joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100683d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x220
mov eax, dword [0x101cff64]
push ebx
push ebp
push esi
push edi
mov ebp, 1
xor edi, edi
cmp eax, ebp
mov esi, ecx
mov dword [esp + 0x10], edi
je 0x100683f9
cmp eax, 2
jne 0x100685fe
mov ebx, dword [esp + 0x234]
cmp ebx, edi
je 0x100685fe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esi + 0x2b8]
call fcn.100626f0
mov esi, eax
cmp esi, edi
mov dword [esp + 0x14], esi
je 0x100685fe
mov eax, dword [0x10270b28]
cmp eax, edi
jne 0x10068441
mov eax, dword [esi + 8]
cmp eax, edi
mov dword [0x10270b28], eax
je 0x100685fe
cmp dword [0x10274670], edi
je 0x10068469
push eax
push ebx
push str.line_CheckLineWndIsPhoto__hWnd:__08x___hWndMain:__08x_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
mov eax, dword [0x10270b28]
add esp, 0x18
cmp ebx, eax
je 0x100685fe
cmp ebx, dword [0x10270b30]
je 0x100685fe
cmp ebx, dword [0x10270b2c]
je 0x100685fa
mov word [esp + 0x28], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push 0x103
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x10274670]
test eax, eax
je 0x100684d5
lea ecx, [esp + 0x28]
push ecx
push str.line_CheckLineWndIsPhoto_2__Title:__s_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
lea edx, [esp + 0x28]
push 0x101d0a6c
push edx
call fcn.10014590
add esp, 8
test eax, eax
je 0x10068504
pop edi
mov dword [esp + 0xc], ebp
mov eax, ebp
pop esi
mov dword [0x10270b2c], ebx
pop ebp
pop ebx
add esp, 0x220
ret 4
push ebx
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebp, eax
test ebp, ebp
je 0x100685d7
xor eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x24], eax
push ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
sub ebx, ecx
mov edi, 5
cmp ebx, edi
jle 0x100685a2
cmp edi, 0x19a
jge 0x100685a2
push 5
push edi
push ebp
call dword [sym.imp.GDI32.dll_GetPixel]
mov esi, eax
mov eax, dword [0x10274670]
test eax, eax
je 0x10068589
push esi
push str.line_CheckLineWndIsPhoto_3__Color:__08x_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
cmp esi, 0x49362d
jne 0x1006859a
add edi, 0x32
cmp edi, ebx
jl 0x10068552
jmp 0x100685a2
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x234]
push ebp
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x234]
test eax, eax
je 0x100685d3
pop edi
pop esi
mov dword [0x10270b2c], ebx
pop ebp
pop ebx
add esp, 0x220
ret 4
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 8]
cmp ebx, eax
mov dword [0x10270b28], eax
je 0x100685fe
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [0x10270b30], ebx
pop ebp
pop ebx
add esp, 0x220
ret 4
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret 4
Function at 0x100689c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x10274670]
push esi
push edi
mov edi, dword [esp + 0xc]
test eax, eax
mov esi, ecx
je 0x100689eb
push edi
push str.DoLineMessageCopy_0___08x_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
test edi, edi
je 0x10068bfd
push 1
push edi
mov ecx, 0x101fadf8
call fcn.1001b160
push 0x10270b00
push edi
mov dword [0x10270af4], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x10270af4]
push 0
push 0
push 0x10270b18
push eax
call fcn.1006f560
add esp, 0x10
test eax, eax
je 0x10068bfd
mov ecx, dword [0x10270b1c]
mov edx, dword [0x10270b04]
mov eax, dword [0x10270b18]
add ecx, edx
push ecx
mov ecx, dword [0x10270b00]
add eax, ecx
push eax
call fcn.1006fab0
add esp, 8
test eax, eax
jne 0x10068a6d
xor edx, edx
pop edi
mov dword [0x10270b18], edx
pop esi
mov dword [0x10270b1c], edx
ret 8
mov eax, dword [0x10274670]
test eax, eax
je 0x10068a9c
mov eax, dword [0x10270b1c]
mov ecx, dword [0x10270b18]
push eax
push ecx
push str.DoLineMessageCopy_1__Copy:__ld__ld_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
mov edx, dword [0x10270af4]
mov ecx, esi
push edx
call fcn.10067db0
test eax, eax
jne 0x10068abf
push eax
push eax
mov ecx, 0x101fadf8
call fcn.1001b160
pop edi
pop esi
ret 8
mov ecx, esi
call fcn.1000ccd0
test eax, eax
je 0x10068ad8
mov eax, dword [0x10270af8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x10274670]
test eax, eax
je 0x10068b01
mov ecx, dword [0x10270af8]
push ecx
push str.DoLineMessageCopy_2___08x_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov esi, dword [0x10270b1c]
mov edx, dword [0x10270b18]
and esi, 0xffff
and edx, 0xffff
shl esi, 0x10
or esi, edx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 1
push 0x201
push edi
call ebx
push esi
push 0
push 0x202
push edi
call ebx
mov edi, 0x43
call fcn.1001a770
test eax, eax
pop ebx
je 0x10068b4f
mov edi, 0x3a
mov eax, dword [0x10274670]
test eax, eax
je 0x10068b74
push edi
push 0x41
push str.DoLineMessageCopy_3___x____x_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x11
call esi
push 0
push 0
push 0
push 0x41
call esi
push 0
push 2
push 0
push 0x41
call esi
push 0
push 2
push 0
push 0x11
call esi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x11
call esi
push 0
push 0
push 0
push edi
call esi
push 0
push 2
push 0
push edi
call esi
push 0
push 2
push 0
push 0x11
call esi
mov eax, dword [0x10274670]
test eax, eax
je 0x10068bf2
push str.DoLineMessageCopy_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10270afc], eax
pop edi
pop esi
ret 8
Function at 0x10069d60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x10274670]
sub esp, 0xa0
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov esi, ecx
je 0x10069da7
mov eax, dword [esp + 0xb8]
mov ecx, dword [esi + 0xc70]
push eax
push ebx
push ecx
push str.AnalyzeMainMessage____08x____08x____08x_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x1c
cmp dword [esi + 0xc70], ebp
jne 0x10069e69
cmp ebx, ebp
je 0x10069e69
cmp dword [esp + 0xb8], ebp
je 0x10069e69
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [esi + 8], ebx
je 0x10069df4
lea edx, [esp + 0x10]
push 0x4f
push edx
push ebx
mov ebp, 1
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x10274670]
test eax, eax
je 0x10069e17
push ebp
push str.AnalyzeMainMessage_1__IsSingleChat:__d_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov edi, dword [esp + 0xb8]
mov ecx, esi
push edi
call fcn.10069820
mov esi, eax
test esi, esi
je 0x10069e45
test ebp, ebp
je 0x10069e3d
lea eax, [esp + 0x10]
push ebp
push eax
mov ecx, esi
call fcn.1006d6f0
push edi
mov ecx, esi
call fcn.1006f2b0
mov eax, dword [0x10274670]
test eax, eax
je 0x10069e69
push edi
push edi
push str.AnalyzeMainMessage____08x____s_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret 8
Function at 0x1006a4b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10188404
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
push edi
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.1005cce0
xor eax, eax
lea ecx, [esi + 0x15c0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x14], 1
mov dword [ecx], method.CCommandLineInfo.virtual_0
mov dword [ecx + 4], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
lea ecx, [esi + 0x15d4]
mov byte [esp + 0x14], 2
mov dword [esp + 0x30], ecx
mov byte [esp + 0x14], 3
mov dword [ecx], method.CCommandLineInfo.virtual_0
mov dword [ecx + 4], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
lea ecx, [esi + 0x15e8]
mov byte [esp + 0x14], 4
mov dword [esp + 0x30], ecx
mov byte [esp + 0x14], 5
mov dword [ecx], method.CCommandLineInfo.virtual_0
mov dword [ecx + 4], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
lea ecx, [esi + 0x15fc]
mov byte [esp + 0x14], 6
mov dword [esp + 0x30], ecx
mov byte [esp + 0x14], 7
mov dword [ecx], method.CCommandLineInfo.virtual_0
mov dword [ecx + 4], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
mov eax, dword [0x1019bf94]
mov byte [esp + 0x14], 8
mov dword [esi + 0x1614], eax
lea edi, [esi + 0x16c4]
push 0xa
mov ecx, edi
mov byte [esp + 0x18], 9
mov dword [esp + 0x34], edi
call fcn.10171689
mov byte [esp + 0x14], 0xa
mov dword [edi], method.CPtrList.virtual_0
mov byte [esp + 0x14], 0xb
mov dword [edi], method.CPtrList.virtual_0
mov byte [esp + 0x14], 0xc
mov dword [edi], method.CPtrList.virtual_0
mov byte [esp + 0x14], 0xd
mov ecx, esi
mov dword [esi], 0x1019422c
call fcn.1006a8b0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x1006b0a0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
push ebp
test eax, eax
mov ebp, ecx
jne 0x1006b0c2
lea eax, [ebp + 0xd0]
push eax
call fcn.100c9da4
add esp, 4
test eax, eax
jne 0x1006b21c
cmp dword [ebp + 0xb20], 0x64
jge 0x1006b21c
mov eax, dword [0x10274670]
test eax, eax
je 0x1006b0f1
push str._Line__SetOpponentInfo_1
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x10
mov eax, dword [ebp + 0xc70]
push ebx
push esi
push edi
test eax, eax
je 0x1006b1f0
mov ecx, dword [ebp + 8]
push 0
push 0
push 0xe
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea edi, [ebx + ebx + 4]
push edi
call fcn.10173930
mov esi, eax
mov eax, dword [0x10274670]
add esp, 4
test eax, eax
je 0x1006b146
push ebx
push str._Line__SetOpponentInfo_2___d_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
test esi, esi
je 0x1006b1f0
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
lea eax, [ebx + 1]
push eax
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x10274670]
test eax, eax
je 0x1006b196
push esi
push str._Line__SetOpponentInfo_3___s_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
push esi
call fcn.100c9da4
add esp, 4
test eax, eax
jbe 0x1006b1e7
cmp ebx, 0x50
mov dword [esp + 0x14], ebx
jb 0x1006b1b4
mov dword [esp + 0x14], 0x4f
mov edx, dword [esp + 0x14]
lea ebx, [ebp + 0xd0]
push edx
push ebx
push esi
call fcn.100ca39a
add esp, 0xc
test eax, eax
je 0x1006b1e7
mov ecx, 0x28
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
push eax
push esi
push ebx
call fcn.100c9dc1
add esp, 0xc
push esi
call fcn.10173959
add esp, 4
mov eax, dword [0x10274670]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1006b21c
add ebp, 0xd0
push ebp
push str._Line__SetOpponentInfo_5___s_
push str.line
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
pop ebp
ret 4
Function at 0x1006c660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10188638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x18], 0
test ebp, ebp
je 0x1006c7dc
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x1006c7dc
mov eax, dword [0x10274670]
test eax, eax
je 0x1006c6e6
push ebp
push str.AnalyzeLineHistory_0___s_
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
mov eax, dword [0x10274670]
add esp, 0x14
test eax, eax
je 0x1006c6e6
mov ecx, dword [esp + 0x24]
push ecx
push str.AnalyzeLineHistory_1___s_
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
push ebx
push esi
push edi
push 0x101c31a4
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebp
call fcn.100e6c40
push 0
lea ecx, [esp + 0x34]
call fcn.100e3f20
mov esi, eax
push esi
mov dword [esp + 0x1c], esi
call fcn.100c9da4
push 0xa
push esi
mov edi, eax
call fcn.100c9d15
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1006c7b2
push 0x101c31a4
push ebp
call fcn.100ca359
mov ebp, eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x1006c7b2
jmp 0x1006c747
mov ebp, dword [esp + 0x14]
push ebx
push eax
call fcn.100ca359
add esp, 8
mov dword [esp + 0x2c], eax
test eax, eax
je 0x1006c7b2
push ebx
call fcn.100c9da4
mov edx, dword [esp + 0x30]
mov esi, eax
sub edx, ebp
add esp, 4
sar edx, 1
add esi, edx
cmp esi, edi
jbe 0x1006c77a
sub esi, edi
lea ebp, [ebp + esi*2]
mov esi, edi
mov ecx, dword [esp + 0x18]
mov eax, edi
sub eax, esi
push esi
push ebp
lea eax, [ecx + eax*2]
push eax
call fcn.100ca39a
add esp, 0xc
test eax, eax
je 0x1006c7aa
push ebx
call fcn.100c9da4
mov edx, dword [esp + 0x30]
add esp, 4
lea eax, [edx + eax*2]
test eax, eax
jne 0x1006c743
jmp 0x1006c7b2
lea eax, [ebp + esi*2]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.100e3260
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.100e3260
mov ecx, dword [esp + 0x10]
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x1006d240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101886fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
push edi
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.1005cce0
xor edi, edi
lea ecx, [esi + 0x10a0]
mov dword [esp + 0x14], edi
call fcn.100e9f70
lea eax, [esi + 0x10b8]
mov byte [esp + 0x14], 1
mov dword [esp + 0x30], eax
mov byte [esp + 0x14], 2
mov dword [eax], method.CCommandLineInfo.virtual_0
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
mov byte [esp + 0x14], 3
mov ecx, esi
mov dword [esi], 0x101942a0
call fcn.1006d4a0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x1006dba0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10188848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
xor eax, eax
push ebx
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 8], ecx
push edi
xor ebx, ebx
mov dword [esp + 0x24], eax
mov ecx, 4
lea edi, [esp + 0x1c]
lea esi, [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1006dbfa
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, 0x101faf68
call fcn.1006dda0
lea ecx, [esp + 0x40]
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x40], ebx
call fcn.10124d90
add esp, 8
push eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x44], 1
call fcn.101734a6
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 3
call fcn.10173267
mov edx, dword [esp + 0x14]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
mov eax, dword [0x10274670]
test eax, eax
je 0x1006dc7e
push ebp
push str.CLineMsgWnd::SetLastMessage_1___x_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
cmp ebp, 0xffffffff
je 0x1006dd38
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [0x10274670]
test eax, eax
je 0x1006dcb5
push esi
push str.CLineMsgWnd::SetLastMessage_2___d_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
test esi, esi
je 0x1006dd31
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x10b0]
test eax, eax
je 0x1006dcda
push eax
call fcn.10173959
add esp, 4
mov dword [edi + 0x10b0], 0
mov eax, esi
shr eax, 1
lea ecx, [eax + eax + 2]
push ecx
call fcn.10173930
mov edx, dword [esp + 0x14]
mov edi, eax
add esp, 4
test edi, edi
mov dword [edx + 0x10b0], edi
je 0x1006dd31
lea ecx, [esi + 2]
xor eax, eax
mov ebx, ecx
mov dword [esp + 0x1c], 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [edx + 0x10b0]
lea eax, [esp + 0x20]
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10274670]
pop ebp
test eax, eax
je 0x1006dd67
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x10b0]
push eax
push ebx
push str.CLineMsgWnd::SetLastMessage_3___d____s_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.10173267
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0xffffffff
call fcn.10173267
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
Function at 0x10072a30
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x4d0
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0x1090], ebx
jne 0x10072b8d
cmp dword [ebp + 0x20], 0x10040
jne 0x10072b8d
cmp dword [ebp + 0x24], 0x200
jne 0x10072b8d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x1094]
add ecx, 0xbb8
cmp ecx, eax
ja 0x10072b8d
mov edx, dword [ebp + 8]
mov ecx, 0xa9
xor eax, eax
lea edi, [esp + 0x23c]
push ebx
mov dword [esp + 0x23c], ebx
push ebx
push ebx
rep stosd dword es:[edi], eax
push ebx
lea eax, [esp + 0x20]
push 1
push eax
lea ecx, [esp + 0x250]
push edx
push ecx
xor esi, esi
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], str.Static
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 3
mov dword [esp + 0x4c], ebx
call fcn.1001ba20
mov eax, dword [esp + 0x258]
add esp, 0x20
cmp eax, ebx
jbe 0x10072af4
mov esi, dword [esp + eax*4 + 0x238]
cmp dword [0x10274670], ebx
je 0x10072b1b
push esi
push 0x3bd
push str._LSC____d__SetSelfNickName__0x_08x_
push 0x101d2ed0
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
cmp esi, ebx
je 0x10072b8d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x32]
mov word [esp + 0x30], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x30]
push 0x103
push edx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [0x10274670], ebx
je 0x10072b70
lea eax, [esp + 0x30]
push eax
push esi
push 0x3c5
push str._LSC____d__SetSelfNickName__0x_08x___s_
push 0x101d2ed0
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x1c
cmp word [esp + 0x30], bx
je 0x10072b8d
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.1005d7c0
mov dword [ebp + 0x1090], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4d0
ret
Function at 0x10073700
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1060
call fcn.100ca4d0
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
cmp eax, 0x20004
jne 0x10073723
cmp ecx, 0x200
je 0x1007373a
cmp eax, 0x20008
jne 0x10073823
cmp ecx, 0x200
jne 0x10073823
mov ecx, 0x20b
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xc]
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0x418
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 8]
push edx
call fcn.100c9da4
add esp, 4
test eax, eax
jbe 0x10073823
cmp dword [esi + 0x20], 0x20004
jne 0x10073799
cmp dword [esi + 0x24], 0x200
jne 0x10073799
mov dword [esi + 0x6d4], 0
jmp 0x100737a3
mov dword [esi + 0x6d4], 1
mov ecx, 0x20b
xor eax, eax
lea edi, [esp + 0x83a]
mov word [esp + 0x838], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x838]
push 0x418
push eax
lea ecx, [esp + 0x10]
push 0xffffffffffffffff
push ecx
call fcn.10012f10
mov eax, dword [0x10274670]
add esp, 0x10
test eax, eax
je 0x10073812
mov eax, dword [esi + 0x6d4]
test eax, eax
mov eax, str.Send
je 0x100737f8
mov eax, str.Recv
push eax
push str._LSC___content__s
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
lea edx, [esp + 0x838]
push 1
push edx
mov ecx, esi
call fcn.1005e8d0
pop edi
pop esi
add esp, 0x1060
ret