joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1091ba2
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov cl, byte [esi + 0x2530]
test cl, cl
push edi
je 0x1091c32
lea eax, [esi + 0x2531]
cmp byte [eax], 0
je 0x1091bc7
mov byte [eax], 0
test cl, cl
je 0x1091c32
lea edi, [esi + 0xd0]
mov ecx, edi
call fcn.0114728a
lea ebx, [esi + 0x20]
push 0xffffffffffffffff
mov ecx, ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], eax
call fcn.01090d15
push 2
push 2
mov ecx, ebx
call fcn.0108f0b6
mov eax, dword [esi + 0xcc]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
neg edi
sbb edi, edi
lea ecx, [esi + 0xd4]
and edi, ecx
mov ecx, dword [edi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov dword [ebx], ecx
mov dword [ebx + 4], eax
push dword [esi + 0xd4]
call edi
push 0
jmp 0x1091cd5
cmp byte [esi + 0x2531], 0
lea edi, [esi + 0x20]
mov ecx, edi
je 0x1091c9a
mov eax, dword [esi + 0x2564]
push 0xffffffffffffffff
mov dword [esi + 0x68], eax
call fcn.01090d15
push 2
push 0
mov ecx, edi
call fcn.0108f0b6
mov eax, dword [esi + 0xcc]
mov ecx, dword [esi + 0xc8]
mov edx, eax
add eax, 4
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edx]
mov edx, ecx
add ecx, 4
neg edx
sbb edx, edx
and edx, ecx
mov ecx, dword [edx]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0xd4]
call edi
push 5
jmp 0x1091cd5
push 1
call fcn.01090d15
push 2
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.0108f0b6
mov eax, dword [esi + 0xcc]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [esi + 0xd4]
call edi
push ebx
mov eax, dword [esi + 0xc8]
push dword [eax + 4]
call edi
cmp byte [esi + 0x2530], 0
jne 0x1091cfc
cmp byte [esi + 0x2531], 0
jne 0x1091cfc
push 0
push dword [esi + 0x2548]
jmp 0x1091d58
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x2518]
add eax, dword [ebp - 0x14]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
lea ebx, [esi + 0x2548]
push eax
mov ecx, ebx
call fcn.0108f096
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push 0x15
xor eax, eax
push eax
dec ecx
push eax
dec ecx
push ecx
mov ecx, dword [esi + 0x38]
sub ecx, dword [ebp - 8]
lea ecx, [ecx + edx - 6]
push ecx
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
push dword [ebx]
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1091d64
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0xc0]
dec eax
je 0x1091d89
dec eax
je 0x1091d7e
dec eax
jne 0x1091d94
add ecx, 0x1ed0
jmp fcn.01090c1b
add ecx, 0x19d0
jmp fcn.01090181
add ecx, 0xad0
jmp fcn.0109000f
ret
Function at 0x1091fcc
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esi + 0x58]
call fcn.011832ba
cmp dword [esi + 0x70], 0
jge 0x1091fec
xor eax, eax
jmp 0x1092193
push ebx
push edi
mov ecx, esi
call fcn.01146e58
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
shl eax, 4
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 4], eax
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff38
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1092068
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0xffffffff
je 0x109205e
test eax, eax
je 0x1092068
push eax
mov ecx, edi
call fcn.0108ed38
cmp eax, 0xffffffff
jne 0x1092065
xor eax, eax
jmp 0x1092191
mov dword [esi + 0x70], eax
push 0
mov ecx, edi
call fcn.01061b61
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov ecx, esi
push eax
call fcn.010902c3
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 5
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 0
push 0
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff2d
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1092102
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1092111
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 1
lea ecx, [esi + 0x20]
push 1
call fcn.011483f2
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x64]
shl ecx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [ecx + edx + 0xc]
push 1
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.011483f2
push 1
mov ecx, edi
call fcn.01061b61
push 0x181
push 0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi]
mov eax, dword [esi + 0x70]
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffff2a
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
push eax
push 0x4e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x109219b
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esi + 0x58]
call fcn.011832ba
cmp dword [esi + 0x70], 0
jge 0x10921bb
xor eax, eax
jmp 0x1092363
push ebx
push edi
lea ecx, [esi + 0x78]
call fcn.01154034
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
shl eax, 4
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 4], eax
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff38
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1092238
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0xffffffff
je 0x109222e
test eax, eax
je 0x1092238
push eax
mov ecx, edi
call fcn.0108ed38
cmp eax, 0xffffffff
jne 0x1092235
xor eax, eax
jmp 0x1092361
mov dword [esi + 0x70], eax
push 0
mov ecx, edi
call fcn.01061b61
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov ecx, esi
push eax
call fcn.010902c3
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 5
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 0
push 0
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff2d
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x10922d2
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10922e1
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 1
lea ecx, [esi + 0x20]
push 1
call fcn.011483f2
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x64]
shl ecx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [ecx + edx + 0xc]
push 1
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.011483f2
push 1
mov ecx, edi
call fcn.01061b61
push 0x181
push 0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi]
mov eax, dword [esi + 0x70]
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffff2a
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
push eax
push 0x4e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x109236b
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
lea ecx, [esi + 0x58]
call fcn.011832ba
cmp dword [esi + 0x70], 0
jge 0x109238b
xor eax, eax
jmp 0x1092536
push ebx
push edi
lea ecx, [esi + 0x240]
call fcn.011585d5
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
shl eax, 4
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 4], eax
lea edi, [esi + 4]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff38
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x109240b
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, 0xffffffff
je 0x1092401
test eax, eax
je 0x109240b
push eax
mov ecx, edi
call fcn.0108ed38
cmp eax, 0xffffffff
jne 0x1092408
xor eax, eax
jmp 0x1092534
mov dword [esi + 0x70], eax
push 0
mov ecx, edi
call fcn.01061b61
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov ecx, esi
push eax
call fcn.010902c3
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 5
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x64]
push 0
push 0
shl eax, 4
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push eax
mov dword [ebp - 0x24], eax
call ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0xffffff2d
call ebx
push eax
push 0x4e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x10924a5
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10924b4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 1
lea ecx, [esi + 0x20]
push 1
call fcn.011483f2
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x64]
shl ecx, 4
mov eax, dword [ecx + edx + 8]
mov ecx, dword [ecx + edx + 0xc]
push 1
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.011483f2
push 1
mov ecx, edi
call fcn.01061b61
push 0x181
push 0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi]
mov eax, dword [esi + 0x70]
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffff2a
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
push eax
push 0x4e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x109277d
Capabilities:
Create thread
Hide graphical window

Disassembly:
mov eax, 0x12770c7
call fcn.01160458
push ecx
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x24]
call fcn.01033682
test eax, eax
jge 0x1092793
xor al, al
jmp 0x109294c
cmp dword [esi + 0x3c], 0
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 0x100355c
je 0x1092831
push ebx
push dword [esi + 0x50]
call edi
test eax, eax
je 0x1092930
push ebx
push dword [esi + 0x5c]
call edi
test eax, eax
je 0x1092930
push ebx
push dword [esi + 0x44]
call edi
xor ecx, ecx
cmp eax, ecx
je 0x1092930
cmp byte [esi + 0x39], cl
je 0x1092827
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
push ecx
lea eax, [ebp - 0x10]
push 0xf107
push eax
call fcn.010535f5
add esp, 0xc
test eax, eax
jne 0x109280d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fe
jmp 0x1092930
push dword [ebp - 0x10]
push dword [esi + 0x4c]
call edi
test eax, eax
je 0x10927fc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fe
jmp 0x1092831
push ecx
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x3c], 2
jne 0x1092854
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x48]
call ebx
push 0
push dword [esi + 0x54]
call ebx
push 0
push dword [esi + 0x40]
call ebx
jmp 0x109288b
push ebx
push dword [esi + 0x40]
call edi
test eax, eax
je 0x1092930
push 0
mov eax, 0x4000
push eax
push eax
lea ecx, [esi + 0x40]
call fcn.01032b63
movzx eax, word [esi + 0x6c]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x3c]
cmp eax, 2
je 0x1092898
cmp eax, 3
jne 0x1092901
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
mov eax, dword [0x12d1f58]
push 0xf106
push dword [eax + 8]
lea ecx, [ebp - 0x10]
call fcn.01044bf9
push dword [ebp - 0x10]
push dword [esi + 4]
call edi
test eax, eax
jne 0x10928d3
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1092930
mov eax, dword [0x12d1f58]
push 0xf108
push dword [eax + 8]
lea ecx, [ebp - 0x10]
call fcn.01044bf9
push dword [ebp - 0x10]
push dword [esi + 0x48]
call edi
test eax, eax
je 0x10928c4
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, edi
call fcn.01032646
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push esi
push 0x109295e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x64], eax
jne 0x1092934
xor al, al
jmp 0x109294a
mov ecx, 0x12d2398
call fcn.0107dc59
push eax
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1093673
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push dword [esi + 0x2548]
call ebx
lea ecx, [esi + 4]
push edi
mov dword [ebp - 4], ecx
call fcn.01061b61
cmp dword [esi + 0xc0], edi
jne 0x10936b5
cmp byte [esi + 0x2531], 0
je 0x10936b5
mov eax, dword [esi + 0x38]
mov dword [esi + 0x2534], eax
lea edi, [esi + 0x20]
push 1
mov ecx, edi
call fcn.01090d15
lea eax, [esi + 0xad0]
neg eax
sbb eax, eax
lea ecx, [esi + 0xad4]
and eax, ecx
mov eax, dword [eax]
and dword [edi], 0
mov dword [edi + 4], eax
mov eax, dword [esi + 0xc8]
push 0
push dword [eax + 4]
call ebx
mov eax, dword [esi + 0xcc]
push 0
push dword [eax + 4]
call ebx
cmp dword [esi + 0xc0], 0
je 0x1093705
mov ecx, esi
call fcn.01091d64
xor eax, eax
cmp byte [ebp + 0xc], al
je 0x1093716
cmp byte [ebp + 0x10], al
setne al
inc eax
inc eax
jmp 0x109371d
cmp byte [ebp + 8], 0
setne al
lea ebx, [esi + 0xad0]
push eax
mov ecx, ebx
call fcn.0108f06f
mov al, byte [ebp + 0xc]
mov ecx, ebx
mov byte [esi + 0x19b8], al
mov dword [esi + 0xc0], 1
call fcn.01091fcc
mov ecx, edi
call fcn.0103801b
mov esi, dword [ebp - 4]
push 1
mov ecx, esi
call fcn.01061b61
push 0x181
push 0
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1093a11
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push dword [esi + 0x2548]
call ebx
lea ecx, [esi + 4]
push edi
mov dword [ebp - 4], ecx
call fcn.01061b61
push edi
push edi
push 0x80e1
push dword [0x12d24cc]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0xc0], edi
jne 0x1093a66
cmp byte [esi + 0x2531], 0
je 0x1093a66
mov eax, dword [esi + 0x38]
mov dword [esi + 0x2534], eax
lea edi, [esi + 0x20]
push 1
mov ecx, edi
call fcn.01090d15
lea eax, [esi + 0x19d0]
neg eax
sbb eax, eax
lea ecx, [esi + 0x19d4]
and eax, ecx
mov eax, dword [eax]
and dword [edi], 0
mov dword [edi + 4], eax
mov eax, dword [esi + 0xc8]
push 0
push dword [eax + 4]
call ebx
mov eax, dword [esi + 0xcc]
push 0
push dword [eax + 4]
call ebx
cmp dword [esi + 0xc0], 0
je 0x1093ab6
mov ecx, esi
call fcn.01091d64
lea ebx, [esi + 0x19d0]
push 0
mov ecx, ebx
call fcn.0108f06f
mov ecx, ebx
mov dword [esi + 0xc0], 2
call fcn.0109219b
mov ecx, edi
call fcn.0103801b
mov esi, dword [ebp - 4]
push 1
mov ecx, esi
call fcn.01061b61
push 0x181
push 0
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1093b04
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea eax, [esi + 0x2508]
push eax
call fcn.0103db49
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
push edi
push dword [esi + 0x2548]
call ebx
lea ecx, [esi + 4]
push edi
mov dword [ebp + 8], ecx
call fcn.01061b61
cmp dword [esi + 0xc0], edi
jne 0x1093b54
cmp byte [esi + 0x2531], 0
je 0x1093b54
mov eax, dword [esi + 0x38]
mov dword [esi + 0x2534], eax
lea edi, [esi + 0x20]
push 1
mov ecx, edi
call fcn.01090d15
lea eax, [esi + 0x1ed0]
neg eax
sbb eax, eax
lea ecx, [esi + 0x1ed4]
and eax, ecx
mov eax, dword [eax]
and dword [edi], 0
mov dword [edi + 4], eax
mov eax, dword [esi + 0xc8]
push 0
push dword [eax + 4]
call ebx
mov eax, dword [esi + 0xcc]
push 0
push dword [eax + 4]
call ebx
cmp dword [esi + 0xc0], 0
je 0x1093ba4
mov ecx, esi
call fcn.01091d64
lea ebx, [esi + 0x1ed0]
push 0
mov ecx, ebx
call fcn.0108f06f
mov ecx, ebx
mov dword [esi + 0xc0], 3
call fcn.0109236b
mov ecx, edi
call fcn.0103801b
mov esi, dword [ebp + 8]
push 1
mov ecx, esi
call fcn.01061b61
push 0x181
push 0
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1095829
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc0]
xor ebx, ebx
cmp dword [edi], ebx
je 0x1095853
call fcn.01091d64
push ebx
mov ecx, esi
mov dword [edi], ebx
call fcn.01093775
jmp 0x1095865
cmp byte [esi + 0x2531], 0
je 0x1095865
mov eax, dword [esi + 0x38]
mov dword [esi + 0x2534], eax
mov eax, dword [esi + 0xcc]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [eax + 4]
call ebx
cmp byte [ebp + 8], 0
je 0x109590b
lea ecx, [esi + 0xd0]
call fcn.0114728a
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0xcc]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
lea ecx, [esi + 0xd0]
neg ecx
sbb ecx, ecx
lea edx, [esi + 0xd4]
and ecx, edx
mov ecx, dword [ecx]
lea edi, [esi + 0x20]
mov dword [edi], ecx
push 0xffffffffffffffff
mov ecx, edi
mov dword [edi + 4], eax
call fcn.01090d15
push 2
push 2
mov ecx, edi
call fcn.0108f0b6
push 0
lea ecx, [esi + 0xd0]
call fcn.0114728a
push eax
mov ecx, esi
call fcn.010360c2
push 5
push dword [esi + 0xd4]
call ebx
mov eax, dword [esi + 0xc8]
push 0
push dword [eax + 4]
call ebx
mov byte [esi + 0x2530], 1
jmp 0x10959dd
cmp byte [ebp + 0xc], 0
lea edi, [esi + 0x20]
je 0x1095992
mov eax, dword [esi + 0x2564]
mov ecx, dword [esi + 0xc8]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0xcc]
mov edx, eax
add eax, 4
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edx]
mov edx, ecx
add ecx, 4
neg edx
sbb edx, edx
and edx, ecx
mov ecx, dword [edx]
mov dword [edi], ecx
push 0xffffffffffffffff
mov ecx, edi
mov dword [edi + 4], eax
call fcn.01090d15
push 2
push 0
mov ecx, edi
call fcn.0108f0b6
push 0
push dword [esi + 0x2534]
mov ecx, esi
call fcn.010360c2
push 0
push dword [esi + 0xd4]
call ebx
mov eax, dword [esi + 0xc8]
push 5
push dword [eax + 4]
call ebx
mov byte [esi + 0x2530], 0
mov byte [esi + 0x2531], 1
jmp 0x10959e4
mov eax, dword [esi + 0xcc]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
and dword [edi], 0
push 1
mov ecx, edi
mov dword [edi + 4], eax
call fcn.01090d15
push 2
push 0
mov ecx, edi
call fcn.0108f0b6
push 0
push dword [esi + 0xd4]
call ebx
mov eax, dword [esi + 0xc8]
push 0
push dword [eax + 4]
call ebx
mov byte [esi + 0x2530], 0
mov byte [esi + 0x2531], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.01091d9a
cmp byte [esi + 0x2530], 0
jne 0x1095a12
cmp byte [esi + 0x2531], 0
jne 0x1095a12
push 0
jmp 0x1095a14
push 4
push dword [esi + 0x2548]
call ebx
mov ecx, edi
call fcn.0103801b
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret 8