 0x100149fd
push edi
push 0x10046efc
push str.GetReadOnlySharedMemory
call fcn.10014390
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x10014a2c
push esi
push edi
push 0x10046f3c
push str.GetReadOnlySharedMemory
call fcn.10014390
add esp, 0x10
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
push edi
push 0x10046f68
push str.GetReadOnlySharedMemory
call fcn.10014390
add esp, 0xc
xor eax, eax
cmp dword [eax*8 + 0x10755024], 0
je 0x10014a59
inc eax
cmp eax, 0x400
jl 0x10014a41
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
mov dword [eax*8 + 0x10755020], esi
mov dword [eax*8 + 0x10755024], ebx
pop esi
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x10014af0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push edi
push ebx
push 0
push 4
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
push 0xffffffffffffffff
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x10014b61
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push edi
push 0x10046fd8
push str.AllocateSharedMemory
call fcn.10014390
add esp, 0x14
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.10014a70
add esp, 4
push ebx
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x10014ba5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push edi
push 0x10047040
push str.AllocateSharedMemory
call fcn.10014390
mov eax, dword [ebp - 4]
add esp, 0x18
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x10014bb0
cmp dword [eax*8 + 0x10755024], 0
je 0x10014bc4
inc eax
cmp eax, 0x400
jl 0x10014bb0
jmp 0x10014bd2
mov dword [eax*8 + 0x10755024], ecx
mov dword [eax*8 + 0x10755020], esi
push ebx
push 0x10047088
push str.AllocateSharedMemory
call fcn.10014390
mov eax, dword [ebp - 4]
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10015070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x10015090
Capabilities:
Get common file path

Disassembly:
push esi
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x100150c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SHGetFolderPath
push str.GetAllUserAppDirectory
call fcn.10014390
add esp, 0xc
xor eax, eax
mov word [esi], ax
ret
mov eax, esi
ret
Function at 0x100150d0
Capabilities:
Get common file path

Disassembly:
push esi
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x10015102
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SHGetFolderPath
push str.GetUserAppDirectory
call fcn.10014390
add esp, 0xc
xor eax, eax
mov word [esi], ax
ret
mov eax, esi
ret

Function at 0x100152f0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x10050050]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.10026c57
lea ecx, [ebp - 0x214]
push 0x10045d20
push ecx
call fcn.10026f14
add esp, 0x14
test eax, eax
jne 0x10015361
lea edx, [ebp - 0x214]
push 0x10047138
push edx
call fcn.10026f14
add esp, 8
test eax, eax
jne 0x10015361
push str..exe
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.10026be2
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push str.HTTP_shellopencommand
push 0x80000000
mov dword [ebp - 0x424], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100153d8
lea edx, [ebp - 0x424]
push edx
mov edx, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x428]
push ecx
push 0
push 0x10045a28
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x41c]
push 0x10045a28
push eax
call fcn.10026b57
add esp, 8
test eax, eax
jne 0x100153d8
push 1
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.iexplore
jmp 0x100153e5
push 1
push 0
push 0
lea edx, [ebp - 0x214]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002656f
mov esp, ebp
pop ebp
ret
Function at 0x10016110
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10050050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0x28
push esi
mov eax, ebx
push edi
mov esi, ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10016130
sub eax, edx
sar eax, 1
mov edi, eax
je 0x1001620e
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001620e
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [edi + edi + 2]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x10016188
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002656f
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
inc edi
push edi
push eax
call fcn.10026c57
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x70
xor esi, esi
lea edx, [ebp - 0x74]
push esi
push edx
call fcn.1002a830
mov eax, 1
add esp, 0xc
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
push 0x1c
lea eax, [ebp - 0x74]
mov ecx, 2
push eax
push 4
mov dword [ebp - 0x70], 0x1d0011
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x54], 0x2f0056
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x38], 0x2f0056
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0x1d0011
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002656f
mov esp, ebp
pop ebp
ret
Function at 0x10017290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [0x10755018], 0
push esi
push edi
jne 0x100172a6
call fcn.10014500
call fcn.1000f7e0
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1001732d
dec eax
jne 0x100173c0
mov esi, dword [ebp + 8]
push esi
push str.Dll_attach__instance:0x_x
push str.DllMain
call fcn.10014390
add esp, 0xc
call fcn.10015400
mov dword [0x10757030], esi
call fcn.10002fc0
call fcn.1000baa0
push 0
push 0
push 0
push 0x100170f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push str.res_thread_return:_x
push str.DllMain
mov dword [0x10741e78], eax
call fcn.10014390
mov eax, dword [0x10755018]
inc dword [eax]
add esp, 0xc
mov ecx, esi
call fcn.100223b0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
push esi
push str.Dll_detach__instance:0x_x
push str.DllMain
call fcn.10014390
mov eax, dword [0x10755018]
dec dword [eax]
add esp, 0xc
push esi
push str.KUAO
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, dword [0x10741e78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10757034], 0
je 0x10017382
mov ecx, dword [0x10755018]
cmp dword [ecx], 0
je 0x1001737d
call fcn.1000bc90
jmp 0x10017382
call fcn.1000bb90
mov edx, dword [0x10755018]
cmp dword [edx], 0
jne 0x100173c0
call fcn.10015490
cmp eax, 0x500
jle 0x100173ae
mov edi, dword [0x10755018]
call fcn.10014bf0
mov dword [0x10755018], 0
mov eax, dword [0x10741c64]
test eax, eax
je 0x100173c0
push eax
call fcn.100277b9
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001d576
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp eax, 0xffffffff
je case.0x1001d4cc.3
mov ecx, dword [eax*4 + 0x1074bbfc]
mov ebx, 1
shl ebx, cl
push ebx
push 0x10047d64
push str.ClickedButton
call fcn.10014390
lea eax, [ebx - 1]
add esp, 0xc
cmp eax, 0xf
ja case.0x1001d4cc.3
movzx eax, byte [eax + 0x1001d5bc]
jmp dword [eax*4 + 0x1001d5a4]
mov eax, esi
call fcn.100034c0
mov ecx, dword [edi + 4]
push 0
push 0
push 0x501
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
ret
push 0x10045b38
push str.ToggleEnglishSymbol
call fcn.10014390
add esp, 8
test byte [esi + 4], 1
je 0x1001d512
mov eax, dword [0x107cb6b0]
xor dword [eax + 0x5c], 0x20
or dword [esi + 0x391fc], 4
mov edx, dword [edi + 4]
push 0
push 0
push 0x501
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
ret
push 0x10045aa4
push str.ToggleFullShape
call fcn.10014390
mov eax, dword [0x107cb6b0]
xor dword [eax + 0x5c], 0x40
or dword [esi + 0x391fc], 4
mov eax, dword [edi + 4]
add esp, 8
push 0
push 0
push 0x501
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
ret
xor ecx, ecx
cmp dword [esi + 8], ecx
sete cl
mov dword [esi + 8], ecx
jmp 0x1001d519
cmp dword [0x1074bd44], 0
jne case.0x1001d4cc.3
call fcn.10020370
push 0x10045708
push 0x10047220
call fcn.10014390
add esp, 8
pop edi
pop esi
pop ebx
jmp fcn.100030c0
Function at 0x1001f890
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0x100482d4
push str.HideMainWindow
mov edi, eax
mov esi, ecx
call fcn.10014390
add esp, 8
test esi, esi
je 0x1001f8da
test edi, edi
je 0x1001f8da
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1001f8d0
mov ecx, dword [edi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1001e140
call fcn.100202d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100202d0
Capabilities:
Hide graphical window

Disassembly:
test esi, esi
je 0x10020361
test edi, edi
je 0x10020361
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10020355
mov eax, dword [0x107cb6b0]
cmp dword [eax + 0xc], 0
je 0x10020355
cmp dword [eax + 8], 1
jne 0x10020355
cmp dword [esi + 0x39210], 0
jne 0x10020355
mov eax, dword [esi]
test eax, eax
je 0x10020326
cmp eax, 1
je 0x10020326
cmp eax, 5
je 0x10020326
cmp eax, 9
jne 0x10020355
cmp dword [esi + 0x39204], 0xe
jne 0x10020355
push str.Hint_Test_String
mov ecx, esi
call fcn.10013a00
add esp, 4
cmp word [str.Hint_Test_String], 0
jne 0x1002034c
mov ecx, dword [edi + 0x10]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, edi
mov ecx, esi
jmp fcn.1001fa90
mov edx, dword [edi + 0x10]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x10020370
Capabilities:
Hide graphical window

Disassembly:
push 0x1004837c
push str.HideStatusWindow
call fcn.10014390
add esp, 8
test esi, esi
je 0x100203cf
test edi, edi
je 0x100203cf
mov eax, dword [edi + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
cmp dword [esi + 8], 0
je 0x100203b1
mov eax, dword [0x1074bc68]
test eax, eax
je 0x100203b1
push 0
push eax
call dword [sym.imp.IMM32.dll_ImmShowSoftKeyboard]
mov eax, dword [0x107cb6b0]
test eax, eax
je 0x100203ce
cmp dword [eax + 0xc], 0
je 0x100203ce
cmp dword [eax + 8], 1
jne 0x100203ce
mov ecx, dword [edi + 0x10]
push 0
push ecx
call ebx
pop ebx
ret
Function at 0x10021030
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
test edx, edx
je 0x1002113c
cmp dword [edx + 0xc], 0
je 0x1002113c
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x10755018]
mov esi, 0x93818
jmp 0x10021066
mov edx, dword [ebp + 0xc]
cmp dword [esi + eax], 0
jne 0x10021077
cmp dword [esi + eax + 4], 0
je 0x10021105
mov ecx, dword [esi + eax]
cmp dword [edx + 0xc], ecx
je 0x10021105
push ecx
call ebx
test eax, eax
je 0x10021097
mov eax, dword [0x10755018]
mov ecx, dword [esi + eax]
push 0
push ecx
call edi
mov eax, dword [0x10755018]
mov edx, dword [esi + eax - 0x320]
or edx, dword [esi + eax - 0x31c]
je 0x100210d1
mov eax, dword [esi + eax - 0x320]
push eax
call ebx
test eax, eax
je 0x100210cc
mov ecx, dword [0x10755018]
mov edx, dword [esi + ecx - 0x320]
push 0
push edx
call edi
mov eax, dword [0x10755018]
mov ecx, dword [esi + eax + 0x320]
or ecx, dword [esi + eax + 0x324]
je 0x10021105
mov edx, dword [esi + eax + 0x320]
push edx
call ebx
test eax, eax
mov eax, dword [0x10755018]
je 0x10021105
mov ecx, dword [esi + eax + 0x320]
push 0
push ecx
call edi
mov eax, dword [0x10755018]
add esi, 8
cmp esi, 0x93b38
jl 0x10021063
mov edx, dword [0x107cb6b0]
cmp dword [edx + 0x28], 0
je 0x1002113c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
call ebx
test eax, eax
jne 0x1002113c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.10020430
pop edi
pop esi
pop ebx
pop ebp
ret