joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10838d5
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov eax, 0x1275b57
call fcn.01160168
sub esp, 0x250
mov eax, dword [0x12cf8c8]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x220]
call fcn.01044ec9
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x22c]
push ecx
push esi
call dword [eax + 0x6c]
cmp eax, edi
jge 0x1083924
mov esi, eax
jmp 0x1083acf
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x220]
call fcn.01032977
mov ecx, dword [ebp - 0x220]
xor eax, eax
cmp dword [ecx - 8], edi
setne al
cmp eax, edi
jne 0x1083951
mov esi, 0x80004005
jmp 0x1083acf
push ebx
lea ecx, [ebp - 0x220]
call fcn.01044f98
test eax, eax
lea ecx, [ebp - 0x220]
setge bl
call fcn.01082792
test eax, eax
jge 0x108397b
mov esi, 0xc9470099
jmp 0x1083ace
lea ecx, [ebp - 0x224]
call fcn.01044ec9
mov byte [ebp - 4], 2
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.010527df
cmp eax, edi
jge 0x10839a7
mov esi, eax
jmp 0x1083abf
test bl, bl
mov byte [ebp - 0x219], 0
je 0x10839e9
lea eax, [ebp - 0x218]
push eax
push 1
push 0x10094fc
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, edi
jne 0x10839da
mov esi, 0x80004005
jmp 0x1083abf
lea edi, [ebp - 0x218]
mov byte [ebp - 0x219], 1
jmp 0x10839ef
mov edi, dword [ebp - 0x220]
lea eax, [ebp - 0x230]
xor ebx, ebx
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 0x230], ebx
call fcn.0117e889
cmp eax, ebx
jl 0x10839a0
push ebx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x25c]
call fcn.0118f7fb
mov byte [ebp - 4], 3
push edi
lea ecx, [ebp - 0x25c]
call fcn.0118e7b5
cmp eax, ebx
jge 0x1083a34
mov esi, eax
jmp 0x1083ab0
lea eax, [esi + 0x2c]
push eax
push 0x17
lea eax, [ebp - 0x25c]
push eax
call fcn.0118fbe4
cmp eax, ebx
jl 0x1083a30
push ebx
lea ecx, [ebp - 0x25c]
call fcn.0118ed24
cmp byte [ebp - 0x219], 0
mov dword [ebp - 0x228], eax
je 0x1083a9d
push dword [ebp - 0x220]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
cmp eax, ebx
jne 0x1083a8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1083a8c
mov dword [ebp - 0x228], 0x8000ffff
cmp dword [ebp - 0x228], ebx
lea eax, [ebp - 0x218]
jge 0x1083b08
push eax
call edi
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x44]
cmp eax, ebx
mov esi, eax
jl 0x1083ab0
mov esi, dword [ebp - 0x228]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.01082932
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.010454b8
pop ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.010454b8
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x22c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.0115fe73
leave
ret 4
push dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
jne 0x1083a9d
mov esi, 0x80004005
jmp 0x1083ab0
Function at 0x1083cce
Capabilities:
Delete file

Disassembly:
mov eax, 0x1275986
call fcn.01160168
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x78]
mov eax, dword [edi]
cmp dword [eax - 8], 0
je 0x1083d44
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, 0x12d2398
call fcn.0116bb3a
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0x10], ecx
je 0x1083d1a
push ebx
push 2
lea ebx, [esi + 0x60]
push ebx
call fcn.0117ec7b
mov ecx, dword [ebp - 0x10]
push 4
push ebx
call fcn.0117ec7b
pop ebx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.010831d6
and dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010454b8
mov ecx, edi
call fcn.010477a3
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x108ed75
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x12cf8c8]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [0x12d23c0]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp + 0xc]
push 0xf1
push eax
push edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
cmp eax, ebx
je 0x108ee0c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x108ee0c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x108ee0c
push ebx
push dword [0x12d23bc]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x1c]
movzx eax, word [edi + 8]
push esi
push 0x64
push 0x64
push ebx
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push ebx
push 0x1003af0
push ebx
mov byte [ebp - 0x10], 4
mov byte [ebp - 0xf], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x108ee13
xor eax, eax
jmp 0x108eecb
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x14
push 0x41e
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x20]
mov eax, esp
mov dword [eax], ecx
call fcn.0103d1cf
cmp al, bl
je 0x108ee5c
movzx eax, word [edi + 2]
push 0x2040
push ebx
push 0xffffffffffffffff
push 1
push eax
push dword [ebp - 0x20]
push dword [0x12d23c0]
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
push eax
push ebx
push 0x430
jmp 0x108ee73
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 1
push 0x413
push dword [ebp - 0x1c]
call esi
lea eax, [ebp - 0x18]
push eax
push 1
push 0x444
push dword [ebp - 0x1c]
call esi
movzx eax, word [edi + 4]
movzx ecx, word [edi + 2]
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x420
push dword [ebp - 0x1c]
call esi
mov ax, word [edi + 4]
mov cx, word [edi + 2]
add ax, 7
movzx eax, ax
add cx, 7
movzx ecx, cx
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x41f
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
call fcn.0115fe73
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1090706
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
je 0x1090724
cmp edi, 1
je 0x1090724
cmp edi, 0xffffffff
je 0x109075d
xor al, al
jmp 0x1090783
cmp edi, 0xffffffff
je 0x109075d
push ebx
push dword [esi + edi*4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x1090744
push 5
push dword [esi + edi*4]
call ebx
xor eax, eax
test edi, edi
sete al
push 0
push dword [esi + eax*4]
call ebx
cmp dword [esi + 0x1c], edi
pop ebx
je 0x1090777
mov dword [esi + 0x1c], edi
jmp 0x1090777
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x1090777
xor ecx, ecx
test eax, eax
sete cl
push 5
push dword [esi + ecx*4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
mov dword [esi + 0x40], edi
call fcn.01037ddb
mov al, 1
pop edi
pop esi
pop ebp
ret 4
Function at 0x10915f4
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov cl, byte [esi + 0x2530]
test cl, cl
push edi
je 0x1091684
lea eax, [esi + 0x2531]
cmp byte [eax], 0
je 0x1091619
mov byte [eax], 0
test cl, cl
je 0x1091684
lea edi, [esi + 0xd0]
mov ecx, edi
call fcn.011473b6
lea ebx, [esi + 0x20]
push 0xffffffffffffffff
mov ecx, ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], eax
call fcn.01090706
push 2
push 2
mov ecx, ebx
call fcn.0108ea44
mov eax, dword [esi + 0xcc]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
neg edi
sbb edi, edi
lea ecx, [esi + 0xd4]
and edi, ecx
mov ecx, dword [edi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov dword [ebx], ecx
mov dword [ebx + 4], eax
push dword [esi + 0xd4]
call edi
push 0
jmp 0x1091727
cmp byte [esi + 0x2531], 0
lea edi, [esi + 0x20]
mov ecx, edi
je 0x10916ec
mov eax, dword [esi + 0x2564]
push 0xffffffffffffffff
mov dword [esi + 0x68], eax
call fcn.01090706
push 2
push 0
mov ecx, edi
call fcn.0108ea44
mov eax, dword [esi + 0xcc]
mov ecx, dword [esi + 0xc8]
mov edx, eax
add eax, 4
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edx]
mov edx, ecx
add ecx, 4
neg edx
sbb edx, edx
and edx, ecx
mov ecx, dword [edx]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0xd4]
call edi
push 5
jmp 0x1091727
push 1
call fcn.01090706
push 2
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.0108ea44
mov eax, dword [esi + 0xcc]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [esi + 0xd4]
call edi
push ebx
mov eax, dword [esi + 0xc8]
push dword [eax + 4]
call edi
cmp byte [esi + 0x2530], 0
jne 0x109174e
cmp byte [esi + 0x2531], 0
jne 0x109174e
push 0
push dword [esi + 0x2548]
jmp 0x10917aa
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x2518]
add eax, dword [ebp - 0x14]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
lea ebx, [esi + 0x2548]
push eax
mov ecx, ebx
call fcn.0108ea24
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push 0x15
xor eax, eax
push eax
dec ecx
push eax
dec ecx
push ecx
mov ecx, dword [esi + 0x38]
sub ecx, dword [ebp - 8]
lea ecx, [ecx + edx - 6]
push ecx
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
push dword [ebx]
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10917b6
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0xc0]
dec eax
je 0x10917db
dec eax
je 0x10917d0
dec eax
jne 0x10917e6
add ecx, 0x1ed0
jmp fcn.01090521
add ecx, 0x19d0
jmp fcn.0108fadf
add ecx, 0xad0
jmp fcn.0108f9b1
ret
Function at 0x10919ea
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esi + 0x58]
call fcn.01182f5b
cmp dword [esi + 0x70], 0
jge 0x1091a0a
xor eax, eax
jmp 0x1091bb1
push ebx
push edi
mov ecx, esi
call fcn.01146f84
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
shl eax, 4
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 4], eax
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff38
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1091a86
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0xffffffff
je 0x1091a7c
test eax, eax
je 0x1091a86
push eax
mov ecx, edi
call fcn.0108e6e7
cmp eax, 0xffffffff
jne 0x1091a83
xor eax, eax
jmp 0x1091baf
mov dword [esi + 0x70], eax
push 0
mov ecx, edi
call fcn.0106162a
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov ecx, esi
push eax
call fcn.0108fc0b
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 5
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 0
push 0
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff2d
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1091b20
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1091b2f
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 1
lea ecx, [esi + 0x20]
push 1
call fcn.01089d4d
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x64]
shl ecx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [ecx + edx + 0xc]
push 1
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.01089d4d
push 1
mov ecx, edi
call fcn.0106162a
push 0x181
push 0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi]
mov eax, dword [esi + 0x70]
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffff2a
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
push eax
push 0x4e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1091bb9
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esi + 0x58]
call fcn.01182f5b
cmp dword [esi + 0x70], 0
jge 0x1091bd9
xor eax, eax
jmp 0x1091d81
push ebx
push edi
lea ecx, [esi + 0x78]
call fcn.01153f1f
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
shl eax, 4
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 4], eax
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff38
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1091c56
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0xffffffff
je 0x1091c4c
test eax, eax
je 0x1091c56
push eax
mov ecx, edi
call fcn.0108e6e7
cmp eax, 0xffffffff
jne 0x1091c53
xor eax, eax
jmp 0x1091d7f
mov dword [esi + 0x70], eax
push 0
mov ecx, edi
call fcn.0106162a
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov ecx, esi
push eax
call fcn.0108fc0b
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 5
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 0
push 0
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff2d
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1091cf0
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1091cff
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 1
lea ecx, [esi + 0x20]
push 1
call fcn.01089d4d
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x64]
shl ecx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [ecx + edx + 0xc]
push 1
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.01089d4d
push 1
mov ecx, edi
call fcn.0106162a
push 0x181
push 0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi]
mov eax, dword [esi + 0x70]
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffff2a
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
push eax
push 0x4e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1091d89
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esi + 0x58]
call fcn.01182f5b
cmp dword [esi + 0x70], 0
jge 0x1091da9
xor eax, eax
jmp 0x1091f54
push ebx
push edi
lea ecx, [esi + 0x240]
call fcn.01158041
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
shl eax, 4
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 4], eax
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff38
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1091e29
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0xffffffff
je 0x1091e1f
test eax, eax
je 0x1091e29
push eax
mov ecx, edi
call fcn.0108e6e7
cmp eax, 0xffffffff
jne 0x1091e26
xor eax, eax
jmp 0x1091f52
mov dword [esi + 0x70], eax
push 0
mov ecx, edi
call fcn.0106162a
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov ecx, esi
push eax
call fcn.0108fc0b
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 5
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 0
push 0
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff2d
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1091ec3
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1091ed2
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 1
lea ecx, [esi + 0x20]
push 1
call fcn.01089d4d
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x64]
shl ecx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [ecx + edx + 0xc]
push 1
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.01089d4d
push 1
mov ecx, edi
call fcn.0106162a
push 0x181
push 0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi]
mov eax, dword [esi + 0x70]
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffff2a
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
push eax
push 0x4e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x109219b
Capabilities:
Create thread
Hide graphical window

Disassembly:
mov eax, 0x1276f7b
call fcn.01160168
push ecx
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x24]
call fcn.010336a1
test eax, eax
jge 0x10921b1
xor al, al
jmp 0x109236a
cmp dword [esi + 0x3c], 0
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 0x100355c
je 0x109224f
push ebx
push dword [esi + 0x50]
call edi
test eax, eax
je 0x109234e
push ebx
push dword [esi + 0x5c]
call edi
test eax, eax
je 0x109234e
push ebx
push dword [esi + 0x44]
call edi
xor ecx, ecx
cmp eax, ecx
je 0x109234e
cmp byte [esi + 0x39], cl
je 0x1092245
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
push ecx
lea eax, [ebp - 0x10]
push 0xf107
push eax
call fcn.01053010
add esp, 0xc
test eax, eax
jne 0x109222b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fa
jmp 0x109234e
push dword [ebp - 0x10]
push dword [esi + 0x4c]
call edi
test eax, eax
je 0x109221a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fa
jmp 0x109224f
push ecx
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x3c], 2
jne 0x1092272
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x48]
call ebx
push 0
push dword [esi + 0x54]
call ebx
push 0
push dword [esi + 0x40]
call ebx
jmp 0x10922a9
push ebx
push dword [esi + 0x40]
call edi
test eax, eax
je 0x109234e
push 0
mov eax, 0x4000
push eax
push eax
lea ecx, [esi + 0x40]
call fcn.01032b67
movzx eax, word [esi + 0x6c]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x3c]
cmp eax, 2
je 0x10922b6
cmp eax, 3
jne 0x109231f
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
mov eax, dword [0x12d1f58]
push 0xf106
push dword [eax + 8]
lea ecx, [ebp - 0x10]
call fcn.01044959
push dword [ebp - 0x10]
push dword [esi + 4]
call edi
test eax, eax
jne 0x10922f1
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x109234e
mov eax, dword [0x12d1f58]
push 0xf108
push dword [eax + 8]
lea ecx, [ebp - 0x10]
call fcn.01044959
push dword [ebp - 0x10]
push dword [esi + 0x48]
call edi
test eax, eax
je 0x10922e2
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, edi
call fcn.01032626
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push esi
push 0x109237c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x64], eax
jne 0x1092352
xor al, al
jmp 0x1092368
mov ecx, 0x12d2398
call fcn.0107d40a
push eax
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret