joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d3c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
push 2
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
jne 0x100d41a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100d405
call esi
mov esi, eax
jmp 0x100d533
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100d533
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x100d43b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x100d463
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100d44e
call esi
jmp 0x100d528
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100d52a
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x100d4d1
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x100d49e
push edi
call fcn.0100a389
test al, al
je 0x100d49e
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov dword [ebp + 8], esp
jmp 0x100d4aa
push edi
lea ecx, [ebp - 4]
call fcn.0100bf66
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x100d4b8
mov esi, 0x8007000e
jmp 0x100d52a
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x100d4d9
xor eax, eax
jmp 0x100d51c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x100d509
push ebx
call fcn.0100a389
test al, al
je 0x100d509
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov eax, esp
jmp 0x100d512
push ebx
lea ecx, [ebp - 4]
call fcn.0100bf66
push 0
push esi
push edi
push eax
call fcn.0100a3e2
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0100cc00
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 4]
call fcn.0100ad5a
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100fc85
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0100ad74
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x100fdf2
push esi
push edi
mov edi, 0x1002270
mov esi, 0x1070938
push 0x100303c
push dword [ebp - 8]
call fcn.0100add1
test eax, eax
je 0x100fd1f
push 0x1002fc8
call fcn.0100a748
lea ecx, [ebp - 0x60]
call fcn.0104dcd7
push 0x1002f68
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], edi
call fcn.0104d672
push ebx
push ebx
push 0x64
push esi
call fcn.0100d5a5
push ebx
push ebx
push esi
call fcn.0100c945
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x60], edi
lea ecx, [ebp - 0x60]
mov eax, dword [ebp + 8]
mov dword [eax], ebx
call fcn.0104dce9
jmp 0x100fddd
push 0x1002f50
push dword [ebp - 8]
call fcn.0100add1
test eax, eax
je 0x100fdc3
lea ecx, [ebp - 0x38]
call fcn.0104dcd7
push 1
push 0x1002ee0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], edi
call fcn.0104d703
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x100fd64
push 1
push 0x1002eb4
lea ecx, [ebp - 0x38]
call fcn.0104df3c
push ebx
push 1
push 0x64
push esi
call fcn.0100d5a5
push ebx
push 1
push esi
call fcn.0100c89a
cmp eax, ebx
mov dword [ebp - 0xc], eax
jge 0x100fdae
push eax
lea eax, [ebp - 0x268]
push 0x1002e70
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x10], ebx
jl 0x100fdae
lea eax, [ebp - 0x268]
push eax
push 0x1002e40
lea ecx, [ebp - 0x38]
call fcn.0104dee0
push 1
lea ecx, [ebp - 0x38]
call fcn.0104d777
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x38]
jmp 0x100fd10
push 0x1002e28
push dword [ebp - 8]
call fcn.0100add1
test eax, eax
je 0x100fddd
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
push dword [ebp - 8]
call fcn.0100ad74
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x100fcc2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [ebp - 0xc]
pop ebx
call fcn.0104ab5e
leave
ret 8
Function at 0x1010025
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x148c
call fcn.0104ae00
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push esi
mov esi, ecx
mov dword [ebp - 8], ecx
add ecx, 0xffffffe0
neg esi
sbb esi, esi
mov dword [ebp - 4], eax
xor eax, eax
and esi, ecx
je 0x1010240
push ebx
push edi
mov edx, 0x80
mov ecx, edx
lea edi, [ebp - 0x610]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0xa10]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x810]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x410]
rep stosd dword es:[edi], eax
mov ecx, 0x102
lea edi, [ebp - 0x148c]
rep stosd dword es:[edi], eax
push 0xff
lea eax, [ebp - 0x610]
push eax
lea edi, [esi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x44d
push dword [edi]
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
push eax
call ebx
push 0xff
lea eax, [ebp - 0xa10]
push eax
push 0x44e
push dword [edi]
call esi
push eax
call ebx
push 0xff
lea eax, [ebp - 0x810]
push eax
push 0x44f
push dword [edi]
call esi
push eax
call ebx
push 0xff
lea eax, [ebp - 0x208]
push eax
push 0x451
push dword [edi]
call esi
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push 0x1003098
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0xe68]
push eax
call ebx
push 0x1003078
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x1084]
push eax
call ebx
push 0x1003064
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xc24]
push eax
call ebx
mov ecx, dword [ebp - 8]
add esp, 0x24
push 0x104
lea eax, [ebp - 0x410]
push eax
call fcn.0101cf74
test eax, eax
je 0x1010188
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x148c]
push eax
call ebx
add esp, 0xc
jmp 0x101019c
lea eax, [ebp - 0x148c]
push 0x1003060
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0xe68]
push eax
push 0x44d
push dword [edi]
call esi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebx
lea eax, [ebp - 0x1084]
push eax
push 0x44e
push dword [edi]
call esi
push eax
call ebx
lea eax, [ebp - 0xc24]
push eax
push 0x44f
push dword [edi]
call esi
push eax
call ebx
lea eax, [ebp - 0x148c]
push eax
push 0x451
push dword [edi]
call esi
push eax
call ebx
push 0x450
push dword [edi]
call esi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x101021b
call fcn.01008080
push 1
push 0x8c
mov ecx, eax
call fcn.01008799
push eax
push esi
call ebx
push 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, edi
call fcn.01010250
xor eax, eax
pop edi
inc eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.0104ab5e
leave
ret 0x10
Function at 0x10158ed
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 4], ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0104c949
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.01047b8b
mov esi, eax
xor edi, edi
cmp esi, edi
jge 0x1015937
mov ecx, dword [ebp + 0xc]
call fcn.0104c9be
push eax
push esi
push 0x471d
call fcn.01008074
mov ecx, eax
call fcn.01008d1b
jmp 0x1015a30
push ebx
xor ebx, ebx
inc ebx
cmp esi, ebx
jne 0x1015946
mov esi, ebx
jmp 0x1015a2f
mov ecx, dword [ebp - 4]
push edi
push dword [ebp + 8]
call fcn.0101de01
test eax, eax
je 0x101593f
push edi
lea ecx, [ebp - 0x10]
call fcn.0104c9be
push eax
call fcn.01008062
mov ecx, eax
call fcn.01022948
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0104c9be
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, edi
jl 0x1015a08
mov ecx, dword [ebp - 4]
push ebx
push ebx
push edi
push edi
push dword [ebp + 8]
call fcn.01014599
mov esi, eax
cmp esi, ebx
jne 0x10159ca
mov ecx, dword [ebp - 4]
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push edi
push dword [ebp + 8]
call fcn.01014336
cmp dword [ebp + 8], edi
mov esi, eax
je 0x10159ca
cmp esi, edi
jl 0x1015a08
call fcn.0100809e
add eax, 0x450
je 0x10159ca
push ebx
mov ecx, eax
call fcn.01048e6f
cmp esi, edi
jl 0x1015a08
push edi
call fcn.01008092
mov ecx, eax
call fcn.01025c57
push edi
push ebx
call fcn.01008092
mov ecx, eax
call fcn.01025c7c
mov ecx, dword [ebp - 4]
call fcn.01013447
mov esi, eax
cmp esi, edi
jl 0x1015a08
push dword [ebp + 0x10]
call fcn.01008092
mov ecx, eax
call fcn.01025679
jmp 0x1015a2f
call fcn.01008062
mov ecx, eax
call fcn.0101ea79
push edi
call fcn.01008092
mov ecx, eax
call fcn.01025c57
push edi
push edi
call fcn.01008092
mov ecx, eax
call fcn.01025c7c
pop ebx
lea ecx, [ebp - 0x10]
call fcn.0104cd4c
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x101cf74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10030e0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x101cff3
push edi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 0x1003060
push edi
push dword [ebp - 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x101cff2
cmp dword [ebp - 0x10], 1
jne 0x101cff2
mov eax, dword [ebp - 0xc]
shr eax, 1
inc eax
cmp eax, dword [ebp + 0xc]
jge 0x101cfee
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 8]
call esi
mov ebx, eax
jmp 0x101cff2
and dword [ebp - 4], 0
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x101d00c
xor eax, eax
test ebx, ebx
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x101dd3d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
mov edi, ecx
call fcn.0101d8be
lea ecx, [ebp + 8]
call fcn.010551dd
call fcn.010080a4
test eax, eax
je 0x101dd64
lea ecx, [ebp + 8]
call fcn.010555d3
push 0x40
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x101dd79
mov ecx, eax
call fcn.01049dd3
jmp 0x101dd7b
xor eax, eax
test eax, eax
mov dword [edi + 0x1c], eax
jne 0x101dd8b
mov dword [ebp + 0xc], 0x8007000e
jmp 0x101dda2
call fcn.01008062
push dword [ebp + 0xc]
mov eax, dword [eax + 0x2c]
mov ecx, dword [edi + 0x1c]
push eax
call fcn.01049ac4
mov dword [ebp + 0xc], eax
call fcn.010080a4
test eax, eax
je 0x101ddb3
lea ecx, [ebp + 8]
call fcn.010555f3
cmp dword [ebp + 0xc], 0
jne 0x101ddf1
push ebx
push esi
call fcn.0100809e
mov esi, eax
add esi, 4
call fcn.01008080
mov ebx, dword [eax + 4]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ecx, dword [edi + 0x1c]
push eax
push ebx
call fcn.01014c29
mov eax, dword [edi + 0x1c]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
lea ecx, [ebp + 8]
call fcn.010555b9
mov eax, dword [ebp + 0xc]
pop edi
pop ebp
ret 8

Function at 0x1026c99
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push esi
push edi
mov dword [ebp - 4], eax
mov esi, ecx
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x100
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [esi + 0x11c], 0
je 0x1026cf6
lea eax, [ebp - 0x208]
push eax
call fcn.0104eab7
test eax, eax
jne 0x1026cf6
inc eax
jmp 0x1026cf8
xor eax, eax
push eax
push dword [esi + 0xf4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.0104ab5e
leave
ret

Function at 0x1026de3
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, ecx
push dword [esi + 0x11c]
push dword [esi + 0x24]
call edi
push dword [esi + 0x11c]
push dword [esi + 0x44]
call edi
push dword [esi + 0x11c]
push dword [esi + 0x64]
call edi
xor eax, eax
cmp word [esi + 0x120], 0x641
lea ecx, [esi + 0x20]
sete al
push eax
call fcn.01026af8
xor eax, eax
cmp word [esi + 0x120], 0x642
lea ecx, [esi + 0x40]
sete al
push eax
call fcn.01026af8
xor eax, eax
cmp word [esi + 0x120], 0x643
lea ecx, [esi + 0x60]
sete al
push eax
call fcn.01026af8
movzx eax, word [esi + 0x120]
sub eax, 0x641
je 0x1026e7c
dec eax
je 0x1026e75
dec eax
jne 0x1026e8d
lea ecx, [esi + 0x124]
call fcn.0104c9be
push eax
jmp 0x1026e81
push 0x1004444
jmp 0x1026e81
push 0x1004438
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
cmp dword [esi + 0x11c], eax
je 0x1026ea3
cmp word [esi + 0x120], 0x643
jne 0x1026ea3
inc eax
push eax
push dword [esi + 0x84]
call edi
push dword [esi + 0x11c]
push dword [esi + 0xbc]
call edi
pop edi
mov ecx, esi
pop esi
jmp fcn.01026c99
Function at 0x1026f4e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push esi
push edi
mov esi, ecx
xor edi, edi
cmp word [esi + 0x120], 0x643
mov dword [ebp - 4], eax
jne 0x1026fc0
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x100
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x84]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x208]
push eax
lea ecx, [esi + 0x124]
call fcn.0104cd51
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x7ff8fff2
add edi, 0x8007000e
push ebx
mov bx, word [ebp + 0xc]
mov ecx, esi
mov word [esi + 0x120], bx
call fcn.01026de3
cmp bx, 0x643
pop ebx
push 1
jne 0x1026feb
lea eax, [esi + 0x80]
lea ecx, [esi + 0x84]
jmp 0x1026ff7
lea eax, [esi + 0xb8]
lea ecx, [esi + 0xbc]
neg eax
sbb eax, eax
and eax, ecx
push dword [eax]
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0x82
push 0x1004350
call fcn.01056fa7
push eax
call fcn.01008074
mov ecx, eax
call fcn.010581e7
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
xor eax, eax
pop esi
call fcn.0104ab5e
leave
ret 0x10

Function at 0x10279ae
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp dword [ebp + 0xc], 0xd
mov dword [ebp + 0x10], eax
jne 0x1027a16
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1027a15
push 0xfffffffffffffff4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x4e
push ebx
mov dword [ebp - 4], 0xd
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebx
mov eax, dword [ebp + 0x10]
pop esi
leave
ret 0x10
Function at 0x1028161
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 0xc], 0x29c
push esi
mov esi, ecx
jne 0x10282be
xor ecx, ecx
cmp dword [esi + 0x70], ecx
je 0x10282be
mov eax, dword [esi + 0x70]
mov edx, dword [eax]
push ebx
push edi
lea edi, [ebp - 0xc]
push edi
push ecx
push 2
push eax
mov dword [ebp + 0xc], ecx
call dword [edx + 0xc]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_InvalidateRect]
jl 0x10281d8
fld qword [ebp - 0xc]
fmul qword [0x1004570]
call fcn.0104ae40
push eax
lea ecx, [esi + 0x90]
call fcn.010418c5
push 1
push 0
lea edi, [esi + 0x94]
push dword [edi]
call ebx
push dword [edi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp + 0xc], 1
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 1
push 2
push eax
call dword [ecx + 0xc]
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.01027d0a
test eax, eax
lea edi, [esi + 0x154]
push dword [edi]
je 0x1028279
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1028240
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.01027f19
push 1
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x94]
call fcn.01026792
push 1
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.01026792
cmp dword [ebp - 4], 0
jl 0x10282ad
fld qword [ebp - 0xc]
fmul qword [0x1004570]
call fcn.0104ae40
push eax
lea ecx, [esi + 0x150]
call fcn.010418c5
push 1
push 0
push dword [edi]
call ebx
push dword [edi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp + 0xc], 1
jmp 0x10282ad
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10282ad
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.01027f19
push 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0x94]
call fcn.01026792
cmp dword [ebp + 0xc], 0
pop edi
pop ebx
je 0x10282be
mov esi, dword [esi + 0x70]
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x1028919
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov esi, ecx
push esi
push 0x10285af
push 1
push 0x106d838
push dword [esi + 4]
call fcn.0104f1fa
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x7c]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebp - 4], 0xc8
push 0
jge 0x1028953
push 0x14
jmp 0x1028962
cmp dword [ebp - 4], 0x12c
jge 0x1028960
push 0xa
jmp 0x1028962
push 5
push 0x414
push dword [esi + 0x7c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.01027f19
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x94]
call fcn.01026792
mov ecx, esi
call fcn.01027d0a
add esi, 0x154
test eax, eax
push dword [esi]
je 0x10289c6
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10289b7
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.01026792
jmp 0x10289da
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10289da
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x102c83f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.0101124f
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push dword [ebp + 0xc]
push ebx
call esi
push 0xf0
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], ecx
je 0x102c897
push eax
push ebx
call esi
push eax
mov dword [ebp - 4], eax
call edi
mov dword [ebp + 0xc], eax
cmp dword [ebp + 8], 0
je 0x102c8e5
push dword [ebp + 8]
push ebx
call esi
push eax
mov dword [ebp + 8], eax
call edi
push dword [ebp + 0xc]
mov esi, eax
push esi
call fcn.01013e7d
push dword [ebp + 0x18]
mov edi, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
cmp edi, esi
mov dword [ebp - 8], eax
je 0x102c8dc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
je 0x102c8fd
cmp dword [ebp - 0xc], 0
je 0x102c8fd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
leave
ret 0x14

Function at 0x102cf14
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
push 0xd
mov edx, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x104b
push dword [edx]
mov dword [ebp - 0x34], 4
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
pop edi
leave
ret 4
Function at 0x102d9a5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
mov word [ebp - 0x210], ax
mov word [ebp - 0x828], ax
mov word [ebp - 0x418], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x418]
mov ebx, ecx
push eax
push dword [ebx + 0x260]
call edi
push esi
lea eax, [ebp - 0x828]
push eax
push dword [ebx + 0x264]
call edi
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [ebp - 0x212], 0
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
call fcn.0104e136
lea eax, [ebp - 0x418]
push eax
call fcn.0104e1fb
test eax, eax
mov dword [ebp - 8], eax
mov edi, 0x1003060
jne 0x102da47
mov dword [ebp - 8], edi
lea eax, [ebp - 0x418]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x102da60
and word [eax], 0
push dword [ebp - 8]
call fcn.0104eab7
test eax, eax
jne 0x102db0d
cmp dword [ebx + 0x268], eax
je 0x102dae7
lea eax, [ebp - 0x620]
push eax
call fcn.0104ea9f
test eax, eax
lea eax, [ebp - 0x620]
je 0x102da90
mov eax, edi
push esi
lea ecx, [ebp - 0x210]
push ecx
push edi
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.0104e518
test eax, eax
je 0x102db20
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
push 0x1004ab4
call edi
lea ecx, [ebp - 0x210]
push ecx
mov dword [ebp - 8], eax
call edi
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
add ecx, eax
cmp ecx, esi
jae 0x102db05
lea eax, [ebp - 0x210]
push 0x1004ab4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
jmp 0x102db05
push esi
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.0104e518
test eax, eax
je 0x102db20
lea eax, [ebp - 0x210]
jmp 0x102db13
lea eax, [ebp - 0x620]
push eax
push dword [ebx + 0x264]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.0104ab5e
leave
ret 0x10