Function at 0x10117d50
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101969b7
mov eax, dword fs:[0]
push eax
sub esp, 0x344
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], 0x101a127c
movzx eax, byte [0x101e75a4]
test eax, eax
jne 0x10117fcf
mov byte [0x101e75a4], 1
xor ecx, ecx
cmp dword [0x101e7534], 0
sete cl
movzx edx, cl
test edx, edx
je 0x10117ecd
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100e3f90
add esp, 8
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2a8]
call fcn.100b71d0
mov dword [ebp - 0x2b0], eax
push 0
mov ecx, 0x101e7524
call fcn.100a08a0
call fcn.10149a80
mov edx, dword [eax]
mov dword [ebp - 0x2ac], edx
mov eax, dword [ebp - 0x2ac]
push eax
push 0x101e7524
mov ecx, dword [ebp - 0x2b0]
push ecx
call fcn.100de150
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10081a60
push str..ServerLog
lea ecx, [ebp - 0x4c]
call fcn.1009f160
mov dword [ebp - 4], 2
mov dword [ebp - 4], 3
lea edx, [ebp - 0x4c]
push edx
push 0x101e7524
lea eax, [ebp - 0x68]
push eax
call fcn.100c21f0
add esp, 0xc
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x338]
mov dword [ebp - 0x2b4], ecx
mov byte [ebp - 4], 4
mov edx, dword [0x101a1a18]
push edx
push 0
mov eax, dword [ebp - 0x2b4]
push eax
mov ecx, 0x101e7524
call fcn.10085bd0
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10085cf0
mov byte [ebp - 4], 3
mov dword [ebp - 4], 7
mov dword [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
push 0x101e7524
lea ecx, [ebp - 0xcc]
call fcn.10082270
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xac]
call fcn.100b6b40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x8c]
call fcn.100b6b90
mov byte [ebp - 4], 0xb
mov dword [ebp - 4], 0xc
push 0
push 0x80000000
push 4
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0xcc]
push ecx
call fcn.100e2cc0
add esp, 0x1c
mov dword [0x101d7bdc], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.10063f10
cmp dword [0x101d7bdc], 0xffffffff
jne 0x10117f90
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x101e57b0
push 0x55
call fcn.1008ebf0
add esp, 0x28
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10117d50
add esp, 8
jmp 0x10117fcf
push 2
push 0
push 0
mov eax, dword [0x101d7bdc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x288]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call fcn.1014e8a0
add esp, 4
push eax
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [0x101d7bdc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str._1_04u._2_02u._3_02u__4_02u:_5_02u:_6_02u___7_
lea ecx, [ebp - 0x174]
call fcn.1011ea90
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x280]
push ecx
mov edx, dword [ebp - 0x2c8]
push edx
call fcn.101205e0
add esp, 8
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x27e]
push eax
mov ecx, dword [ebp - 0x2cc]
push ecx
call fcn.101205e0
add esp, 8
mov dword [ebp - 0x2d0], eax
lea edx, [ebp - 0x27a]
push edx
mov eax, dword [ebp - 0x2d0]
push eax
call fcn.101205e0
add esp, 8
mov dword [ebp - 0x2d4], eax
lea ecx, [ebp - 0x278]
push ecx
mov edx, dword [ebp - 0x2d4]
push edx
call fcn.101205e0
add esp, 8
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x276]
push eax
mov ecx, dword [ebp - 0x2d8]
push ecx
call fcn.101205e0
add esp, 8
mov dword [ebp - 0x2dc], eax
lea edx, [ebp - 0x274]
push edx
mov eax, dword [ebp - 0x2dc]
push eax
call fcn.101205e0
add esp, 8
mov dword [ebp - 0x2e0], eax
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2e0]
push edx
call fcn.10120730
add esp, 8
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.1011ec40
add esp, 8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x174]
call fcn.10118290
lea edx, [ebp - 0x270]
push edx
lea ecx, [ebp - 0x1d4]
call fcn.100c0ae0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1d4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100e31a0
add esp, 8
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1d4]
call fcn.10063f10
push 0
mov edx, dword [ebp - 0x284]
push edx
push 0x186
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x101d7bdc], 0xffffffff
je 0x1011824b
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x234]
call fcn.100c0ae0
mov dword [ebp - 0x340], eax
mov edx, dword [ebp - 0x340]
mov dword [ebp - 0x344], edx
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x344]
call fcn.100e14c0
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x34c], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x2a4]
push ecx
call fcn.100c2340
add esp, 0xc
mov byte [ebp - 4], 0x15
push 0
push 1
lea ecx, [ebp - 0x250]
call fcn.10042350
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x234]
call fcn.10063f10
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x328], edx
cmp dword [ebp - 0x290], 0x10
jb 0x10118204
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x350], eax
jmp 0x10118210
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x350], ecx
push 0
lea edx, [ebp - 0x288]
push edx
mov eax, dword [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x350]
push ecx
mov edx, dword [0x101d7bdc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 0x17
push 0
push 1
lea ecx, [ebp - 0x2a4]
call fcn.10042350
mov byte [ebp - 4], 0xf
mov dword [ebp - 4], 0x18
push 0
push 1
lea ecx, [ebp - 0x270]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret