joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108eb2a
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [esi + 0x698]
cmp byte [eax], 0
jne 0x108eb76
push ebx
mov ebx, dword [esi + 0x28]
push edi
mov edi, dword [esi + 0x24]
and dword [esi + 0x24], 0
mov byte [eax], 1
mov eax, dword [esi + 4]
test eax, eax
je 0x108eb5c
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x108eb66
push dword [ebp + 8]
push ebx
call edi
cmp dword [esi + 4], 0
pop edi
pop ebx
je 0x108eb76
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
pop ebp
ret 4

Function at 0x108eb96
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [0x11141ec]
test ecx, ecx
je 0x108ebe6
mov eax, dword [ecx + 4]
test eax, eax
je 0x108ebe6
push esi
push edi
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, eax
mov edi, dword [esi + 0x24]
test edi, edi
je 0x108ebce
and dword [esi + 0x24], 0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [esi + 0x28]
call edi
push 2
mov ecx, esi
call fcn.0108eb2a
mov ecx, dword [0x11141ec]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x108eba9
pop edi
pop esi
ret
Function at 0x108ec39
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [esi], eax
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x108ed4e
push eax
push 0x101478c
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
mov dword [ebp + 8], eax
je 0x108ed4e
lea eax, [ebp - 0x14]
push eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
call ebx
test eax, eax
je 0x108ed4e
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
je 0x108ed4e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
mov ebx, ecx
sub ebx, edx
cmp ebx, eax
jl 0x108ed1f
cmp dword [0x1113538], 0
push 2
je 0x108ecd0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, dword [ebp - 0x14]
mov dword [esi], eax
jmp 0x108ece0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [edi + 0x30]
sub ecx, eax
mov dword [esi], ecx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jl 0x108ed02
mov eax, dword [ebp - 0x20]
sub eax, dword [edi + 0x34]
sub eax, dword [0x11141e8]
mov dword [esi + 4], eax
jns 0x108ed4e
mov dword [ebp - 4], 1
jmp 0x108ed4e
mov ecx, dword [0x11141e8]
add ecx, eax
mov dword [esi + 4], ecx
sub eax, dword [edi + 0x34]
xor edx, edx
inc edx
cmp eax, ecx
jle 0x108ed1a
mov dword [ebp - 4], edx
mov dword [edi + 0x3c], edx
jmp 0x108ed4e
mov eax, dword [ebp - 8]
sub eax, dword [edi + 0x34]
sub eax, dword [0x11141e8]
mov dword [esi + 4], eax
jns 0x108ed37
mov dword [ebp - 4], 1
cmp edx, dword [ebp - 0x14]
jle 0x108ed4c
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [edi + 0x30]
sub ecx, eax
mov dword [esi], ecx
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop esi
sete al
pop ebx
leave
ret 4
Function at 0x10918bb
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], 1
mov al, byte [esi + 0x30]
xor ebx, ebx
or edi, 0xffffffff
test al, al
setne bl
xor ecx, ecx
cmp dword [esi + 0x28], ecx
je 0x109191d
test al, al
je 0x10918eb
mov ecx, esi
call fcn.0109175d
jmp 0x1091918
cmp dword [esi + 0x14], ecx
jne 0x1091900
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x14], eax
mov edi, 0xea60
jmp 0x1091918
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x14]
mov ecx, 0xea60
mov edx, ecx
sub edx, eax
cmp eax, ecx
sbb edi, edi
and edi, edx
xor ebx, ebx
inc ebx
jmp 0x1091920
mov dword [esi + 0x14], ecx
push 8
push edi
push 0
lea eax, [esi + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
sub eax, 0
je 0x109194a
dec eax
je 0x1091958
sub eax, 0x7f
je 0x109194f
sub eax, 0x82
jne 0x1091962
mov byte [esi + 0x30], 1
jmp 0x109194f
cmp ebx, 1
jne 0x1091958
mov ecx, esi
call fcn.0109175d
jmp 0x109195f
mov ecx, esi
call fcn.01091851
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x10918ca
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10919d2
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x10919ec
xor eax, eax
jmp 0x1091b4c
push edi
push 0x10157a0
push ebx
push ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi], eax
je 0x1091ad3
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x1091ad3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 2
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [esi]
mov dword [ebp - 0x18], eax
push eax
call edi
test eax, eax
je 0x1091ac6
push 2
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x1091ac6
push 0xc
call fcn.0105f04e
cmp eax, ebx
pop ecx
je 0x1091a7d
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], esi
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [ebp - 0xc], eax
jmp 0x1091a80
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jne 0x1091a8e
mov dword [ebp - 0x10], 0x8007000e
jmp 0x1091ac6
lea eax, [esi + 8]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
push 0x1091978
push ebx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x1091ac6
push 0x7d0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1091ac6
mov byte [esi + 0xc], 1
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x1091ad9
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0xc], bl
jne 0x1091b48
cmp dword [ebp - 0x10], ebx
jl 0x1091b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1091af5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1091b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x1091b13
push eax
call edi
mov dword [esi], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1091b20
push eax
call edi
mov dword [esi + 4], ebx
cmp dword [ebp - 4], ebx
je 0x1091b2d
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x1091b3a
push dword [ebp - 8]
call edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x1091b48
push 1
call fcn.010915ca
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10953ba
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0105f070
mov eax, dword [0x111121c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0xe
pop ecx
mov dword [ebp - 0x1008], eax
xor eax, eax
lea edi, [ebp - 0x1040]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1044]
push eax
mov edi, 0x10000000
push edi
xor ebx, ebx
push ebx
push edx
mov dword [ebp - 0x1044], 0x3c
mov word [ebp - 0x804], bx
mov dword [ebp - 0x1030], 0x3ff
call esi
test eax, eax
je 0x10954d8
and word [ebp - 0x1004], bx
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1044]
push eax
push edi
push ebx
push dword [ebp - 0x1008]
mov dword [ebp - 0x1030], 0x3ff
call esi
test eax, eax
je 0x10954d8
xor esi, esi
cmp word [ebp - 0x804], si
lea eax, [ebp - 0x1004]
lea ecx, [ebp - 0x804]
je 0x1095494
mov edx, dword [ebp - 0x804]
cmp dx, 0x2e
je 0x1095494
inc ecx
inc ecx
mov dx, word [ecx]
cmp dx, si
jne 0x1095484
cmp word [ecx], si
jne 0x109549f
lea ecx, [ebp - 0x804]
cmp word [ebp - 0x1004], si
je 0x10954be
mov edx, dword [ebp - 0x1004]
cmp dx, 0x2e
je 0x10954be
inc eax
inc eax
mov dx, word [eax]
cmp dx, si
jne 0x10954ae
cmp word [eax], si
jne 0x10954c9
lea eax, [ebp - 0x1004]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0105eca9
leave
ret 8
Function at 0x1097602
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x34], 0
pop esi
ret

Function at 0x109842f
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
push edi
or edi, 0xffffffff
test eax, eax
mov dword [ebp - 4], 1
mov ebx, edi
jl 0x1098459
mov ecx, dword [esi + 0x4c]
cdq
idiv ecx
mov ebx, eax
mov edi, edx
mov eax, dword [ebp + 8]
sub eax, 0xd
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
je 0x10984b4
sub eax, 0xe
je 0x10984ab
sub eax, 5
je 0x10984b4
sub eax, 5
je 0x10984a2
dec eax
je 0x1098499
dec eax
je 0x109848f
dec eax
je 0x1098485
and dword [ebp - 4], 0
jmp 0x1098501
inc ebx
cmp ebx, dword [esi + 0x50]
jne 0x10984cd
xor ebx, ebx
jmp 0x10984cd
inc edi
cmp edi, dword [esi + 0x4c]
jne 0x10984d2
xor edi, edi
jmp 0x10984d2
dec ebx
jns 0x10984cd
mov ebx, dword [esi + 0x50]
dec ebx
jmp 0x10984cd
dec edi
jns 0x10984d2
mov edi, dword [esi + 0x4c]
dec edi
jmp 0x10984d2
mov ecx, esi
call fcn.01097602
jmp 0x1098501
mov ecx, esi
call fcn.0109809c
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.01097602
cmp ebx, dword [ebp - 8]
jne 0x10984d7
cmp edi, dword [ebp - 0xc]
je 0x1098501
cmp ebx, 0xffffffff
je 0x10984eb
cmp edi, 0xffffffff
je 0x10984eb
cmp ebx, dword [esi + 0x50]
jge 0x10984eb
cmp edi, dword [esi + 0x4c]
jl 0x10984ef
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x4c]
imul eax, ebx
push 0
add eax, edi
push eax
mov ecx, esi
call fcn.01097861
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x109b02e
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
add ecx, 0xfffffff4
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x6c]
test esi, esi
je 0x109b055
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8
Function at 0x109d097
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x111121c]
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
mov eax, dword [esi + 0xe0c]
neg eax
sbb eax, eax
push edi
and eax, 5
push eax
push dword [esi + 0x1e28]
call ebx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x2b4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
xor edi, edi
push edi
push eax
call dword [ecx + 0x9c]
test eax, eax
jge 0x109d158
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x2b4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
push 1
push eax
call dword [ecx + 0x9c]
test eax, eax
jge 0x109d158
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x2b4c]
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
push 2
push eax
call dword [ecx + 0x9c]
test eax, eax
jge 0x109d158
push edi
push dword [esi + 0x1e2c]
call ebx
mov eax, dword [esi + 0xe0c]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x1e30]
jmp 0x109d2cd
mov eax, dword [0x1113528]
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x14b
push dword [esi + 0x1e2c]
add eax, 0x74
mov dword [ebp - 0x420], eax
call edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x9d6d
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x109d1db
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x9d69
mov ecx, esi
call fcn.0109cf18
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x9d6a
mov ecx, esi
call fcn.0109cf18
lea eax, [ebp - 0x20c]
push eax
push 2
push 0x9d6b
mov ecx, esi
call fcn.0109cf18
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x9d7c
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x109d2af
lea eax, [ebp - 0x414]
push eax
push 0
push 0x143
push dword [esi + 0x1e2c]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x418], eax
je 0x109d2af
push 0xffffffffffffffff
push eax
push 0x151
push dword [esi + 0x1e2c]
call edi
mov eax, dword [esi + 0x1e38]
cmp eax, 0xfffffffe
jne 0x109d295
push 0
push 0
push 0x147
push dword [esi + 0x1e2c]
call edi
mov ecx, dword [ebp - 0x420]
push 0xffffffffffffffff
push 0x1017740
mov dword [ebp - 0x41c], eax
call fcn.01063f5e
cmp dword [ebp - 0x41c], 0xffffffff
je 0x109d277
cmp eax, 0xffffffff
jne 0x109d2af
push 0
push dword [ebp - 0x418]
push 0x14e
push dword [esi + 0x1e2c]
call edi
or dword [esi + 0x1e38], 0xffffffff
jmp 0x109d2af
cmp eax, 0xffffffff
jne 0x109d2af
push 0
push dword [ebp - 0x418]
push 0x14e
push dword [esi + 0x1e2c]
call edi
push 0
push dword [esi + 0x1e30]
call ebx
mov eax, dword [esi + 0xe0c]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x1e2c]
call ebx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret
Function at 0x109e044
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x34], eax
je 0x109e166
push ebx
xor ebx, ebx
push edi
lea edi, [esi + 0x344]
inc ebx
cmp dword [edi], eax
jne 0x109e128
cmp dword [esi + 0x1dc4], eax
jne 0x109e07a
call fcn.0109c3c9
mov eax, dword [esi + 0x358]
push ebx
add eax, 0xac
push 0x9cdb
lea ecx, [esi + 0x30]
mov dword [edi], ebx
mov dword [esi + 0x350], eax
call fcn.0109d5da
mov eax, dword [0x1114294]
push ebx
mov ecx, esi
mov dword [esi + 0x1dd0], eax
call fcn.0109c446
mov ecx, dword [esi + 0x28]
call fcn.010a6edd
mov eax, dword [esi + 0x1dfc]
test eax, eax
je 0x109e0f4
mov ecx, dword [esi + 0x1df4]
push 0x105
push 0x12
push 0x64
add ecx, 3
push ecx
mov ecx, dword [esi + 0x1df0]
sub ecx, 0x64
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [esi + 0x1dfc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0109cdc9
mov eax, dword [esi + 0x34c]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x1dd0]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x1dd4]
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x1dec]
mov edx, dword [esi + 0x1df4]
mov ecx, dword [esi + 0x1de8]
sub edx, eax
push edx
mov edx, dword [esi + 0x1df0]
sub edx, ecx
push edx
push eax
push ecx
push dword [esi + 8]
mov ecx, dword [esi + 0x1b28]
call fcn.0109c2e1
mov ecx, dword [esi + 0x1b28]
push ebx
push 0xc
call fcn.0109c309
pop edi
pop ebx
pop esi
leave
ret

Function at 0x109f2de
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 0x1dc4], 0
je 0x109f2ec
jmp fcn.0109c408
jmp fcn.0109c3c9

Function at 0x109fbaf
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push eax
push eax
push 0x87
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 2
jne 0x109fc10
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ah, ah
js 0x109fc0f
push 0x10
call esi
and eax, 0x8000
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
push dword [ebx + 0x2614]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
test eax, eax
je 0x109fc08
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 4], 1
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
Function at 0x10a0413
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x111121c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
and word [edi], 0
push 0x20019
push 0
push 0x80000001
push 0x1017c80
lea ecx, [ebp - 0x430]
mov dword [ebp - 4], eax
call fcn.01064103
push 0x1017f78
lea ecx, [ebp - 0x430]
call fcn.01064159
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov ebx, 0x104
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
xor eax, eax
cmp word [ebp - 0x20c], ax
jne 0x10a0493
lea ecx, [ebp - 0x20c]
push ecx
push eax
push eax
push 5
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x10a049b
lea eax, [ebp - 0x20c]
jmp 0x10a04b2
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.0103f0fb
test eax, eax
jl 0x10a04b9
lea eax, [ebp - 0x414]
push dword [ebp + 0xc]
push eax
push edi
call esi
lea ecx, [ebp - 0x430]
call fcn.0106413d
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret 8

Function at 0x10a28f0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x111121c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
add esi, 0x104
push edi
lea eax, [esi + esi]
push eax
mov edi, ecx
call fcn.0105f04e
and dword [ebp - 0x214], 0
test eax, eax
pop ecx
mov dword [ebp - 0x210], eax
je 0x10a2a20
test ebx, ebx
je 0x10a2972
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x9c5f
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10a2972
push ebx
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
jmp 0x10a297c
mov eax, dword [ebp - 0x210]
and word [eax], 0
lea eax, [esi + esi]
push eax
call fcn.0105f04e
mov ebx, eax
test ebx, ebx
pop ecx
je 0x10a2a14
push esi
push ebx
push dword [edi + 0x2614]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10a2a03
push dword [ebp - 0x210]
mov eax, dword [edi + 0x2614]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x210]
mov ecx, edi
mov dword [ebp - 0x214], eax
call fcn.010a203d
cmp dword [ebp - 0x214], 0
je 0x10a2a0d
cmp dword [edi + 0x2608], 2
jne 0x10a2a0d
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 0
push dword [edi + 0x2614]
call esi
push 1
push dword [edi + 0x2614]
call esi
jmp 0x10a2a0d
mov dword [ebp - 0x214], 1
push ebx
call fcn.0105eff6
pop ecx
push dword [ebp - 0x210]
call fcn.0105eff6
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret 8
Function at 0x10a9b0f
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x3008], al
push edi
je 0x10a9c19
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x3008], al
neg al
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x2fe8]
call edi
movzx eax, byte [esi + 0x3008]
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
push dword [esi + 0x2fe8]
call ebx
mov al, byte [esi + 0x3008]
neg al
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
push eax
push dword [esi + 0x2618]
call edi
xor eax, eax
cmp byte [esi + 0x3008], al
sete al
push eax
push dword [esi + 0x2618]
call ebx
mov al, byte [esi + 0x3008]
neg al
mov ecx, esi
sbb eax, eax
and eax, 0x5d
add eax, 0x1f
mov dword [esi + 0x2c90], eax
add eax, 5
mov dword [esi + 0x2f98], eax
call fcn.010a6edd
cmp byte [esi + 0x3008], 0
je 0x10a9c12
lea eax, [ebp + 8]
push eax
push dword [esi + 0x2fe8]
xor ebx, ebx
mov dword [ebp + 8], ebx
call fcn.010a26d8
mov edi, dword [ebp + 8]
push edi
lea ecx, [ebp - 4]
call fcn.010a66a3
cmp dword [ebp - 4], ebx
jne 0x10a9bf1
cmp edi, ebx
je 0x10a9c7c
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x10a9c7c
push 1
push ebx
mov ecx, esi
call fcn.010a8085
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10a9c08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
je 0x10a9c12
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov ecx, esi
call fcn.0109fae0
mov ecx, esi
call fcn.010a824c
neg al
mov ecx, esi
sbb eax, eax
inc eax
push eax
push 0xa018
call fcn.010a2458
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [esi + 0x44]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x10a9c75
lea edi, [esi + 0x40]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov eax, dword [edi]
movzx ecx, cx
movzx edx, dx
shl ecx, 0x10
or ecx, edx
push ecx
push 0
mov ecx, edi
call dword [eax]
mov ecx, esi
call fcn.010a7660
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10b24cc
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 8

Function at 0x10b24ea
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov esi, ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
jne 0x10b251e
push 0x1001bc8
push edi
push 0xc
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x24], edi
jmp 0x10b262e
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0xb0
push dword [esi]
call edi
mov eax, dword [esi + 0x24]
lea eax, [eax + eax + 2]
push eax
call fcn.0105f04e
mov ebx, eax
test ebx, ebx
pop ecx
mov dword [ebp - 0xc], ebx
jne 0x10b255d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x10b262d
push ebx
push dword [esi + 0x24]
push 0xd
push dword [esi]
call edi
mov eax, dword [esi + 0x2c]
imul eax, dword [esi + 0x28]
push 0x64
xor edx, edx
pop ecx
div ecx
cmp dword [ebp + 8], eax
jae 0x10b257d
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
mov eax, ebx
xor ebx, ebx
test ecx, ecx
jbe 0x10b25a9
mov dword [ebp + 8], ecx
mov ebx, ecx
push eax
call dword [sym.imp.USER32.dll_CharNextW]
dec dword [ebp + 8]
jne 0x10b258d
jmp 0x10b25a9
inc ebx
cmp cx, 0xa
je 0x10b25d1
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
test cx, cx
jne 0x10b259b
push 0x1001bc8
push 0
push 0xc
push dword [esi]
call edi
mov edi, dword [esi + 0x24]
push dword [ebp - 0xc]
and dword [esi + 0x24], 0
call fcn.0105eff6
mov eax, edi
jmp 0x10b262c
push ebx
push 0
push 0xb1
push dword [esi]
call edi
push 0x1001bc8
push 0
push 0xc2
push dword [esi]
call edi
mov eax, dword [ebp - 8]
sub dword [esi + 0x24], ebx
cmp eax, dword [ebp - 4]
je 0x10b2622
mov edx, eax
sub edx, ebx
lea ecx, [ebx + 1]
cmp ecx, eax
sbb eax, eax
and eax, edx
mov edx, dword [ebp - 4]
sub edx, ebx
cmp ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
sbb ecx, ecx
and ecx, edx
push ecx
push eax
push 0xb1
push dword [esi]
mov dword [ebp - 4], ecx
call edi
push dword [ebp - 0xc]
call fcn.0105eff6
mov eax, ebx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4