joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a5d0
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x101acb18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
test edi, edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
je 0x1004a7ec
push esi
push edi
call fcn.100ecb78
add esp, 4
test eax, eax
je 0x1004a7c5
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1004a7c5
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1004a7c5
mov ecx, 0x102c8130
call fcn.100cd690
mov ecx, 0x102c8130
call fcn.100cdbb0
mov esi, eax
test esi, esi
je 0x1004a7c5
push esi
call fcn.100ecb78
add esp, 4
test eax, eax
je 0x1004a7c5
mov ecx, 0x10236e78
call fcn.100031d0
lea eax, [esp + 0x14]
mov ecx, 0x10236e78
push eax
push esi
call fcn.100033b0
test eax, eax
jne 0x1004a7c5
push 0x10237188
lea ecx, [esp + 0x2c]
call fcn.101058a0
push edi
lea ecx, [esp + 0x2c]
push str.SELECT_T1.hostname__t_t_t_t_t_tFROM_user_as_T1__t_t_t_t_t_tWHERE_T1.ip___s_AND_trim_T1.hostname______t_t_t_t_t_tLIMIT_1
push ecx
mov dword [esp + 0x2c], ebp
call fcn.10109120
mov eax, dword [0x102cb7c8]
add esp, 0xc
or ebp, 0xffffffff
test eax, eax
je 0x1004a6cd
mov edx, dword [esp + 0x28]
push edx
push str.GetNickNameFromDateBase_1___s_
push 0x10200048
push ebp
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push 0
push eax
push ebp
push ecx
push edx
mov ecx, 0x10236e78
call fcn.100033d0
test eax, eax
jne 0x1004a793
mov eax, dword [esp + 0xc]
mov ecx, 0x10236e78
push eax
call fcn.10003460
cmp eax, 0x64
jne 0x1004a7b4
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov ecx, 0x10236e78
call fcn.100034b0
mov esi, eax
mov eax, dword [0x102cb7c8]
test eax, eax
je 0x1004a749
test esi, esi
mov eax, str.NULL
je 0x1004a730
mov eax, esi
push eax
push str.GetNickNameFromDateBase_2___s_
push 0x10200048
push ebp
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
test esi, esi
je 0x1004a7b4
push esi
call fcn.100ecb78
add esp, 4
test eax, eax
jbe 0x1004a7b4
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
xor eax, eax
lea ecx, [edx + edx]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
dec eax
push eax
push esi
push ecx
call fcn.100ecb95
add esp, 0xc
mov dword [esp + 0x10], 1
jmp 0x1004a7b4
mov eax, dword [0x102cb7c8]
test eax, eax
je 0x1004a7b4
push str.DealDateBase_1
push 0x10200048
push ebp
push 0x102caf34
call fcn.10131cf0
add esp, 0x10
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], ebp
call fcn.10106110
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x1004a7d9
push eax
mov ecx, 0x10236e78
call fcn.100034f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1004a7ec
push eax
mov ecx, 0x10236e78
call fcn.100034d0
mov ecx, dword [esp + 0x14]
mov eax, ebp
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x10050320
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebp
mov ebp, ecx
push esi
push edi
lea eax, [ebp + 0xd0]
push eax
call fcn.100ecb78
add esp, 4
test eax, eax
jne 0x1005044c
mov ecx, 0x81
lea edi, [esp + 0xe]
mov word [esp + 0xc], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x420]
cmp eax, 1
jne 0x100503a1
mov esi, dword [esp + 0x424]
test esi, esi
je 0x1005044c
push esi
call fcn.100ecb78
add esp, 4
test eax, eax
je 0x1005044c
push esi
call fcn.100ecb78
mov ecx, eax
lea edi, [esp + 0x10]
shl ecx, 1
mov edx, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10050412
test eax, eax
jne 0x10050412
mov edx, dword [esp + 0x424]
test edx, edx
je 0x1005044c
mov ecx, 0x81
lea edi, [esp + 0x216]
mov word [esp + 0x214], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x214]
push ecx
call fcn.100ecb78
add esp, 4
test eax, eax
je 0x1005044c
lea edx, [esp + 0xc]
push 0x104
push edx
lea eax, [esp + 0x21c]
push 0xffffffffffffffff
push eax
call fcn.10012960
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebp
call fcn.10060a30
mov ecx, ebp
call fcn.10050460
mov eax, dword [0x102cb7c8]
test eax, eax
je 0x1005044c
lea edx, [esp + 0xc]
push edx
push str._Fetion___selfinfo__user___s
push str.IMCD
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
pop edi
pop esi
pop ebp
add esp, 0x410
ret 8
Function at 0x10052460
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x100524ed
cmp dword [esp + 0x218], eax
je 0x100524a7
lea edi, [esi + 0x12b4]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.100617f0
mov ecx, edi
call fcn.10105e30
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100ecb78
add esp, 4
test eax, eax
jbe 0x100524ed
lea eax, [esp + 8]
lea ecx, [esi + 0x12b4]
push eax
call fcn.101063f0
pop edi
pop esi
add esp, 0x208
ret 8

Function at 0x1005a250
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x324
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0xc70]
push edi
cmp eax, esi
je 0x1005a37e
mov edx, dword [eax + 8]
mov ecx, 0xa9
xor eax, eax
lea edi, [esp + 0x8c]
push esi
mov dword [esp + 0x8c], esi
push esi
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x28]
push 1
push eax
lea ecx, [esp + 0xa0]
push edx
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], str.MyStaticText
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x3f1
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], esi
call fcn.1001de80
mov edx, dword [esp + 0xa8]
add esp, 0x20
cmp edx, esi
jbe 0x1005a37e
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x62]
mov word [esp + 0x60], si
rep stosd dword es:[edi], eax
mov ecx, dword [esp + edx*4 + 0x88]
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push 0x14
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x60]
push 0x14
push edx
lea eax, [esp + 0x40]
push 0xffffffffffffffff
push eax
call fcn.10012960
add esp, 0x10
mov dword [esp + 0xc], str.Remember_password
mov dword [esp + 0x10], 0x10202bac
mov dword [esp + 0x14], 0x10202ba0
lea edi, [esp + 0xc]
mov ecx, dword [edi]
lea edx, [esp + 0x60]
push ecx
push edx
call fcn.100ed29f
add esp, 8
test eax, eax
je 0x1005a378
inc esi
add edi, 4
cmp esi, 3
jb 0x1005a351
pop edi
pop esi
pop ebx
add esp, 0x324
ret
mov dword [ebx + 0x134c], esi
pop edi
pop esi
pop ebx
add esp, 0x324
ret
Function at 0x1005c740
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2b8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x10]
cmp edx, ebx
je 0x1005c98b
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xbe]
mov word [esp + 0xbc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xbc]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0xbc]
push ecx
call fcn.100ecb78
add esp, 4
test eax, eax
je 0x1005c98b
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x1c]
push 0x50
stosw word es:[edi], ax
push edx
lea eax, [esp + 0xc4]
push 0xffffffffffffffff
push eax
call fcn.10012960
lea ecx, [esi + 0xd0]
push ecx
call fcn.100ecb78
lea edx, [esp + 0x30]
mov edi, eax
push edx
call fcn.100ecb78
add esp, 0x18
cmp eax, edi
je 0x1005c98b
push ebp
mov ecx, esi
call fcn.10060820
lea eax, [esp + 0xc0]
mov dword [esp + 0x14], str.Conversations__
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x10202de0
mov dword [esp + 0x1c], 0x10202dd4
xor edi, edi
lea ebx, [esp + 0x14]
mov ecx, dword [ebx]
lea edx, [esp + 0xc0]
push ecx
push edx
call fcn.100ed039
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1005c846
inc edi
add ebx, 4
cmp edi, 3
jb 0x1005c81e
mov ebp, dword [esp + 0x10]
jmp 0x1005c857
mov eax, dword [esp + edi*4 + 0x14]
push eax
call fcn.100ecb78
add esp, 4
lea ebp, [ebp + eax*2]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x20]
push 0x50
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push ebp
call fcn.10012960
lea edx, [esp + 0x30]
push edx
call fcn.100ecb78
add esp, 0x14
mov ebp, 2
test eax, eax
jbe 0x1005c925
lea eax, [esp + 0x20]
push 0x10202dcc
push eax
lea ebx, [esp + 0x28]
call fcn.100ed039
mov edi, eax
add esp, 8
test edi, edi
jne 0x1005c8d3
lea ecx, [esp + 0x20]
mov dword [esi + 0x20], 0x2020001
push ecx
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.10060a30
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.10060af0
jmp 0x1005c925
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push edi
push ebx
call fcn.1005c9a0
push 0x10202dcc
call fcn.100ecb78
lea ebx, [edi + eax*2]
push 0x10202dcc
push ebx
call fcn.100ed039
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1005c8d3
test ebx, ebx
je 0x1005c925
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.100ecb78
add esp, 4
lea eax, [esp + eax*2 + 0x24]
mov ecx, esi
push eax
push ebx
call fcn.1005c9a0
mov ecx, dword [esi + 0xb20]
mov eax, 1
cmp ecx, eax
jle 0x1005c963
mov dword [esi + 0x20], 0x2020002
push 0x10237188
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.10060a30
push 0x10237188
mov ecx, esi
call fcn.10060af0
mov ecx, esi
call fcn.10060c10
mov eax, dword [0x102cb7c8]
pop ebp
test eax, eax
je 0x1005c98b
lea ecx, [esp + 0x1c]
push ecx
push 0x10202d98
push str.IMCD
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x2b8
ret
Function at 0x1005ca90
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101ada4b
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
push esi
mov esi, ecx
lea eax, [esi + 0xd0]
push eax
call fcn.100ecb78
add esp, 4
test eax, eax
jne 0x1005cc72
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1005cc72
mov edx, dword [esi + 0x14]
test edx, edx
je 0x1005cc72
push ebx
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xb2]
mov word [esp + 0xb0], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
stosw word es:[edi], ax
call ebx
lea edx, [esp + 0xb0]
push edx
call fcn.100ecb78
add esp, 4
test eax, eax
jbe 0x1005cbe0
lea eax, [esp + 0xb0]
lea ecx, [esp + 0xc]
push eax
call fcn.10199dd9
push 0x10237188
push 0x10202d94
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c8], 0
call fcn.10196dfb
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], 9
je 0x1005cb87
cmp dword [esi + 0x20], 0x1020008
jne 0x1005cbcc
cmp dword [esi + 0x24], 2
jne 0x1005cbcc
lea ecx, [esp + 0x10]
push 0x50
push ecx
push 0xffffffffffffffff
push eax
call fcn.10012960
add esp, 0x10
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.10060a30
mov eax, dword [0x102cb7c8]
test eax, eax
je 0x1005cbcc
lea eax, [esp + 0x10]
push eax
push 0x10202d98
push str.IMCD
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c0], 0xffffffff
call fcn.10199d65
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xb0]
mov edx, dword [esi + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
call ebx
lea eax, [esp + 0xb0]
push eax
call fcn.100ecb78
add esp, 4
test eax, eax
pop edi
pop ebx
jbe 0x1005cc72
lea ecx, [esp + 8]
push 0x50
push ecx
lea edx, [esp + 0xb0]
push 0xffffffffffffffff
push edx
call fcn.10012960
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.10060af0
mov eax, dword [0x102cb7c8]
test eax, eax
je 0x1005cc72
lea ecx, [esp + 8]
push ecx
push str._ICQ___oppoinfo__nick___s
push str.IMCD
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
mov ecx, dword [esp + 0x2b0]
pop esi
mov dword fs:[0], ecx
add esp, 0x2b8
ret
Function at 0x1005d000
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xe08
cmp eax, 1
push esi
push edi
mov esi, ecx
jne 0x1005d079
mov ecx, 0x2ff
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xc]
stosw word es:[edi], ax
lea eax, [esp + 0x210]
push eax
push 0x600
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1005d12f
mov edx, dword [esi + 0x1080]
push 0x600
push edx
lea eax, [esp + 0x218]
push 0xffffffffffffffff
push eax
call fcn.10012960
add esp, 0x10
pop edi
pop esi
add esp, 0xe08
ret 8
cmp eax, 2
jne 0x1005d12f
push ebx
mov ebx, dword [esi + 0x129c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
push ebp
mov ebp, dword [esp + 0xe20]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, ebp
sub ecx, ebx
cmp ecx, 1
stosw word es:[edi], ax
jle 0x1005d0b1
dec ebp
cmp ebx, ebp
jge 0x1005d0f1
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
push 0x104
push edx
push ebx
push eax
mov ecx, esi
call fcn.10061400
mov edx, dword [esi + 0x1080]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.100ecb29
add esp, 8
inc ebx
cmp ebx, ebp
jl 0x1005d0b5
mov eax, dword [esi + 0x1080]
push eax
call fcn.100ecb78
add esp, 4
cmp eax, 2
pop ebp
pop ebx
jb 0x1005d12f
mov ecx, dword [esi + 0x1080]
cmp word [ecx + eax*2 - 4], 0xd
jne 0x1005d12f
cmp word [ecx + eax*2 - 2], 0xa
jne 0x1005d12f
xor edx, edx
mov word [ecx + eax*2 - 4], dx
mov ecx, dword [esi + 0x1080]
mov word [ecx + eax*2 - 2], dx
pop edi
pop esi
add esp, 0xe08
ret 8
Function at 0x1005f1f0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x1005f27d
cmp dword [esp + 0x218], eax
je 0x1005f237
lea edi, [esi + 0x1290]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.100617f0
mov ecx, edi
call fcn.10199ced
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100ecb78
add esp, 4
test eax, eax
jbe 0x1005f27d
lea eax, [esp + 8]
lea ecx, [esi + 0x1290]
push eax
call fcn.10199efc
pop edi
pop esi
add esp, 0x208
ret 8
Function at 0x10060220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101ade08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ecx, 0x28
mov dword [esi + 0x20], ebx
xor eax, eax
lea edi, [esi + 0x30]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xd0]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0x170]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0x210]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xb30]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xbd0]
rep stosd dword es:[edi], eax
mov ecx, 0x100
lea edi, [esi + 0x2b0]
rep stosd dword es:[edi], eax
push 0x10237090
mov ecx, esi
call fcn.100609d0
lea eax, [esp + 0xc]
push eax
call fcn.10133f40
push eax
lea ecx, [esi + 0x6b0]
call fcn.10133b00
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 2
push ebx
push ebx
push ebx
call fcn.10134060
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.10133f40
mov ecx, eax
call fcn.10133c30
push eax
lea ecx, [esi + 0x6b4]
call fcn.10133b00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x6b8], eax
mov eax, 3
mov dword [esi + 0x6d4], eax
mov dword [esi + 0x6d8], eax
mov dword [esi + 0x6c0], ebx
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x6dc]
mov dword [esi + 0x6c4], ebx
mov dword [esi + 0x6c8], ebx
mov dword [esi + 0x6cc], ebx
mov dword [esi + 0x6d0], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x8e4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str.msolimc2.dat
push eax
mov dword [esi + 0xaec], ebx
mov dword [esi + 0xaf0], ebx
mov dword [esi + 0xb10], ebx
mov dword [esi + 0xc70], ebx
call fcn.10001b90
add esp, 8
push eax
lea ecx, [esi + 0xc74]
mov dword [esp + 0x20], ebx
call fcn.10199eac
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10199d65
mov ecx, 0x100
xor eax, eax
lea edi, [esi + 0xc7c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc78], ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x100628b0
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x100628f3
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
test eax, eax
je 0x100628f3
push edi
push str.SysPager
push edi
push eax
call esi
test eax, eax
je 0x100628f3
push edi
push str.ToolbarWindow32
push edi
push eax
call esi
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x10066cf0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x710
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x312]
mov word [esp + 0x310], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x51a]
mov word [esp + 0x518], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esi + 0xc]
mov ebp, dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0x310]
push 0x103
push ecx
push edx
mov edi, eax
call ebp
lea eax, [esp + 0x518]
push 0x103
push eax
push edi
call ebp
lea ecx, [esp + 0x310]
push 0x10204524
push ecx
call fcn.100ed29f
add esp, 8
test eax, eax
je 0x10066e7e
lea edx, [esp + 0x518]
push 0x10204524
push edx
call fcn.100ed29f
add esp, 8
test eax, eax
je 0x10066e7e
mov eax, dword [esi + 0xc]
push eax
call sub.IMM32.dll_ImmGetContext
mov edx, eax
cmp edx, ebx
je 0x10066e7e
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x100
stosw word es:[edi], ax
push ecx
push 0x800
push edx
stosb byte es:[edi], al
call sub.IMM32.dll_ImmGetCompositionStringA
mov edx, eax
cmp edx, ebx
je 0x10066e7e
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x112]
mov word [esp + 0x110], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x110]
push 0x100
push eax
lea ecx, [esp + 0x18]
push edx
push ecx
call fcn.10012ab0
mov edx, dword [esi + 0x1080]
push edx
call fcn.100ecb78
mov edi, eax
lea eax, [esp + 0x124]
push eax
call fcn.100ecb78
add eax, edi
add esp, 0x18
cmp eax, 0xc00
jb 0x10066e58
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x3c]
mov eax, dword [esi + 0x1080]
push eax
call fcn.100ecb78
add esp, 4
mov edi, eax
mov edx, dword [esi + 0x1080]
lea ecx, [esp + 0x110]
push ecx
lea eax, [edx + edi*2]
push eax
call fcn.100ecb29
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1084], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x710
ret
Function at 0x10066eb0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10066fa9
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
je 0x10066fa2
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [esp + 0x14], eax
je 0x10066f99
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
lea edi, [ebx + ebx]
push edi
call fcn.1019a42e
mov esi, eax
add esp, 4
test esi, esi
je 0x10066f95
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
dec ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
push ebx
push eax
push esi
call fcn.100ecb95
mov ecx, dword [ebp + 0x1080]
push ecx
call fcn.100ecb78
push esi
mov edi, eax
call fcn.100ecb78
add eax, edi
add esp, 0x14
cmp eax, 0xc00
jb 0x10066f6d
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x3c]
mov eax, dword [ebp + 0x1080]
push eax
call fcn.100ecb78
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0x1080]
push esi
lea edx, [ecx + edi*2]
push edx
call fcn.100ecb29
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov dword [ebp + 0x1084], eax
call fcn.1019a457
add esp, 4
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
add esp, 8
ret

Function at 0x100672a0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10067392
mov ecx, dword [0x102cb7c8]
test ecx, ecx
je 0x100672d5
push eax
push str.GetText___x_
push 0x101f22f0
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0xe
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
je 0x10067392
lea edi, [ebx + ebx + 4]
push edi
call fcn.1019a42e
mov esi, eax
mov eax, dword [0x102cb7c8]
add esp, 4
test eax, eax
je 0x1006732a
push esi
push ebx
push str.GetText___d____p_
push 0x101f22f0
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x18
test esi, esi
je 0x10067392
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
inc ebx
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push ebx
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x102cb7c8]
test eax, eax
je 0x10067374
push esi
push 0x10204560
push 0x101f22f0
push 0xffffffffffffffff
push 0x102caf34
call fcn.10131cf0
add esp, 0x14
push esi
call fcn.100ecb78
add esp, 4
test eax, eax
jbe 0x10067389
push esi
mov ecx, ebp
call fcn.10068170
push esi
call fcn.1019a457
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret