joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10073e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172fee
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea ecx, [eax + 0x60]
mov dword [eax], vtable.CShareVariableManager.0
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], dx
lea ebx, [eax + 0x78]
mov dword [ebp - 4], edx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edx
mov word [ebx], dx
lea edi, [eax + 0x90]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], edx
mov word [edi], dx
lea esi, [eax + 0xa8]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edx
mov word [esi], dx
mov dword [eax + 0xd4], 7
mov dword [eax + 0xd0], edx
mov word [eax + 0xc0], dx
mov dword [eax + 0xec], 7
mov dword [eax + 0xe8], edx
mov word [eax + 0xd8], dx
mov byte [ebp - 4], 5
push edx
push 0x10199228
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
call fcn.100048b0
push 0
push 0x10199228
mov ecx, ebx
call fcn.100048b0
push 0
push 0x10199228
mov ecx, edi
call fcn.100048b0
push 0
push 0x10199228
mov ecx, esi
call fcn.100048b0
mov ecx, dword [ebp - 0x10]
call fcn.100781a0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100781a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x244]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x232]
push eax
call fcn.10098090
xor eax, eax
push eax
xorps xmm0, xmm0
mov word [ebp - 0x2c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x18], ax
mov word [ebp - 6], ax
lea eax, [ebp - 0x2c]
push 0x10191a90
push eax
movq qword [ebp - 0x2a], xmm0
movq qword [ebp - 0x22], xmm0
movq qword [ebp - 0x16], xmm0
movq qword [ebp - 0xe], xmm0
call fcn.10091da4
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x242]
push eax
movzx eax, word [ebp - 0x244]
push eax
lea eax, [ebp - 0x18]
push 0x10199c90
push eax
call fcn.10091da4
add esi, 0xd8
add esp, 0x2c
cmp dword [esi + 0x14], 8
jb 0x1007824f
mov eax, dword [esi]
jmp 0x10078251
mov eax, esi
push eax
push 0
push str.LastUseDay
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx edx, word [ebp - 0x244]
movzx ecx, word [ebp - 0x242]
imul edx, edx, 0x64
add edx, ecx
movzx ecx, word [ebp - 0x23e]
imul edx, edx, 0x64
add edx, ecx
cmp eax, edx
je 0x10078336
cmp dword [esi + 0x14], 8
jb 0x10078295
mov eax, dword [esi]
jmp 0x10078297
mov eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
push str.LastUseDay
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
mov edi, edi
movzx eax, word [ecx + str.UseDayTotal]
mov word [ebp + ecx - 0x234], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100782b0
cmp dword [esi + 0x14], 8
jb 0x100782d1
mov eax, dword [esi]
jmp 0x100782d3
mov eax, esi
push eax
push 0
lea eax, [ebp - 0x234]
push eax
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0x18]
push 0x10191a90
push eax
call fcn.10091da4
add esp, 0xc
xor ecx, ecx
lea ecx, [ecx]
movzx eax, word [ecx + str.UseDayTotal]
mov word [ebp + ecx - 0x234], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10078300
cmp dword [esi + 0x14], 8
jb 0x1007831f
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x234]
push eax
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10078660
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
mov edi, ecx
push eax
mov dword [ebp - 0x418], edi
call fcn.10098090
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10098090
mov eax, dword [edi + 0x24]
add esp, 0x18
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, eax
je 0x10078886
push ebx
jmp 0x100786d0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x41c], eax
lea ebx, [eax + 0xc]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100786e1
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x1007883a
push ebx
lea eax, [ebp - 0x414]
push str.Is_s
push eax
call fcn.10091da4
add edi, 0x90
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x1007871d
mov eax, dword [edi]
jmp 0x1007871f
mov eax, edi
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x10191c04
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x10191c04
lea eax, [ebp - 0x20c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10078776
test dx, dx
je 0x10078772
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10078776
add eax, 4
add ecx, 4
test dx, dx
jne 0x10078750
xor eax, eax
jmp 0x1007877b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10078799
lea eax, [ebp - 0x20c]
push eax
call fcn.100946c9
mov ecx, dword [ebp - 0x41c]
add esp, 4
mov ecx, dword [ecx + 4]
mov byte [ecx], al
push ebx
lea eax, [ebp - 0x414]
push str.Use_s
push eax
call fcn.10091da4
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x100787b6
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.nothing
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, str.nothing
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1007880b
test dx, dx
je 0x10078807
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1007880b
add eax, 4
add ecx, 4
test dx, dx
jne 0x100787e5
xor eax, eax
jmp 0x10078810
sbb eax, eax
or eax, 1
test eax, eax
je 0x10078834
mov eax, dword [ebp - 0x41c]
lea ecx, [ebp - 0x20c]
mov edx, dword [eax + 8]
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x10078823
mov edi, dword [ebp - 0x418]
cmp byte [esi + 0xd], 0
jne 0x1007887a
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1007885f
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1007887a
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x10078853
jmp 0x1007887a
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10078878
cmp esi, dword [eax + 8]
jne 0x10078878
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x10078868
mov esi, eax
mov eax, dword [edi + 0x24]
cmp esi, dword [eax]
jne 0x100786d0
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x100788a0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x418], edi
mov eax, dword [edi + 0x24]
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, eax
je 0x100789fe
lea ebx, [edi + 0x90]
lea esp, [esp]
mov edi, dword [esi + 0x14]
mov eax, dword [edi + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [edi + 4]
cmp byte [eax], 0
lea eax, [ebp - 0x20c]
je 0x10078901
push 0x10191dc0
jmp 0x10078906
push 0x10191d98
push 0x10192050
push eax
call fcn.10091da4
add esp, 0xc
add edi, 0xc
push edi
lea eax, [ebp - 0x414]
push str.Is_s
push eax
call fcn.10091da4
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x10078936
mov eax, dword [ebx]
jmp 0x10078938
mov eax, ebx
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
lea eax, [ebp - 0x414]
push str.Use_s
push eax
call fcn.10091da4
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push 0x10192050
push eax
call fcn.10091da4
add esp, 0x18
cmp dword [ebx + 0x14], 8
jb 0x10078988
mov eax, dword [ebx]
jmp 0x1007898a
mov eax, ebx
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp byte [esi + 0xd], 0
jne 0x100789e7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100789cc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100789e7
lea ecx, [ecx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100789c0
jmp 0x100789e7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100789e5
cmp esi, dword [eax + 8]
jne 0x100789e5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100789d5
mov esi, eax
mov edi, dword [ebp - 0x418]
mov eax, dword [edi + 0x24]
cmp esi, dword [eax]
jne 0x100788e0
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [edi + 0xd4], 8
lea esi, [edi + 0xc0]
jb 0x10078a11
mov eax, dword [esi]
jmp 0x10078a13
mov eax, esi
push eax
push 0x10191dc0
push str.ModifyHotKey
push str.SetModify
call ebx
cmp dword [esi + 0x14], 8
jb 0x10078a2f
mov eax, dword [esi]
jmp 0x10078a31
mov eax, esi
push eax
push 0x10191dc0
push str.ModifyHotKey64
push str.SetModify
call ebx
cmp dword [esi + 0x14], 8
jb 0x10078a4d
mov eax, dword [esi]
jmp 0x10078a4f
mov eax, esi
push eax
push 0x10191dc0
push str.TempModifyHotKey
push str.SetModify
call ebx
cmp dword [esi + 0x14], 8
jb 0x10078a69
mov esi, dword [esi]
push esi
push 0x10191dc0
push str.TempModifyHotKey64
push str.SetModify
call ebx
cmp dword [edi + 0xbc], 8
lea ecx, [edi + 0xa8]
jb 0x10078a8c
mov ecx, dword [ecx]
cmp dword [edi + 0xa4], 8
lea eax, [edi + 0x90]
pop edi
pop esi
pop ebx
jb 0x10078aa0
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10078e70
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
mov dword [esi], vtable.CBaseImeWnd.0
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
cmp dword [esi + 0x38], 8
jb 0x10078eac
push dword [esi + 0x24]
call fcn.10091747
add esp, 4
xor eax, eax
mov dword [esi + 0x38], 7
mov dword [esi + 0x34], 0
mov word [esi + 0x24], ax
cmp dword [esi + 0x20], 8
jb 0x10078ed1
push dword [esi + 0xc]
call fcn.10091747
add esp, 4
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], 0
xor eax, eax
mov word [esi + 0xc], ax
pop esi
ret

Function at 0x100794a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017311b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x130], edi
call fcn.10078dc0
push 0x11c
lea eax, [ebp - 0x12c]
push 0
mov dword [ebp - 4], 0
push eax
mov dword [edi], vtable.CImeStatusWnd.0
call fcn.10098090
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x10079556
cmp dword [ebp - 0x128], 6
jb 0x10079556
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007954f
push 1
push 0x4ca
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x11c
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.10098090
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x100795c5
cmp dword [ebp - 0x128], 6
jb 0x100795c5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100795be
push 1
push 0x4c9
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x100795f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017311b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x130], ebx
mov dword [ebx], vtable.CImeStatusWnd.0
push 0x11c
lea eax, [ebp - 0x12c]
push 0
push eax
mov dword [ebp - 4], 0
call fcn.10098090
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x100796a1
cmp dword [ebp - 0x128], 6
jb 0x100796a1
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007969a
push 2
push 0x4ca
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x11c
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.10098090
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x10079710
cmp dword [ebp - 0x128], 6
jb 0x10079710
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10079709
push 2
push 0x4c9
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call fcn.10078e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x1007b2f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101731c6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
xor edi, edi
nop
cmp dword [0x101ed6cc], 0
jne 0x1007b346
push 4
call fcn.10092352
add esp, 4
test eax, eax
je 0x1007b33f
mov dword [eax], vtable.CShareConfigManager.0
jmp 0x1007b341
xor eax, eax
mov dword [0x101ed6cc], eax
cmp dword [0x101ed764], 0
jne 0x1007b381
push 0xf0
call fcn.10092352
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1007b373
mov ecx, eax
call fcn.10073e80
jmp 0x1007b375
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x101ed764], eax
cmp edi, 0xc7
ja 0x1007b463
mov eax, dword [0x101ed764]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + ebx + 0xf08]
test esi, esi
je 0x1007b463
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1007b424
cmp dword [0x101ed6cc], eax
jne 0x1007b3d4
push 4
call fcn.10092352
add esp, 4
test eax, eax
je 0x1007b3cd
mov dword [eax], vtable.CShareConfigManager.0
jmp 0x1007b3cf
xor eax, eax
mov dword [0x101ed6cc], eax
cmp dword [0x101ed764], 0
jne 0x1007b40f
push 0xf0
call fcn.10092352
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x1007b401
mov ecx, eax
call fcn.10073e80
jmp 0x1007b403
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x101ed764], eax
mov eax, dword [0x101ed764]
mov eax, dword [eax + 0x28]
mov dword [eax + ebx + 0xf08], 0
jmp 0x1007b463
mov eax, dword [ebp - 0x10]
cmp esi, dword [eax + 4]
je 0x1007b463
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1007b463
lea eax, [ebp - 0x14]
push eax
push 0x1f4
push 3
push 0
push 0
push 0
push esi
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x1007b463
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
inc edi
add ebx, 0x64
cmp edi, 0xc8
jl 0x1007b320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007d070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10173338
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [edi + 0x38]
sub edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
sub ecx, dword [edi + 0x2c]
lea ebx, [edi + 0x2c]
push edx
push ecx
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push dword [edi + 0x54]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_FillRect]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
mov ecx, edi
call fcn.1007d160
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov edi, dword [ebp - 0x14]
push 0xcc0020
push 0
push 0
push edi
push eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push edi
call esi
push dword [ebp - 0x20]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1007da90
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x1007dae2
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x5c]
cmp esi, dword [edi + 0x60]
je 0x1007dac5
jmp 0x1007dab0
cmp byte [esi + 0x48], 0
je 0x1007dabd
mov ecx, esi
call fcn.1007beb0
add esi, 0x70
cmp esi, dword [edi + 0x60]
jne 0x1007dab0
mov ecx, edi
call fcn.1007d210
push dword [edi]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [edi], 0
mov dword [edi + 4], 0
pop esi
mov eax, 1
pop edi
ret
Function at 0x1007dda0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10173428
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov dword [edi], vtable.CTfTextLayoutSink.0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x10], esi
mov eax, dword [esi]
push esi
call dword [eax + 4]
push 0x101c720c
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 0xffffffff
mov dword [edi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
mov dword [edi], vtable.CCandidateListUIPresenter.1.0
mov dword [edi + 0x20], vtable.CCandidateListUIPresenter.2.0
mov dword [edi + 0x24], vtable.CCandidateListUIPresenter.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0xffffffff
mov dword [edi + 0x28], 1
mov dword [edi + 0x10], esi
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov dword [edi + 0x3c], 1
mov dword [edi + 0x44], 0xffff8ad0
mov dword [edi + 0x48], 0xffff8ad0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x54], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10081400
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101735bd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov edi, dword [0x101ed714]
test edi, edi
je 0x10081460
mov byte [ebp - 4], 1
call fcn.10009ec0
mov byte [ebp - 4], 0
call fcn.10009ec0
push edi
call fcn.10091747
add esp, 4
mov dword [0x101ed714], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret