joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10130520
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov byte [esp + 0x10], al
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], fcn.100cf978
mov dword [esp + 0x1c], fcn.100cfa42
mov dword [esp + 0x20], fcn.100cf89b
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x1fff8
mov dword [esp + 0x14], vtable.t_heap.0
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x3c], 1
call fcn.10097f30
add esp, 4
mov byte [esp + 0x38], 0
mov esi, dword [esp + 0x24]
test al, al
jne 0x100040ac
test esi, esi
je 0x1000408f
mov edi, dword [esp + 0x20]
lea esp, [esp]
mov eax, esi
mov esi, dword [esi + 4]
push eax
call edi
add esp, 4
test esi, esi
jne 0x10004080
lea ecx, [esp + 0xc]
call fcn.10061940
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100040c3
mov edi, dword [esp + 0x20]
mov eax, esi
mov esi, dword [esi + 4]
push eax
call edi
add esp, 4
test esi, esi
jne 0x100040b4
lea ecx, [esp + 0xc]
call fcn.10061940
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100040e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10130c36
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
call fcn.10054e70
test eax, eax
jne 0x10004137
xor al, al
jmp 0x100042da
push 0x3a0
call fcn.100cfcae
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x10004159
mov esi, eax
call fcn.1005ac60
mov esi, eax
mov dword [esp + 0x10], esi
jmp 0x1000415f
mov dword [esp + 0x10], ebx
mov esi, ebx
mov dword [esi + 8], 0xfffffff7
mov dword [esi + 0x18], 0x100000
call fcn.100025a0
test eax, eax
je 0x10004195
call fcn.100025a0
cmp dword [eax + 0x20], ebx
je 0x10004195
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x12c]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x150], ebx
call fcn.100680e0
cmp word [eax + 0x4d4], bx
lea esi, [eax + 0x4d4]
jne 0x100041dd
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push ebx
push ebx
push 0x23
push ebx
call edi
test eax, eax
je 0x100041dd
push esi
push 1
push ebx
push 0x23
push ebx
call edi
test eax, eax
je 0x100041dd
xor esi, esi
mov ebx, esi
lea edi, [esp + 0x24]
call fcn.1004b160
mov eax, str.SogouInputComponentsPicfaceJson
mov esi, edi
mov byte [esp + 0x150], 1
call fcn.1004a0c0
push 0
mov ecx, edi
call fcn.1004a5a0
test al, al
je 0x10004271
mov ecx, edi
push ecx
mov ebx, str.SGPicFaceDT.json
call fcn.1004a120
test al, al
je 0x10004271
cmp byte [esp + 0x136], 0
lea eax, [esp + 0x28]
jne 0x1000422f
mov eax, dword [esp + 0x130]
lea edx, [esp + 0x18]
lea ecx, [eax + 4]
push edx
call fcn.100b7840
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x10004275
mov ecx, esi
call fcn.100c3c40
cmp eax, 7
jne 0x10004275
push 0x1013ca08
mov ecx, esi
call fcn.100c4aa0
test eax, eax
je 0x10004275
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.100b7f40
add esp, 4
jmp 0x10004275
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
mov dword [eax + 0x390], edx
call fcn.10054e70
call fcn.10054f00
mov ecx, dword [esp + 0x20]
call fcn.10004550
cmp byte [esp + 0x136], 0
jne 0x100042b9
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x100042b9
push eax
call fcn.100cf89b
add esp, 4
mov dword [esp + 0x150], 0xffffffff
test esi, esi
je 0x100042d8
mov ecx, esi
call fcn.100c3a10
push esi
call fcn.100cf5f9
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.100cf604
mov esp, ebp
pop ebp
ret 4
Function at 0x10004410
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.10054e70
test eax, eax
jne 0x1000441e
xor al, al
ret 4
mov eax, dword [esp + 4]
cmp byte [eax + 0x120a], 0
je 0x10004419
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
mov esi, eax
call fcn.10054e70
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
push 0
add eax, 8
push eax
call edi
test eax, eax
je 0x10004483
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x1388
jbe 0x1000446b
call ebp
sub eax, esi
cmp eax, 0x1d4c0
ja 0x10004482
push 0x64
call ebx
call fcn.10054e70
push 0
push 0
add eax, 8
push eax
call edi
test eax, eax
jne 0x10004458
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
ret 4

Function at 0x10004550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10130c00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], vtable.t_mutex::t_locker.0
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x14]
lea edi, [esi + 0xda0]
push eax
mov byte [esp + 0x34], 1
mov dword [esp + 0x14], edi
call fcn.100657b0
test al, al
jne 0x100045f0
lea ecx, [esp + 0x14]
call fcn.100619a0
push 0x1013f970
push 0x1013c7e4
mov edx, eax
call fcn.10062cd0
add esp, 8
lea ecx, [esp + 0x14]
call fcn.10061940
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push ebx
add esi, 0xd9c
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x1000464d
push ebx
push ebx
push ebx
push 0x10002f00
push ebx
push ebx
mov dword [esp + 0x38], ebx
call fcn.100d1a8f
push ebx
push ebx
push ebx
push 0x10004490
push ebx
push ebx
mov dword [esp + 0x4c], eax
call fcn.100d1a8f
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x30
mov dword [esp + 0x20], eax
xor esi, esi
lea ebx, [ebx]
mov ecx, dword [esp + esi*4 + 0x1c]
push ecx
call edi
inc esi
cmp esi, 2
jl 0x10004640
mov edi, dword [esp + 0x10]
mov byte [esp + 0x30], bl
cmp edi, ebx
je 0x1000465e
call fcn.100658f0
lea ecx, [esp + 0x14]
call fcn.10061940
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004cc0
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1012a73b
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x438], eax
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x44c]
mov dword fs:[0], eax
cmp dword [ebx + 0x3b0], 0
lea esi, [ebx + 0x3b0]
jne 0x10004dbc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x246]
push ecx
mov word [esp + 0x248], ax
call fcn.100d6e40
add esp, 0xc
lea edx, [esp + 0x23c]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x23c]
mov edx, esi
call fcn.1004b220
mov eax, str.SGPicFaceTpBq
call fcn.1004a0c0
lea edi, [esp + 0x124]
call fcn.1004b080
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1013f9d8
call fcn.1004b4d0
add esp, 8
cmp byte [esp + 0x236], 0
lea eax, [esp + 0x128]
jne 0x10004d8f
mov eax, dword [esp + 0x230]
add eax, 4
call fcn.1004a0c0
cmp byte [esp + 0x236], 0
jne 0x10004dbc
mov eax, dword [esp + 0x230]
lea ecx, [esp + 0x128]
cmp eax, ecx
je 0x10004dbc
push eax
call fcn.100cf89b
add esp, 4
push esi
lea edi, [esp + 0x10]
call fcn.1004b0e0
mov ecx, edi
mov dword [esp + 0x454], 0
call fcn.1004a200
cmp byte [esp + 0x45c], 0
je 0x10004e11
test al, al
je 0x10004e09
cmp byte [esp + 0x11e], 0
lea eax, [esp + 0x10]
jne 0x10004dfb
mov eax, dword [esp + 0x118]
add eax, 4
push 1
push eax
call fcn.1004a420
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10004e5c
test al, al
je 0x10004e62
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebx + 0xd94]
cmp eax, 0x1b7740
jbe 0x10004e62
lea ecx, [esp + 0xc]
call fcn.1004a200
test al, al
je 0x10004e5a
cmp byte [esp + 0x11e], 0
lea eax, [esp + 0x10]
jne 0x10004e4c
mov eax, dword [esp + 0x118]
add eax, 4
push 0
push eax
call fcn.1004a420
add esp, 8
call esi
mov dword [ebx + 0xd94], eax
cmp byte [esp + 0x11e], 0
jne 0x10004e84
mov eax, dword [esp + 0x118]
lea edx, [esp + 0x10]
cmp eax, edx
je 0x10004e84
push eax
call fcn.100cf89b
add esp, 4
mov ecx, dword [esp + 0x44c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.100cf604
add esp, 0x44c
ret 4
Function at 0x10007c80
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [esi + 4]
push eax
call edi
test eax, eax
jne 0x10007ce2
push esi
call fcn.100082a0
mov ecx, dword [esi + 4]
push ecx
call edi
test eax, eax
jne 0x10007ce2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov edi, eax
call fcn.100619a0
mov esi, eax
call fcn.100621c0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
call fcn.100619a0
push 0x1013fbf0
push 0x1013c7e4
mov edx, eax
call fcn.10062cd0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x100082a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x1012b57b
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
push 0x998
call fcn.100cfcae
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x100082ef
push eax
call fcn.10009980
mov esi, eax
jmp 0x100082f1
xor esi, esi
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
jne 0x1000835a
mov ecx, ebx
call fcn.100619a0
push 0x1013fc08
push 0x1013c7e4
mov edx, eax
call fcn.10062cd0
mov eax, dword [ebp + 4]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10008337
push esi
call fcn.10009c90
push esi
call fcn.100cf5f9
add esp, 4
mov ecx, dword [ebp + 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
mov edx, dword [ebp + 4]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100083ce
push esi
call fcn.100cf5f9
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov edi, eax
call fcn.100619a0
mov esi, eax
call fcn.100621c0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
call fcn.100619a0
push 0x1013fc18
push 0x1013c7e4
mov edx, eax
call fcn.10062cd0
mov eax, dword [ebp + 4]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x1000a0b0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
push edi
mov edi, eax
mov eax, dword [edi + 0x20]
jne 0x1000a14c
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000a0fb
push esi
mov esi, dword [eax + 0x1e4]
test esi, esi
je 0x1000a0fa
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000a0fa
push eax
call ebp
test eax, eax
je 0x1000a0fa
mov eax, dword [esi + 0x12c]
push 0
push eax
call ebx
pop esi
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1000a11b
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1000a11b
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1000a11b
push 0
push eax
call ebx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1000a146
cmp dword [eax + 0x12c], 0
je 0x1000a146
mov eax, dword [eax + 0x12c]
push eax
call ebp
test eax, eax
je 0x1000a146
mov edi, dword [edi + 0x20]
mov ecx, dword [edi + 0x12c]
push 0
push ecx
call ebx
pop ebp
pop ebx
pop edi
ret 4
test eax, eax
je 0x1000a148
cmp dword [eax + 0x12c], 0
je 0x1000a148
mov edx, dword [eax + 0x12c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi + 0x20]
mov eax, dword [edi + 0x12c]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret 4

Function at 0x1000a190
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1000a1c5
cmp dword [eax + 0x12c], 0
je 0x1000a1c5
mov eax, dword [eax + 0x12c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x12c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
ret

Function at 0x1000a1d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 0x20]
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push esi
test eax, eax
je 0x1000a21f
cmp dword [eax + 0x1e4], 0
je 0x1000a21f
mov esi, dword [eax + 0x1e4]
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000a21f
push eax
call ebp
test eax, eax
je 0x1000a21f
mov eax, dword [esi + 0x12c]
push 0
push eax
call ebx
call fcn.10076570
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1000a25f
cmp dword [eax + 0x1e8], 0
je 0x1000a25f
mov esi, dword [eax + 0x1e8]
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000a25f
push eax
call ebp
test eax, eax
je 0x1000a25f
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call ebx
call fcn.10076570
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x1000a270
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov edi, eax
call fcn.1000a1d0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1000a37e
cmp dword [eax + 0x12c], 0
je 0x1000a37e
mov dword [edi + 0x790], 2
mov eax, dword [eax + 0x12c]
push 0x2711
push eax
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10002720
cmp dword [eax + 0x120], 0
je 0x1000a2e4
call fcn.100025a0
cmp dword [eax + 0x1c], 0
je 0x1000a2e4
call fcn.10002720
mov esi, dword [eax + 0x120]
call fcn.100025a0
mov eax, dword [eax + 0x1c]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x40]
mov ecx, esi
call eax
call fcn.100025a0
cmp dword [eax + 0x1c], 0
je 0x1000a30c
call fcn.100025a0
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x50]
call eax
call fcn.100025a0
mov dword [eax + 0x1c], 0
mov esi, dword [edi + 0x20]
cmp byte [esi + 0x30], 0
je 0x1000a324
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 0
mov ecx, esi
mov byte [esi + 0x30], 0
call eax
cmp dword [esi + 0x84], esi
je 0x1000a330
mov byte [esi + 0x64], 1
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 0x20]
push edx
call fcn.1002d4c0
mov esi, dword [edi + 0x20]
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000a36d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000a36d
mov eax, dword [esi + 0x12c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [edi + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov dword [edi + 0x20], 0
pop edi
mov al, 1
pop esi
pop ecx
ret

Function at 0x1000a9d0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov esi, eax
call fcn.10002720
mov dword [eax + 0x1200], 0
call fcn.10009fe0
test al, al
je 0x1000aa4c
mov edi, esi
call fcn.1000cb10
push 1
push 0
mov ecx, esi
call fcn.1000a710
mov eax, dword [esi + 0x20]
mov dword [eax + 0x514], 0x3e8
mov byte [eax + 0x518], 0
mov esi, dword [esi + 0x20]
cmp byte [esi + 0x30], 0
je 0x1000aa2b
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0
mov ecx, esi
mov byte [esi + 0x30], 0
call edx
cmp dword [esi + 0x84], esi
je 0x1000aa37
mov byte [esi + 0x64], 1
mov eax, dword [esi + 0x12c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x1000aea0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x68
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x1000aee5
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x1000aee5
push 2
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MonitorFromRect]
cmp eax, ebp
jne 0x1000af16
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x1000af04
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 2
push ecx
push edx
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x48]
push ecx
push eax
mov dword [esp + 0x50], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1000af50
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], edx
mov edx, dword [esp + 0x68]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebp
pop ebx
add esp, 0x68
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
call edi
push 1
mov ebx, eax
call edi
xor ecx, ecx
xor edx, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
push ebp
mov dword [esi + 8], ebx
push str.Shell_TrayWnd
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebp
je 0x1000afc0
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebp
pop ebx
add esp, 0x68
ret

Function at 0x1000b190
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1000b1b7
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1000b1b7
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1000b1b4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret
xor al, al
ret
Function at 0x1000b2d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, eax
push edi
mov edi, dword [esi + 0x20]
test edi, edi
je 0x1000b401
mov eax, edi
call fcn.1002d380
test eax, eax
je 0x1000b401
mov ebx, dword [edi + 0x200]
test ebx, ebx
je 0x1000b401
mov eax, edi
call fcn.1002d380
cmp dword [eax + 0x19c], 5
je 0x1000b401
mov eax, dword [ebx + 0x12c]
test eax, eax
je 0x1000b401
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1000b33e
mov eax, dword [ebx + 0x12c]
push 0
push eax
call edi
mov eax, esi
call fcn.1000b190
mov eax, esi
call fcn.1000b450
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push eax
push ebx
mov dword [ebx + 0x1bc], ecx
mov dword [ebx + 0x1c0], edx
call fcn.100385f0
xor eax, eax
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.1000aea0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
lea edx, [eax + 0x6d]
cmp edx, ecx
jle 0x1000b3bb
lea eax, [ecx - 0x6d]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
lea esi, [ecx + 0x1a]
cmp esi, edx
jle 0x1000b3d1
lea ecx, [edx - 0x1a]
mov dword [esp + 0x14], ecx
push 0x1d
push 0
push 0
push ecx
push eax
mov eax, dword [ebx + 0x12c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebx + 0x12c]
push 4
push ecx
call edi
call fcn.10076f20
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x1000b410
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax + 0x20]
push esi
test eax, eax
je 0x1000b44a
mov esi, dword [eax + 0x200]
test esi, esi
je 0x1000b44a
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000b446
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000b446
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x1000b450
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax + 0x20]
push esi
test eax, eax
je 0x1000b48a
mov esi, dword [eax + 0x1e4]
test esi, esi
je 0x1000b48a
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1000b486
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000b486
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret