joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049d30
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x101a89f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
test edi, edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
je 0x10049f4c
push esi
push edi
call fcn.100e9958
add esp, 4
test eax, eax
je 0x10049f25
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10049f25
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10049f25
mov ecx, 0x102a96e8
call fcn.100cc7a0
mov ecx, 0x102a96e8
call fcn.100ccdf0
mov esi, eax
test esi, esi
je 0x10049f25
push esi
call fcn.100e9958
add esp, 4
test eax, eax
je 0x10049f25
mov ecx, 0x102320a8
call fcn.10003150
lea eax, [esp + 0x14]
mov ecx, 0x102320a8
push eax
push esi
call fcn.10003330
test eax, eax
jne 0x10049f25
push 0x102323b8
lea ecx, [esp + 0x2c]
call fcn.10102670
push edi
lea ecx, [esp + 0x2c]
push str.SELECT_T1.hostname__t_t_t_t_t_tFROM_user_as_T1__t_t_t_t_t_tWHERE_T1.ip___s_AND_trim_T1.hostname______t_t_t_t_t_tLIMIT_1
push ecx
mov dword [esp + 0x2c], ebp
call fcn.10105ef0
mov eax, dword [0x102acd68]
add esp, 0xc
or ebp, 0xffffffff
test eax, eax
je 0x10049e2d
mov edx, dword [esp + 0x28]
push edx
push str.GetNickNameFromDateBase_1___s_
push 0x101fbf40
push ebp
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push 0
push eax
push ebp
push ecx
push edx
mov ecx, 0x102320a8
call fcn.10003350
test eax, eax
jne 0x10049ef3
mov eax, dword [esp + 0xc]
mov ecx, 0x102320a8
push eax
call fcn.100033e0
cmp eax, 0x64
jne 0x10049f14
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov ecx, 0x102320a8
call fcn.10003430
mov esi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x10049ea9
test esi, esi
mov eax, str.NULL
je 0x10049e90
mov eax, esi
push eax
push str.GetNickNameFromDateBase_2___s_
push 0x101fbf40
push ebp
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
test esi, esi
je 0x10049f14
push esi
call fcn.100e9958
add esp, 4
test eax, eax
jbe 0x10049f14
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
xor eax, eax
lea ecx, [edx + edx]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
dec eax
push eax
push esi
push ecx
call fcn.100e9975
add esp, 0xc
mov dword [esp + 0x10], 1
jmp 0x10049f14
mov eax, dword [0x102acd68]
test eax, eax
je 0x10049f14
push str.DealDateBase_1
push 0x101fbf40
push ebp
push 0x102ac4d4
call fcn.10140e70
add esp, 0x10
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], ebp
call fcn.10102ee0
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x10049f39
push eax
mov ecx, 0x102320a8
call fcn.10003470
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10049f4c
push eax
mov ecx, 0x102320a8
call fcn.10003450
mov ecx, dword [esp + 0x14]
mov eax, ebp
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x1004fa80
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebp
mov ebp, ecx
push esi
push edi
lea eax, [ebp + 0xd0]
push eax
call fcn.100e9958
add esp, 4
test eax, eax
jne 0x1004fbac
mov ecx, 0x81
lea edi, [esp + 0xe]
mov word [esp + 0xc], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x420]
cmp eax, 1
jne 0x1004fb01
mov esi, dword [esp + 0x424]
test esi, esi
je 0x1004fbac
push esi
call fcn.100e9958
add esp, 4
test eax, eax
je 0x1004fbac
push esi
call fcn.100e9958
mov ecx, eax
lea edi, [esp + 0x10]
shl ecx, 1
mov edx, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x1004fb72
test eax, eax
jne 0x1004fb72
mov edx, dword [esp + 0x424]
test edx, edx
je 0x1004fbac
mov ecx, 0x81
lea edi, [esp + 0x216]
mov word [esp + 0x214], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x214]
push ecx
call fcn.100e9958
add esp, 4
test eax, eax
je 0x1004fbac
lea edx, [esp + 0xc]
push 0x104
push edx
lea eax, [esp + 0x21c]
push 0xffffffffffffffff
push eax
call fcn.10012a80
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebp
call fcn.10060190
mov ecx, ebp
call fcn.1004fbc0
mov eax, dword [0x102acd68]
test eax, eax
je 0x1004fbac
lea edx, [esp + 0xc]
push edx
push str._Fetion___selfinfo__user___s
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
pop edi
pop esi
pop ebp
add esp, 0x410
ret 8
Function at 0x10051bc0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x10051c4d
cmp dword [esp + 0x218], eax
je 0x10051c07
lea edi, [esi + 0x12b4]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.10060f50
mov ecx, edi
call fcn.10102c00
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100e9958
add esp, 4
test eax, eax
jbe 0x10051c4d
lea eax, [esp + 8]
lea ecx, [esi + 0x12b4]
push eax
call fcn.101031c0
pop edi
pop esi
add esp, 0x208
ret 8

Function at 0x100599b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x324
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0xc70]
push edi
cmp eax, esi
je 0x10059ade
mov edx, dword [eax + 8]
mov ecx, 0xa9
xor eax, eax
lea edi, [esp + 0x8c]
push esi
mov dword [esp + 0x8c], esi
push esi
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x28]
push 1
push eax
lea ecx, [esp + 0xa0]
push edx
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], str.MyStaticText
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x3f1
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], esi
call fcn.1001dc70
mov edx, dword [esp + 0xa8]
add esp, 0x20
cmp edx, esi
jbe 0x10059ade
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x62]
mov word [esp + 0x60], si
rep stosd dword es:[edi], eax
mov ecx, dword [esp + edx*4 + 0x88]
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push 0x14
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x60]
push 0x14
push edx
lea eax, [esp + 0x40]
push 0xffffffffffffffff
push eax
call fcn.10012a80
add esp, 0x10
mov dword [esp + 0xc], str.Remember_password
mov dword [esp + 0x10], 0x101fea88
mov dword [esp + 0x14], 0x101fea7c
lea edi, [esp + 0xc]
mov ecx, dword [edi]
lea edx, [esp + 0x60]
push ecx
push edx
call fcn.100ea07f
add esp, 8
test eax, eax
je 0x10059ad8
inc esi
add edi, 4
cmp esi, 3
jb 0x10059ab1
pop edi
pop esi
pop ebx
add esp, 0x324
ret
mov dword [ebx + 0x134c], esi
pop edi
pop esi
pop ebx
add esp, 0x324
ret
Function at 0x1005bea0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2b8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x10]
cmp edx, ebx
je 0x1005c0eb
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xbe]
mov word [esp + 0xbc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xbc]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0xbc]
push ecx
call fcn.100e9958
add esp, 4
test eax, eax
je 0x1005c0eb
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x1c]
push 0x50
stosw word es:[edi], ax
push edx
lea eax, [esp + 0xc4]
push 0xffffffffffffffff
push eax
call fcn.10012a80
lea ecx, [esi + 0xd0]
push ecx
call fcn.100e9958
lea edx, [esp + 0x30]
mov edi, eax
push edx
call fcn.100e9958
add esp, 0x18
cmp eax, edi
je 0x1005c0eb
push ebp
mov ecx, esi
call fcn.1005ff80
lea eax, [esp + 0xc0]
mov dword [esp + 0x14], str.Conversations__
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x101fecbc
mov dword [esp + 0x1c], 0x101fecb0
xor edi, edi
lea ebx, [esp + 0x14]
mov ecx, dword [ebx]
lea edx, [esp + 0xc0]
push ecx
push edx
call fcn.100e9e19
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1005bfa6
inc edi
add ebx, 4
cmp edi, 3
jb 0x1005bf7e
mov ebp, dword [esp + 0x10]
jmp 0x1005bfb7
mov eax, dword [esp + edi*4 + 0x14]
push eax
call fcn.100e9958
add esp, 4
lea ebp, [ebp + eax*2]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x20]
push 0x50
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push ebp
call fcn.10012a80
lea edx, [esp + 0x30]
push edx
call fcn.100e9958
add esp, 0x14
mov ebp, 2
test eax, eax
jbe 0x1005c085
lea eax, [esp + 0x20]
push 0x101feca8
push eax
lea ebx, [esp + 0x28]
call fcn.100e9e19
mov edi, eax
add esp, 8
test edi, edi
jne 0x1005c033
lea ecx, [esp + 0x20]
mov dword [esi + 0x20], 0x2020001
push ecx
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.10060190
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.10060250
jmp 0x1005c085
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push edi
push ebx
call fcn.1005c100
push 0x101feca8
call fcn.100e9958
lea ebx, [edi + eax*2]
push 0x101feca8
push ebx
call fcn.100e9e19
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1005c033
test ebx, ebx
je 0x1005c085
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.100e9958
add esp, 4
lea eax, [esp + eax*2 + 0x24]
mov ecx, esi
push eax
push ebx
call fcn.1005c100
mov ecx, dword [esi + 0xb20]
mov eax, 1
cmp ecx, eax
jle 0x1005c0c3
mov dword [esi + 0x20], 0x2020002
push 0x102323b8
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.10060190
push 0x102323b8
mov ecx, esi
call fcn.10060250
mov ecx, esi
call fcn.10060370
mov eax, dword [0x102acd68]
pop ebp
test eax, eax
je 0x1005c0eb
lea ecx, [esp + 0x1c]
push ecx
push 0x101fec74
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x2b8
ret
Function at 0x1005c1f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101a992b
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
push esi
mov esi, ecx
lea eax, [esi + 0xd0]
push eax
call fcn.100e9958
add esp, 4
test eax, eax
jne 0x1005c3d2
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1005c3d2
mov edx, dword [esi + 0x14]
test edx, edx
je 0x1005c3d2
push ebx
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xb2]
mov word [esp + 0xb0], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
stosw word es:[edi], ax
call ebx
lea edx, [esp + 0xb0]
push edx
call fcn.100e9958
add esp, 4
test eax, eax
jbe 0x1005c340
lea eax, [esp + 0xb0]
lea ecx, [esp + 0xc]
push eax
call fcn.10195d69
push 0x102323b8
push 0x101fec70
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c8], 0
call fcn.10192d8b
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], 9
je 0x1005c2e7
cmp dword [esi + 0x20], 0x1020008
jne 0x1005c32c
cmp dword [esi + 0x24], 2
jne 0x1005c32c
lea ecx, [esp + 0x10]
push 0x50
push ecx
push 0xffffffffffffffff
push eax
call fcn.10012a80
add esp, 0x10
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.10060190
mov eax, dword [0x102acd68]
test eax, eax
je 0x1005c32c
lea eax, [esp + 0x10]
push eax
push 0x101fec74
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c0], 0xffffffff
call fcn.10195cf5
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xb0]
mov edx, dword [esi + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
call ebx
lea eax, [esp + 0xb0]
push eax
call fcn.100e9958
add esp, 4
test eax, eax
pop edi
pop ebx
jbe 0x1005c3d2
lea ecx, [esp + 8]
push 0x50
push ecx
lea edx, [esp + 0xb0]
push 0xffffffffffffffff
push edx
call fcn.10012a80
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.10060250
mov eax, dword [0x102acd68]
test eax, eax
je 0x1005c3d2
lea ecx, [esp + 8]
push ecx
push str._ICQ___oppoinfo__nick___s
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
mov ecx, dword [esp + 0x2b0]
pop esi
mov dword fs:[0], ecx
add esp, 0x2b8
ret
Function at 0x1005c760
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xe08
cmp eax, 1
push esi
push edi
mov esi, ecx
jne 0x1005c7d9
mov ecx, 0x2ff
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xc]
stosw word es:[edi], ax
lea eax, [esp + 0x210]
push eax
push 0x600
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1005c88f
mov edx, dword [esi + 0x1080]
push 0x600
push edx
lea eax, [esp + 0x218]
push 0xffffffffffffffff
push eax
call fcn.10012a80
add esp, 0x10
pop edi
pop esi
add esp, 0xe08
ret 8
cmp eax, 2
jne 0x1005c88f
push ebx
mov ebx, dword [esi + 0x129c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
push ebp
mov ebp, dword [esp + 0xe20]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, ebp
sub ecx, ebx
cmp ecx, 1
stosw word es:[edi], ax
jle 0x1005c811
dec ebp
cmp ebx, ebp
jge 0x1005c851
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
push 0x104
push edx
push ebx
push eax
mov ecx, esi
call fcn.10060b60
mov edx, dword [esi + 0x1080]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.100e9909
add esp, 8
inc ebx
cmp ebx, ebp
jl 0x1005c815
mov eax, dword [esi + 0x1080]
push eax
call fcn.100e9958
add esp, 4
cmp eax, 2
pop ebp
pop ebx
jb 0x1005c88f
mov ecx, dword [esi + 0x1080]
cmp word [ecx + eax*2 - 4], 0xd
jne 0x1005c88f
cmp word [ecx + eax*2 - 2], 0xa
jne 0x1005c88f
xor edx, edx
mov word [ecx + eax*2 - 4], dx
mov ecx, dword [esi + 0x1080]
mov word [ecx + eax*2 - 2], dx
pop edi
pop esi
add esp, 0xe08
ret 8
Function at 0x1005e950
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x1005e9dd
cmp dword [esp + 0x218], eax
je 0x1005e997
lea edi, [esi + 0x1290]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.10060f50
mov ecx, edi
call fcn.10195c7d
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100e9958
add esp, 4
test eax, eax
jbe 0x1005e9dd
lea eax, [esp + 8]
lea ecx, [esi + 0x1290]
push eax
call fcn.10195e8c
pop edi
pop esi
add esp, 0x208
ret 8
Function at 0x1005f980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a9ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ecx, 0x28
mov dword [esi + 0x20], ebx
xor eax, eax
lea edi, [esi + 0x30]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xd0]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0x170]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0x210]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xb30]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xbd0]
rep stosd dword es:[edi], eax
mov ecx, 0x100
lea edi, [esi + 0x2b0]
rep stosd dword es:[edi], eax
push 0x102322c0
mov ecx, esi
call fcn.10060130
lea eax, [esp + 0xc]
push eax
call fcn.101430c0
push eax
lea ecx, [esi + 0x6b0]
call fcn.10142c80
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 2
push ebx
push ebx
push ebx
call fcn.101431e0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.101430c0
mov ecx, eax
call fcn.10142db0
push eax
lea ecx, [esi + 0x6b4]
call fcn.10142c80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x6b8], eax
mov eax, 3
mov dword [esi + 0x6d4], eax
mov dword [esi + 0x6d8], eax
mov dword [esi + 0x6c0], ebx
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x6dc]
mov dword [esi + 0x6c4], ebx
mov dword [esi + 0x6c8], ebx
mov dword [esi + 0x6cc], ebx
mov dword [esi + 0x6d0], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x8e4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str.msolimc2.dat
push eax
mov dword [esi + 0xaec], ebx
mov dword [esi + 0xaf0], ebx
mov dword [esi + 0xb10], ebx
mov dword [esi + 0xc70], ebx
call fcn.10001b90
add esp, 8
push eax
lea ecx, [esi + 0xc74]
mov dword [esp + 0x20], ebx
call fcn.10195e3c
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10195cf5
mov ecx, 0x100
xor eax, eax
lea edi, [esi + 0xc7c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc78], ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x10062010
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x10062053
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
test eax, eax
je 0x10062053
push edi
push str.SysPager
push edi
push eax
call esi
test eax, eax
je 0x10062053
push edi
push str.ToolbarWindow32
push edi
push eax
call esi
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x10066420
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x710
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x312]
mov word [esp + 0x310], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x51a]
mov word [esp + 0x518], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esi + 0xc]
mov ebp, dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0x310]
push 0x103
push ecx
push edx
mov edi, eax
call ebp
lea eax, [esp + 0x518]
push 0x103
push eax
push edi
call ebp
lea ecx, [esp + 0x310]
push 0x1020036c
push ecx
call fcn.100ea07f
add esp, 8
test eax, eax
je 0x100665ae
lea edx, [esp + 0x518]
push 0x1020036c
push edx
call fcn.100ea07f
add esp, 8
test eax, eax
je 0x100665ae
mov eax, dword [esi + 0xc]
push eax
call sub.IMM32.dll_ImmGetContext
mov edx, eax
cmp edx, ebx
je 0x100665ae
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x100
stosw word es:[edi], ax
push ecx
push 0x800
push edx
stosb byte es:[edi], al
call sub.IMM32.dll_ImmGetCompositionStringA
mov edx, eax
cmp edx, ebx
je 0x100665ae
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x112]
mov word [esp + 0x110], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x110]
push 0x100
push eax
lea ecx, [esp + 0x18]
push edx
push ecx
call fcn.10012bd0
mov edx, dword [esi + 0x1080]
push edx
call fcn.100e9958
mov edi, eax
lea eax, [esp + 0x124]
push eax
call fcn.100e9958
add eax, edi
add esp, 0x18
cmp eax, 0xc00
jb 0x10066588
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x3c]
mov eax, dword [esi + 0x1080]
push eax
call fcn.100e9958
add esp, 4
mov edi, eax
mov edx, dword [esi + 0x1080]
lea ecx, [esp + 0x110]
push ecx
lea eax, [edx + edi*2]
push eax
call fcn.100e9909
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1084], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x710
ret
Function at 0x100665e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100666d9
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
je 0x100666d2
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [esp + 0x14], eax
je 0x100666c9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
lea edi, [ebx + ebx]
push edi
call fcn.101963be
mov esi, eax
add esp, 4
test esi, esi
je 0x100666c5
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
dec ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
push ebx
push eax
push esi
call fcn.100e9975
mov ecx, dword [ebp + 0x1080]
push ecx
call fcn.100e9958
push esi
mov edi, eax
call fcn.100e9958
add eax, edi
add esp, 0x14
cmp eax, 0xc00
jb 0x1006669d
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x3c]
mov eax, dword [ebp + 0x1080]
push eax
call fcn.100e9958
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0x1080]
push esi
lea edx, [ecx + edi*2]
push edx
call fcn.100e9909
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov dword [ebp + 0x1084], eax
call fcn.101963e7
add esp, 4
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
add esp, 8
ret

Function at 0x100669d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10066ac2
mov ecx, dword [0x102acd68]
test ecx, ecx
je 0x10066a05
push eax
push str.GetText___x_
push 0x101ee240
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0xe
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
je 0x10066ac2
lea edi, [ebx + ebx + 4]
push edi
call fcn.101963be
mov esi, eax
mov eax, dword [0x102acd68]
add esp, 4
test eax, eax
je 0x10066a5a
push esi
push ebx
push str.GetText___d____p_
push 0x101ee240
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x18
test esi, esi
je 0x10066ac2
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
inc ebx
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push ebx
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x102acd68]
test eax, eax
je 0x10066aa4
push esi
push 0x102003a8
push 0x101ee240
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10140e70
add esp, 0x14
push esi
call fcn.100e9958
add esp, 4
test eax, eax
jbe 0x10066ab9
push esi
mov ecx, ebp
call fcn.10067820
push esi
call fcn.101963e7
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret