joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bd30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1012a64b
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov eax, dword [esp + 0x278]
mov dword [esp + 0x18], eax
mov ebx, edx
mov dword [esp + 0x14], ecx
call fcn.100680e0
cmp word [eax + 0x4d4], 0
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea esi, [eax + 0x4d4]
jne 0x1000bdb7
push esi
push 0
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1000bdb7
push esi
push 1
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1000bdb7
xor esi, esi
push esi
lea edi, [esp + 0x20]
call fcn.10062630
mov dword [esp + 0x270], 0
call fcn.100680e0
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x1000be01
push esi
push 0
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1000be01
push esi
push 1
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1000be01
xor esi, esi
push esi
lea edi, [esp + 0x144]
call fcn.10062630
push 0x1013c82c
push 0x1013c7e4
lea edx, [esp + 0x24]
call fcn.10062cd0
push str.SogouInputComponentsPicfaceJson
push 0x1013c7e4
lea edx, [esp + 0x2c]
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
lea edx, [esp + 0x34]
call fcn.10062cd0
push str.SGCandSearch.json
push 0x1013c7e4
lea edx, [esp + 0x3c]
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push str.SogouInputComponentsPicfaceCandDownload
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
mov edx, dword [esp + 0x48]
push 4
add edx, 0x4cc
push edx
lea esi, [ebx + 4]
push 4
push esi
mov dword [ebx], 4
call fcn.100d07bb
mov edi, dword [esp + 0x60]
add esi, 4
lea edi, [edi + edi + 2]
mov dword [esi], edi
add esp, 0x40
add esi, 4
cmp byte [esp + 0x138], 0
lea eax, [esp + 0x28]
jne 0x1000bebf
mov eax, dword [esp + 0x24]
push edi
add eax, 4
push eax
push edi
push esi
call fcn.100d07bb
add esi, edi
lea ebx, [edi + 0xc]
mov edi, dword [esp + 0x154]
lea edi, [edi + edi + 2]
mov dword [esi], edi
add esp, 0x10
add esi, 4
cmp byte [esp + 0x25c], 0
lea eax, [esp + 0x14c]
jne 0x1000befb
mov eax, dword [esp + 0x148]
push edi
add eax, 4
push eax
push edi
push esi
call fcn.100d07bb
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp byte [esp + 0x25c], 0
lea eax, [edi + ebx + 4]
mov esi, vtable.t_str.0
mov dword [ecx], eax
mov dword [esp + 0x140], esi
jne 0x1000bf45
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x1000bf45
push eax
call fcn.100cf89b
add esp, 4
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], esi
jne 0x1000bf68
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x1000bf68
push eax
call fcn.100cf89b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.100cf604
add esp, 0x260
ret 4
Function at 0x1000c520
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x101311a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x4c]
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1000c6aa
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1000c575
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1000c575
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x20]
push ebx
xor ecx, ecx
call fcn.1002b340
mov ebp, eax
test ebp, ebp
jl 0x1000c638
mov edi, dword [esi + 0x20]
mov edx, ebx
call fcn.1002d250
test al, al
je 0x1000c638
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx + 0x26c]
cmp eax, ebp
jl 0x1000c5af
dec eax
call fcn.1002b8c0
xor ebp, ebp
mov byte [esp + 0x1c], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x24], fcn.100cf978
mov dword [esp + 0x28], fcn.100cfa42
mov dword [esp + 0x2c], fcn.100cf89b
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], 0x1fff8
mov dword [esp + 0x20], vtable.t_heap.0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
push ecx
mov bl, 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], bl
call fcn.10096e50
add esp, 8
test al, al
jne 0x1000c63c
mov byte [esp + 0x44], al
mov esi, dword [esp + 0x30]
cmp esi, ebp
je 0x1000c62f
mov edi, dword [esp + 0x2c]
lea ebx, [ebx]
mov eax, esi
mov esi, dword [esi + 4]
push eax
call edi
add esp, 4
cmp esi, ebp
jne 0x1000c620
lea ecx, [esp + 0x18]
call fcn.10061940
xor al, al
jmp 0x1000c6ac
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x1dc]
cmp ecx, ebp
je 0x1000c666
cmp dword [ecx + 0x120], ebp
je 0x1000c666
call fcn.1002d480
push eax
lea ecx, [esp + 0x1c]
mov byte [eax + 0x434], bl
call fcn.1003d440
push 0x13
call fcn.10069fb0
add esp, 4
push ebp
push ecx
call fcn.10002720
add esp, 4
mov ebx, eax
call fcn.10003030
mov byte [esp + 0x44], 0
mov esi, dword [esp + 0x30]
test esi, esi
je 0x1000c6a1
mov edi, dword [esp + 0x2c]
mov eax, esi
mov esi, dword [esi + 4]
push eax
call edi
add esp, 4
test esi, esi
jne 0x1000c692
lea ecx, [esp + 0x18]
call fcn.10061940
mov al, 1
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x1000cb10
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [edi + 0x51c]
push ebp
push esi
test eax, eax
je 0x1000cbe2
mov eax, dword [eax + 0x12c]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebp
test eax, eax
je 0x1000cbe2
mov eax, dword [edi + 0x51c]
mov eax, dword [eax + 0x12c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000cb64
mov ecx, dword [edi + 0x51c]
mov edx, dword [ecx + 0x12c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.100025a0
mov eax, dword [eax + 0x524]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x50]
call eax
call fcn.10002720
mov esi, dword [eax + 0x120]
call fcn.100025a0
mov eax, dword [eax + 0x524]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x40]
mov ecx, esi
call eax
call fcn.100025a0
mov dword [eax + 0x524], 0
mov esi, dword [edi + 0x51c]
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000cbcb
push eax
call ebp
test eax, eax
je 0x1000cbcb
mov ecx, dword [esi + 0x12c]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [edi + 0x51c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov dword [edi + 0x51c], 0
pop esi
pop ebp
pop ecx
ret

Function at 0x10012b20
Capabilities:
Create thread

Disassembly:
push esi
push 0
mov esi, eax
push 1
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x10012b3a
mov al, al
pop esi
ret
push edi
xor edi, edi
add esi, 0x44
cmp dword [esi], 0xffffffff
jne 0x10012b6c
push 0
push 0
push 0
push 0x100129b0
push 0
push 0
call fcn.100d1a8f
mov dword [esi], eax
inc edi
add esp, 0x18
add esi, 4
cmp edi, 2
jl 0x10012b40
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x10013460
Capabilities:
Open clipboard

Disassembly:
push 0xffffffffffffffff
push 0x10129900
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x64]
mov esi, ecx
xor ebx, ebx
mov edi, edx
cmp esi, ebx
je 0x1001357d
mov eax, dword [ebp]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001357d
call dword [sym.imp.USER32.dll_EmptyClipboard]
test byte [ebp + 4], 8
je 0x100134c9
mov edx, esi
call fcn.10013ad0
cmp edi, ebx
jne 0x100134d8
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1001357d
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
mov dword [esp + 0x7c], ebx
call fcn.10013cc0
lea edi, [esp + 0x34]
call fcn.10013bc0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x68], 1
call fcn.10007e00
mov esi, 0x10
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x30], esi
jb 0x10013532
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.100cf5f9
add esp, 4
test byte [ebp + 4], 1
je 0x1001354b
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x4c], esi
jae 0x10013546
lea ecx, [esp + 0x38]
call fcn.100135a0
test byte [ebp + 4], 2
je 0x10013564
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x4c], esi
jae 0x1001355f
lea ecx, [esp + 0x38]
call fcn.100136e0
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x4c], esi
jb 0x1001357d
mov edx, dword [esp + 0x38]
push edx
call fcn.100cf5f9
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.100cf604
add esp, 0x4c
ret 4
Function at 0x10013ad0
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0x20
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x1c], eax
xor eax, eax
push esi
mov word [esp + 8], ax
mov eax, edx
push edi
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10013b00
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.10013d30
mov eax, dword [esp + 0x1c]
lea ecx, [eax + eax + 2]
push ecx
push 2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x10013b41
cmp dword [esp + 0x20], 8
jb 0x10013bab
mov edx, dword [esp + 0xc]
push edx
jmp 0x10013ba3
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x10013b61
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x20], 8
jb 0x10013bab
mov eax, dword [esp + 0xc]
push eax
jmp 0x10013ba3
cmp dword [esp + 0x20], 8
mov ecx, dword [esp + 0xc]
jae 0x10013b70
lea ecx, [esp + 0xc]
push ecx
inc edi
push edi
push eax
call fcn.100d10c5
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x10013b97
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x20], 8
jb 0x10013bab
mov ecx, dword [esp + 0xc]
push ecx
call fcn.100cf5f9
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.100cf604
add esp, 0x20
ret
Function at 0x10014170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10130bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
sub eax, ebx
je 0x10014323
sub eax, 1
je 0x1001423e
sub eax, 2
jne 0x1001439a
call fcn.10002720
cmp dword [eax + 0x1200], ebx
jne 0x100141dc
call fcn.10002720
lea ecx, [eax + 0x154]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
call edx
mov edi, dword [0x1016cc70]
cmp edi, ebx
jne 0x1001420d
push 8
call fcn.100cfcae
add esp, 4
cmp eax, ebx
je 0x10014203
mov dword [eax + 4], 0xffffffff
mov dword [eax], vtable.t_PicFaceTls.0
jmp 0x10014205
xor eax, eax
mov edi, eax
mov dword [0x1016cc70], edi
mov eax, dword [edi + 4]
add edi, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x1001422f
push esi
call fcn.10009c90
push esi
call fcn.100cf5f9
add esp, 4
mov ecx, dword [edi]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1001439a
push 1
call fcn.100d21d7
add esp, 4
mov byte [esp + 0x18], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], ebx
call fcn.100680e0
lea edx, [esp + 0x14]
push edx
mov ecx, eax
call fcn.10065d20
test al, al
je 0x100142b1
lea esi, [esp + 0x14]
call fcn.1006a920
mov ecx, esi
test al, al
je 0x100142b5
call fcn.10069da0
test al, al
je 0x100142b1
push 0xffffffffffffffff
mov eax, esi
push ebx
push eax
call fcn.10007d40
mov ecx, eax
call fcn.100c04a0
mov ecx, esi
test al, al
je 0x100142b5
push ecx
call fcn.10002400
mov ebx, eax
call fcn.10068230
test al, al
jne 0x100142d2
mov ecx, esi
call fcn.100619f0
lea ecx, [esp + 0x14]
call fcn.10061940
or eax, 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x1016bc60], edi
call fcn.10002720
push 0x104
push 0x1016ba58
push edi
mov dword [eax + 0x11c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x1016ba58
call fcn.100d0727
add esp, 8
test eax, eax
je 0x1001430c
xor edx, edx
mov word [eax], dx
call fcn.1007cdf0
mov eax, dword [eax]
call fcn.1007b2a0
lea ecx, [esp + 0x14]
call fcn.10061940
jmp 0x1001439a
mov dword [0x1016bc60], ebx
call fcn.10002720
cmp dword [eax + 0x1200], ebx
jne 0x10014370
cmp byte [0x1016ba50], bl
jne 0x10014370
call fcn.10002720
cmp dword [eax + 0x120], ebx
je 0x10014370
cmp dword [0x1016ba54], 9
jl 0x10014370
call fcn.10002720
mov eax, dword [eax + 0x120]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc8]
push 0x101402b8
call eax
call fcn.10002720
call fcn.100027a0
mov eax, dword [0x1016ba4c]
mov esi, eax
cmp eax, ebx
je 0x10014394
push eax
call fcn.10012fe0
push esi
call fcn.100cf5f9
add esp, 4
mov dword [0x1016ba4c], ebx
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10014e00
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 0
push ecx
push 0
push eax
push 1
push 1
push 0
push 0
push 0x80001080
push 0x1013c8bc
push str.Edit
push 0
mov byte [esi + 0x154], 0
mov byte [esi + 0x155], 1
mov dword [esi + 0x168], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x164], eax
test eax, eax
je 0x10014e4d
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10085500
mov eax, dword [eax]
push eax
call fcn.100842a0
test eax, eax
je 0x10014e79
mov edx, dword [eax + 4]
lea ecx, [eax + 0x18]
add eax, 8
mov dword [esi + 0x120], edx
mov dword [esi + 0x124], ecx
mov dword [esi + 0x128], eax
mov eax, dword [esi + 0x164]
test eax, eax
jne 0x10014e87
xor al, al
pop ecx
ret
push esi
push str.1E287BCD_7589_42C0_911D_4A79F12E75BD
push eax
call dword [sym.imp.USER32.dll_SetPropW]
mov edx, dword [esi + 0x164]
push 0x10014ec0
push 0xfffffffffffffffc
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [esi + 0x16c], eax
mov al, 1
pop ecx
ret

Function at 0x10015840
Capabilities:
Get graphical window text

Disassembly:
push ebx
push edi
mov edi, eax
mov eax, dword [esi + 0x13c]
xor ebx, ebx
cmp eax, ebx
je 0x1001585f
push eax
call fcn.100cf89b
add esp, 4
mov dword [esi + 0x13c], ebx
push edi
call fcn.100d2059
add esp, 4
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x164]
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [esi + 0x156], bl
jne 0x100158ac
mov eax, dword [esi + 0x138]
cmp eax, ebx
je 0x1001589d
push eax
call fcn.100cf89b
add esp, 4
mov dword [esi + 0x138], ebx
push edi
call fcn.100d2059
add esp, 4
mov dword [esi + 0x138], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100158b1
mov ecx, dword [esi + 0x164]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
sub eax, edx
push 0xb1
sar eax, 1
push ecx
mov edi, eax
call ebx
mov edx, dword [esi + 0x164]
push edi
push edi
push 0xb1
push edx
call ebx
mov ecx, esi
pop edi
pop ebx
jmp fcn.10015eb0
Function at 0x1001aaf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1001ab38
mov esi, dword [eax + 0x1e4]
test esi, esi
je 0x1001ab38
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1001ab38
push eax
call ebx
test eax, eax
je 0x1001ab38
mov eax, dword [esi + 0x12c]
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1001ab5d
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1001ab5d
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1001ab5d
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1001ab8f
mov esi, dword [eax + 0x200]
test esi, esi
je 0x1001ab8f
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1001ab8f
push eax
call ebx
test eax, eax
je 0x1001ab8f
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call edi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001e090
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1001e0c3
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1001e0c3
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1001e0c3
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1001e0f9
mov esi, dword [eax + 0x200]
test esi, esi
je 0x1001e0f9
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1001e0f9
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1001e0f9
mov eax, dword [esi + 0x12c]
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1001e13a
cmp byte [eax + 0x1cc], 0
je 0x1001e13a
mov ecx, dword [eax + 0x1c8]
mov eax, dword [ecx + 0x14c]
cmp byte [eax + 0x30], 0
je 0x1001e13a
mov eax, dword [eax + 0x80]
test eax, eax
je 0x1001e133
call fcn.1007e510
test al, al
je 0x1001e13a
push 0
call fcn.10021dc0
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10025a10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x10025a43
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x10025a43
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x10025a43
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x10025a79
mov esi, dword [eax + 0x200]
test esi, esi
je 0x10025a79
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x10025a79
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10025a79
mov eax, dword [esi + 0x12c]
push 0
push eax
call edi
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10026bf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov esi, ecx
call fcn.10002720
test eax, eax
je 0x10026c3d
call fcn.10002720
cmp dword [eax + 0x1200], 1
jne 0x10026c3d
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 0xb]
cmp ecx, 0x38
ja 0x10026c3d
mov ecx, dword [esi + 0x12c]
movzx edx, ax
movzx eax, word [ebp + 8]
shl edx, 0x10
or edx, eax
push edx
push 2
push 0xa1
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x10026c68
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x10026c68
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x10026c68
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x10026c9e
mov esi, dword [eax + 0x200]
test esi, esi
je 0x10026c9e
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x10026c9e
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10026c9e
mov edx, dword [esi + 0x12c]
push 0
push edx
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x10026cdf
cmp byte [eax + 0x1cc], 0
je 0x10026cdf
mov ecx, dword [eax + 0x1c8]
mov eax, dword [ecx + 0x14c]
cmp byte [eax + 0x30], 0
je 0x10026cdf
mov eax, dword [eax + 0x80]
test eax, eax
je 0x10026cd8
call fcn.1007e510
test al, al
je 0x10026cdf
push 0
call fcn.10021dc0
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002c400
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x264], 0
push esi
push edi
jg 0x1002c43b
mov ecx, dword [ebx + 0x228]
cmp byte [ecx + 0x31], 0
je 0x1002c425
mov byte [ecx + 0x64], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x4c]
push 0
mov byte [ecx + 0x31], 0
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1002c466
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1002c466
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1002c466
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1002c49c
mov esi, dword [eax + 0x200]
test esi, esi
je 0x1002c49c
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1002c49c
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1002c49c
mov eax, dword [esi + 0x12c]
push 0
push eax
call edi
mov eax, dword [ebx + 0x264]
push ebx
call fcn.1002c5b0
dec dword [ebx + 0x264]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1002c4c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x23c]
test eax, eax
jne 0x1002c4db
or eax, 0xffffffff
jmp 0x1002c4fa
mov ecx, dword [eax + 0x124]
add ecx, 8
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [edi + 0x260], eax
dec eax
cmp dword [edi + 0x264], eax
jl 0x1002c529
mov ecx, dword [edi + 0x22c]
cmp byte [ecx + 0x31], 0
je 0x1002c513
mov byte [ecx + 0x64], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x4c]
push 0
mov byte [ecx + 0x31], 0
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1002c554
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1002c554
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1002c554
push 0
push eax
call ebx
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1002c58a
mov esi, dword [eax + 0x200]
test esi, esi
je 0x1002c58a
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1002c58a
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1002c58a
mov eax, dword [esi + 0x12c]
push 0
push eax
call ebx
mov eax, dword [edi + 0x264]
push edi
call fcn.1002c780
inc dword [edi + 0x264]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e3e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push edi
mov edi, dword [esi + 0x1d8]
cmp byte [edi + 0x30], 1
je 0x1002e405
mov eax, dword [edi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, edi
mov byte [edi + 0x30], 1
call edx
cmp dword [edi + 0x84], edi
je 0x1002e411
mov byte [edi + 0x64], 1
mov eax, dword [edi + 0x12c]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [edi + 0x12c]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
neg eax
sbb eax, eax
neg eax
add eax, 4
push eax
push ecx
call edi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esi + 0x1d8]
call fcn.10048730
mov eax, dword [esi + 0x12c]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x1002e476
mov edx, dword [esi + 0x1d8]
push eax
xor ecx, ecx
call fcn.10048730
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x1d8]
mov eax, dword [esi + 0x2c]
sub eax, dword [ecx + 0x2c]
push 0x1d
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x10]
push 0xd2
push 0x172
push eax
mov eax, dword [esi + 0x28]
sub eax, dword [ecx + 0x28]
cdq
sub eax, edx
mov edx, dword [ecx + 0x12c]
sar eax, 1
add eax, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x1d8]
mov ecx, dword [eax + 0x12c]
push 4
push ecx
call edi
mov edx, dword [esi + 0x1d8]
mov eax, dword [edx + 0x12c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 8