joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d990
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2a8
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov eax, edi
mov ecx, edx
and eax, 0x10000
and ecx, 0x400
cmp eax, 0x10000
jne 0x1002dada
cmp ecx, 0x400
jne 0x1002dada
cmp edi, 0x2010010
jne 0x1002dada
cmp edx, ecx
jne 0x1002dada
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xaa]
mov word [esp + 0xa8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 8]
stosw word es:[edi], ax
lea eax, [esp + 0xa8]
push eax
push 0x104
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0xa8]
push edx
call fcn.100e9a88
mov edi, eax
add esp, 4
test edi, edi
je 0x1002dada
lea eax, [esp + 0xa8]
push 0x101f5ce0
push eax
call fcn.100e9f49
add esp, 8
test eax, eax
je 0x1002da4e
mov word [esp + edi*2 + 0x9e], 0
jmp 0x1002da6c
lea ecx, [esp + 0xa8]
push str._TM
push ecx
call fcn.100e9f49
add esp, 8
test eax, eax
je 0x1002da6c
mov word [eax], 0
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
push 0x50
stosw word es:[edi], ax
push edx
lea eax, [esp + 0xb0]
push 0xffffffffffffffff
push eax
call fcn.10012bb0
add esp, 0x10
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.100602c0
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.10060380
mov eax, dword [0x102acd68]
test eax, eax
je 0x1002dada
lea eax, [esp + 8]
push eax
push str.SetSelfInfo_8___s_
push 0x101f5ca4
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
pop edi
pop esi
add esp, 0x2a8
ret
Function at 0x1002db00
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1002dd50
mov ebx, dword [esp + 0x41c]
test ebx, ebx
je 0x1002dd50
mov eax, dword [esp + 0x420]
test eax, eax
jle 0x1002dd50
mov eax, dword [0x102acd68]
test eax, eax
je 0x1002db5c
mov eax, dword [esi + 0x6d4]
push eax
push str.GetUserNameW_8_1___d_
push 0x101f5ca4
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
mov eax, dword [esi + 0xaec]
push edi
cmp eax, 1
je 0x1002dcdf
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [esi + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push 0x104
push 0xd
push edx
stosw word es:[edi], ax
call ebx
lea eax, [esp + 0xc]
push eax
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1002dbdc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x214]
push ecx
push edx
call fcn.100e9a63
add esp, 8
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1002dc18
lea ecx, [esp + 0xc]
lea edx, [esp + 0x214]
push ecx
push edx
push edi
push str.GetUserNameW_8_2___x____s____s_
push 0x101f5ca4
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
test edi, edi
je 0x1002dc93
lea eax, [esp + 0xc]
push eax
push 0x104
push 0xd
push edi
call ebx
push 2
lea ecx, [esp + 0x10]
push 0x101f5d6c
push ecx
call fcn.100ea049
add esp, 0xc
test eax, eax
je 0x1002dc5b
push 2
lea edx, [esp + 0x10]
push 0x101f5d64
push edx
call fcn.100ea049
add esp, 0xc
test eax, eax
jne 0x1002dc65
mov dword [esi + 0xaec], 1
mov eax, dword [0x102acd68]
test eax, eax
je 0x1002dc93
mov ecx, dword [esi + 0xaec]
lea eax, [esp + 0xc]
push eax
push ecx
push str.GetUserNameW_8_3___d____s_
push 0x101f5ca4
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x18
cmp dword [esi + 0xaec], 1
je 0x1002dcba
lea edx, [esp + 0x214]
push 0x101f5d24
push edx
call fcn.100e9f49
add esp, 8
test eax, eax
je 0x1002dcba
mov word [eax], 0
lea eax, [esp + 0x214]
mov ecx, esi
push eax
call fcn.100602c0
lea ecx, [esp + 0x214]
push ecx
mov ecx, esi
call fcn.10060380
mov ebx, dword [esp + 0x420]
mov edx, dword [esp + 0x424]
xor eax, eax
mov edi, ebx
lea ecx, [edx + edx]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x424]
lea ecx, [esi + 0xd0]
dec eax
push eax
push ecx
push ebx
call fcn.100e9aa5
mov eax, dword [0x102acd68]
add esp, 0xc
test eax, eax
pop edi
je 0x1002dd3f
mov edx, dword [esi + 0xaec]
push ebx
push edx
push str.GetUserNameW_8_4___d____s_
push 0x101f5ca4
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x18
mov eax, dword [esi + 0xaec]
pop esi
pop ebx
add esp, 0x410
ret 8
pop esi
xor eax, eax
pop ebx
add esp, 0x410
ret 8
Function at 0x1003a8b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a894a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x24], esi
call fcn.1005f8a0
xor edi, edi
lea eax, [esi + 0x12b8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], eax
mov byte [esp + 0x18], 1
mov dword [eax], method.CCommandLineInfo.virtual_0
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
lea ebx, [esi + 0x12d8]
mov byte [esp + 0x18], 2
push edi
mov ecx, ebx
mov dword [esp + 0x38], ebx
call fcn.100e90de
mov byte [esp + 0x18], 3
mov dword [ebx], 0x101b83ec
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x12f8]
mov byte [esp + 0x18], 4
mov dword [esp + 0x34], eax
mov byte [esp + 0x18], 5
mov dword [eax], method.CCommandLineInfo.virtual_0
mov dword [eax + 4], edi
mov dword [eax + 8], 0x11
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], 0xa
mov byte [esp + 0x18], 6
mov ecx, esi
mov dword [esi], 0x101bfa9c
call fcn.1003ac00
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x10044de0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push ebp
push esi
test ebx, ebx
mov esi, ecx
je 0x10044f44
mov ebp, dword [esp + 0x21c]
test ebp, ebp
je 0x10044f44
mov eax, dword [esi + 0x24c]
test eax, eax
je 0x10044f44
push ebp
call fcn.100e9a88
add esp, 4
test eax, eax
jbe 0x10044f44
push 0xd
push ebp
call fcn.100ea69e
add esp, 8
test eax, eax
je 0x10044f44
mov eax, dword [esi + 0x244]
mov eax, dword [eax + 8]
test eax, eax
je 0x10044f44
mov ecx, dword [0x102acd68]
test ecx, ecx
je 0x10044e77
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
push str.EIMQQComChatMessage__I64x
push str.eimqq
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x18
push ebx
lea ecx, [esi + 0x240]
call fcn.10064fa0
mov esi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x10044eb8
test esi, esi
je 0x10044e9a
mov eax, dword [esi + 0xc70]
jmp 0x10044e9c
xor eax, eax
push eax
push esi
push ebx
push str.EIMQQComChatMessage___x__x__x
push str.eimqq
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
test esi, esi
je 0x10044f44
mov eax, dword [esi + 0xc70]
test eax, eax
je 0x10044f44
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 0x10], 0
pop edi
je 0x10044f13
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.100602c0
lea edx, [esp + 0xc]
mov ecx, esi
push edx
call fcn.10060380
mov eax, dword [0x102acd68]
test eax, eax
je 0x10044f3c
lea eax, [esp + 0xc]
push ebp
push eax
push ebx
push str.EIMQQComChatMessage_____x__s__s
push str.eimqq
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
push ebp
mov ecx, esi
call fcn.10045e60
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x10047160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a9448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push edi
mov ebp, ecx
mov ecx, dword [esp + 0x34]
push 0xffffffffffffffff
push 0
call fcn.10109df0
mov ecx, dword [esp + 0x38]
push 0xffffffffffffffff
push 0
call fcn.1019573b
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 8]
test eax, eax
mov dword [esp + 0xc], eax
jle 0x10047362
xor edi, edi
test eax, eax
jle 0x10047362
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, ebx
call fcn.10047d40
mov eax, dword [eax]
lea ecx, [esp + 0x34]
push eax
mov dword [esp + 0x30], 0
call fcn.101027a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.10196a35
mov esi, dword [esp + 0x34]
xor ecx, ecx
mov eax, dword [esi - 8]
test eax, eax
jle 0x10047343
mov dx, word [esi]
cmp dx, 0xfffc
je 0x10047205
cmp dx, 0xd
jne 0x10047212
inc ecx
add esi, 2
cmp ecx, eax
jl 0x100471f5
jmp 0x10047343
lea ecx, [esp + 0x1c]
push edi
push ecx
mov ecx, ebx
call fcn.10047d40
mov esi, dword [eax + 4]
mov byte [esp + 0x2c], 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.10196a35
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x34]
push edx
push esi
push eax
mov ecx, ebp
call fcn.10047380
push 0x20
push 0xfffc
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.10104ee0
push 0x101f3348
push 0x101f584c
lea ecx, [esp + 0x3c]
call fcn.10104fe0
push 0x102323b8
push 0x101fbd38
lea ecx, [esp + 0x3c]
call fcn.10104fe0
push 0x102323b8
push 0x101fbd00
lea ecx, [esp + 0x3c]
call fcn.10104fe0
cmp dword [ebp + 0x1494], 1
jne 0x100472fb
test edi, edi
jne 0x100472fb
mov ecx, dword [esp + 0x34]
push 0x101fb910
push ecx
call fcn.100e9f49
add esp, 8
test eax, eax
jne 0x10047343
mov edx, dword [esp + 0x34]
push str.Be_wary_of_prize
push edx
call fcn.100e9f49
add esp, 8
test eax, eax
jne 0x10047343
mov eax, dword [esp + 0x34]
push 0x101fb8e0
push eax
call fcn.100e9f49
add esp, 8
test eax, eax
jne 0x10047343
mov ecx, dword [esp + 0x34]
push 0x101fb8b4
push ecx
call fcn.100e9f49
add esp, 8
test eax, eax
jne 0x10047343
mov ecx, dword [esp + 0x3c]
push esi
mov eax, dword [ecx + 8]
push eax
call fcn.101958ff
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x34]
push edx
mov eax, dword [ecx + 4]
push eax
call fcn.1010a480
mov eax, dword [0x102acd68]
test eax, eax
je 0x10047343
mov eax, dword [esp + 0x34]
push eax
push esi
push str._DealArrString__AddChatLog__Dir:__d___Text:__s_
push str.eimqq
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x18
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10103010
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x100471b5
pop esi
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x10049e60
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x101a9738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
test edi, edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
je 0x1004a07c
push esi
push edi
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1004a055
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1004a055
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1004a055
mov ecx, 0x102a96e8
call fcn.100cc8d0
mov ecx, 0x102a96e8
call fcn.100ccf20
mov esi, eax
test esi, esi
je 0x1004a055
push esi
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1004a055
mov ecx, 0x102320a8
call fcn.10003180
lea eax, [esp + 0x14]
mov ecx, 0x102320a8
push eax
push esi
call fcn.10003360
test eax, eax
jne 0x1004a055
push 0x102323b8
lea ecx, [esp + 0x2c]
call fcn.101027a0
push edi
lea ecx, [esp + 0x2c]
push str.SELECT_T1.hostname__t_t_t_t_t_tFROM_user_as_T1__t_t_t_t_t_tWHERE_T1.ip___s_AND_trim_T1.hostname______t_t_t_t_t_tLIMIT_1
push ecx
mov dword [esp + 0x2c], ebp
call fcn.10106020
mov eax, dword [0x102acd68]
add esp, 0xc
or ebp, 0xffffffff
test eax, eax
je 0x10049f5d
mov edx, dword [esp + 0x28]
push edx
push str.GetNickNameFromDateBase_1___s_
push 0x101fbf40
push ebp
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push 0
push eax
push ebp
push ecx
push edx
mov ecx, 0x102320a8
call fcn.10003380
test eax, eax
jne 0x1004a023
mov eax, dword [esp + 0xc]
mov ecx, 0x102320a8
push eax
call fcn.10003410
cmp eax, 0x64
jne 0x1004a044
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov ecx, 0x102320a8
call fcn.10003460
mov esi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x10049fd9
test esi, esi
mov eax, str.NULL
je 0x10049fc0
mov eax, esi
push eax
push str.GetNickNameFromDateBase_2___s_
push 0x101fbf40
push ebp
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
test esi, esi
je 0x1004a044
push esi
call fcn.100e9a88
add esp, 4
test eax, eax
jbe 0x1004a044
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
xor eax, eax
lea ecx, [edx + edx]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
dec eax
push eax
push esi
push ecx
call fcn.100e9aa5
add esp, 0xc
mov dword [esp + 0x10], 1
jmp 0x1004a044
mov eax, dword [0x102acd68]
test eax, eax
je 0x1004a044
push str.DealDateBase_1
push 0x101fbf40
push ebp
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x10
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], ebp
call fcn.10103010
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x1004a069
push eax
mov ecx, 0x102320a8
call fcn.100034a0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1004a07c
push eax
mov ecx, 0x102320a8
call fcn.10003480
mov ecx, dword [esp + 0x14]
mov eax, ebp
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x1004fbb0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebp
mov ebp, ecx
push esi
push edi
lea eax, [ebp + 0xd0]
push eax
call fcn.100e9a88
add esp, 4
test eax, eax
jne 0x1004fcdc
mov ecx, 0x81
lea edi, [esp + 0xe]
mov word [esp + 0xc], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x420]
cmp eax, 1
jne 0x1004fc31
mov esi, dword [esp + 0x424]
test esi, esi
je 0x1004fcdc
push esi
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1004fcdc
push esi
call fcn.100e9a88
mov ecx, eax
lea edi, [esp + 0x10]
shl ecx, 1
mov edx, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x1004fca2
test eax, eax
jne 0x1004fca2
mov edx, dword [esp + 0x424]
test edx, edx
je 0x1004fcdc
mov ecx, 0x81
lea edi, [esp + 0x216]
mov word [esp + 0x214], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x214]
push ecx
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1004fcdc
lea edx, [esp + 0xc]
push 0x104
push edx
lea eax, [esp + 0x21c]
push 0xffffffffffffffff
push eax
call fcn.10012bb0
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebp
call fcn.100602c0
mov ecx, ebp
call fcn.1004fcf0
mov eax, dword [0x102acd68]
test eax, eax
je 0x1004fcdc
lea edx, [esp + 0xc]
push edx
push str._Fetion___selfinfo__user___s
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
pop edi
pop esi
pop ebp
add esp, 0x410
ret 8
Function at 0x10051cf0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x10051d7d
cmp dword [esp + 0x218], eax
je 0x10051d37
lea edi, [esi + 0x12b4]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.10061080
mov ecx, edi
call fcn.10102d30
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100e9a88
add esp, 4
test eax, eax
jbe 0x10051d7d
lea eax, [esp + 8]
lea ecx, [esi + 0x12b4]
push eax
call fcn.101032f0
pop edi
pop esi
add esp, 0x208
ret 8

Function at 0x10059ae0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x324
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0xc70]
push edi
cmp eax, esi
je 0x10059c0e
mov edx, dword [eax + 8]
mov ecx, 0xa9
xor eax, eax
lea edi, [esp + 0x8c]
push esi
mov dword [esp + 0x8c], esi
push esi
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x28]
push 1
push eax
lea ecx, [esp + 0xa0]
push edx
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], str.MyStaticText
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x3f1
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], esi
call fcn.1001dda0
mov edx, dword [esp + 0xa8]
add esp, 0x20
cmp edx, esi
jbe 0x10059c0e
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x62]
mov word [esp + 0x60], si
rep stosd dword es:[edi], eax
mov ecx, dword [esp + edx*4 + 0x88]
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push 0x14
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x60]
push 0x14
push edx
lea eax, [esp + 0x40]
push 0xffffffffffffffff
push eax
call fcn.10012bb0
add esp, 0x10
mov dword [esp + 0xc], str.Remember_password
mov dword [esp + 0x10], 0x101fea88
mov dword [esp + 0x14], 0x101fea7c
lea edi, [esp + 0xc]
mov ecx, dword [edi]
lea edx, [esp + 0x60]
push ecx
push edx
call fcn.100ea1af
add esp, 8
test eax, eax
je 0x10059c08
inc esi
add edi, 4
cmp esi, 3
jb 0x10059be1
pop edi
pop esi
pop ebx
add esp, 0x324
ret
mov dword [ebx + 0x134c], esi
pop edi
pop esi
pop ebx
add esp, 0x324
ret
Function at 0x1005bfd0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2b8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x10]
cmp edx, ebx
je 0x1005c21b
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xbe]
mov word [esp + 0xbc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xbc]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0xbc]
push ecx
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1005c21b
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x1c]
push 0x50
stosw word es:[edi], ax
push edx
lea eax, [esp + 0xc4]
push 0xffffffffffffffff
push eax
call fcn.10012bb0
lea ecx, [esi + 0xd0]
push ecx
call fcn.100e9a88
lea edx, [esp + 0x30]
mov edi, eax
push edx
call fcn.100e9a88
add esp, 0x18
cmp eax, edi
je 0x1005c21b
push ebp
mov ecx, esi
call fcn.100600b0
lea eax, [esp + 0xc0]
mov dword [esp + 0x14], str.Conversations__
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x101fecbc
mov dword [esp + 0x1c], 0x101fecb0
xor edi, edi
lea ebx, [esp + 0x14]
mov ecx, dword [ebx]
lea edx, [esp + 0xc0]
push ecx
push edx
call fcn.100e9f49
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1005c0d6
inc edi
add ebx, 4
cmp edi, 3
jb 0x1005c0ae
mov ebp, dword [esp + 0x10]
jmp 0x1005c0e7
mov eax, dword [esp + edi*4 + 0x14]
push eax
call fcn.100e9a88
add esp, 4
lea ebp, [ebp + eax*2]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x20]
push 0x50
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push ebp
call fcn.10012bb0
lea edx, [esp + 0x30]
push edx
call fcn.100e9a88
add esp, 0x14
mov ebp, 2
test eax, eax
jbe 0x1005c1b5
lea eax, [esp + 0x20]
push 0x101feca8
push eax
lea ebx, [esp + 0x28]
call fcn.100e9f49
mov edi, eax
add esp, 8
test edi, edi
jne 0x1005c163
lea ecx, [esp + 0x20]
mov dword [esi + 0x20], 0x2020001
push ecx
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.100602c0
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.10060380
jmp 0x1005c1b5
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push edi
push ebx
call fcn.1005c230
push 0x101feca8
call fcn.100e9a88
lea ebx, [edi + eax*2]
push 0x101feca8
push ebx
call fcn.100e9f49
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1005c163
test ebx, ebx
je 0x1005c1b5
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.100e9a88
add esp, 4
lea eax, [esp + eax*2 + 0x24]
mov ecx, esi
push eax
push ebx
call fcn.1005c230
mov ecx, dword [esi + 0xb20]
mov eax, 1
cmp ecx, eax
jle 0x1005c1f3
mov dword [esi + 0x20], 0x2020002
push 0x102323b8
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.100602c0
push 0x102323b8
mov ecx, esi
call fcn.10060380
mov ecx, esi
call fcn.100604a0
mov eax, dword [0x102acd68]
pop ebp
test eax, eax
je 0x1005c21b
lea ecx, [esp + 0x1c]
push ecx
push 0x101fec74
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x2b8
ret
Function at 0x1005c320
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101aa66b
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
push esi
mov esi, ecx
lea eax, [esi + 0xd0]
push eax
call fcn.100e9a88
add esp, 4
test eax, eax
jne 0x1005c502
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1005c502
mov edx, dword [esi + 0x14]
test edx, edx
je 0x1005c502
push ebx
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xb2]
mov word [esp + 0xb0], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
stosw word es:[edi], ax
call ebx
lea edx, [esp + 0xb0]
push edx
call fcn.100e9a88
add esp, 4
test eax, eax
jbe 0x1005c470
lea eax, [esp + 0xb0]
lea ecx, [esp + 0xc]
push eax
call fcn.10196aa9
push 0x102323b8
push 0x101fec70
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c8], 0
call fcn.10193acb
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], 9
je 0x1005c417
cmp dword [esi + 0x20], 0x1020008
jne 0x1005c45c
cmp dword [esi + 0x24], 2
jne 0x1005c45c
lea ecx, [esp + 0x10]
push 0x50
push ecx
push 0xffffffffffffffff
push eax
call fcn.10012bb0
add esp, 0x10
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.100602c0
mov eax, dword [0x102acd68]
test eax, eax
je 0x1005c45c
lea eax, [esp + 0x10]
push eax
push 0x101fec74
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c0], 0xffffffff
call fcn.10196a35
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xb0]
mov edx, dword [esi + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
call ebx
lea eax, [esp + 0xb0]
push eax
call fcn.100e9a88
add esp, 4
test eax, eax
pop edi
pop ebx
jbe 0x1005c502
lea ecx, [esp + 8]
push 0x50
push ecx
lea edx, [esp + 0xb0]
push 0xffffffffffffffff
push edx
call fcn.10012bb0
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.10060380
mov eax, dword [0x102acd68]
test eax, eax
je 0x1005c502
lea ecx, [esp + 8]
push ecx
push str._ICQ___oppoinfo__nick___s
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
mov ecx, dword [esp + 0x2b0]
pop esi
mov dword fs:[0], ecx
add esp, 0x2b8
ret