joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c360
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebp
mov ebp, ecx
push esi
push edi
lea eax, [ebp + 0xd0]
push eax
call fcn.100c9da4
add esp, 4
test eax, eax
jne 0x1004c48c
mov ecx, 0x81
lea edi, [esp + 0xe]
mov word [esp + 0xc], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x420]
cmp eax, 1
jne 0x1004c3e1
mov esi, dword [esp + 0x424]
test esi, esi
je 0x1004c48c
push esi
call fcn.100c9da4
add esp, 4
test eax, eax
je 0x1004c48c
push esi
call fcn.100c9da4
mov ecx, eax
lea edi, [esp + 0x10]
shl ecx, 1
mov edx, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x1004c452
test eax, eax
jne 0x1004c452
mov edx, dword [esp + 0x424]
test edx, edx
je 0x1004c48c
mov ecx, 0x81
lea edi, [esp + 0x216]
mov word [esp + 0x214], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x214]
push ecx
call fcn.100c9da4
add esp, 4
test eax, eax
je 0x1004c48c
lea edx, [esp + 0xc]
push 0x104
push edx
lea eax, [esp + 0x21c]
push 0xffffffffffffffff
push eax
call fcn.10012f10
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebp
call fcn.1005d700
mov ecx, ebp
call fcn.1004c4a0
mov eax, dword [0x10274670]
test eax, eax
je 0x1004c48c
lea edx, [esp + 0xc]
push edx
push str._Fetion___selfinfo__user___s
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
pop edi
pop esi
pop ebp
add esp, 0x410
ret 8
Function at 0x1004e4a0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x1004e52d
cmp dword [esp + 0x218], eax
je 0x1004e4e7
lea edi, [esi + 0x12b4]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.1005e8d0
mov ecx, edi
call fcn.100e2f80
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100c9da4
add esp, 4
test eax, eax
jbe 0x1004e52d
lea eax, [esp + 8]
lea ecx, [esi + 0x12b4]
push eax
call fcn.100e3540
pop edi
pop esi
add esp, 0x208
ret 8

Function at 0x100566b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x324
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0xc70]
push edi
cmp eax, esi
je 0x100567de
mov edx, dword [eax + 8]
mov ecx, 0xa9
xor eax, eax
lea edi, [esp + 0x8c]
push esi
mov dword [esp + 0x8c], esi
push esi
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x28]
push 1
push eax
lea ecx, [esp + 0xa0]
push edx
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], str.MyStaticText
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x3f1
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], esi
call fcn.1001ba20
mov edx, dword [esp + 0xa8]
add esp, 0x20
cmp edx, esi
jbe 0x100567de
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x3a]
mov word [esp + 0x38], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x62]
mov word [esp + 0x60], si
rep stosd dword es:[edi], eax
mov ecx, dword [esp + edx*4 + 0x88]
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push eax
push 0x14
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x60]
push 0x14
push edx
lea eax, [esp + 0x40]
push 0xffffffffffffffff
push eax
call fcn.10012f10
add esp, 0x10
mov dword [esp + 0xc], str.Remember_password
mov dword [esp + 0x10], 0x101cdcd4
mov dword [esp + 0x14], 0x101cdcc8
lea edi, [esp + 0xc]
mov ecx, dword [edi]
lea edx, [esp + 0x60]
push ecx
push edx
call fcn.100ca324
add esp, 8
test eax, eax
je 0x100567d8
inc esi
add edi, 4
cmp esi, 3
jb 0x100567b1
pop edi
pop esi
pop ebx
add esp, 0x324
ret
mov dword [ebx + 0x134c], esi
pop edi
pop esi
pop ebx
add esp, 0x324
ret
Function at 0x10058f60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2b8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x10]
cmp edx, ebx
je 0x100591ab
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xbe]
mov word [esp + 0xbc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xbc]
push eax
push 0x104
push 0xd
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0xbc]
push ecx
call fcn.100c9da4
add esp, 4
test eax, eax
je 0x100591ab
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x1c]
push 0x50
stosw word es:[edi], ax
push edx
lea eax, [esp + 0xc4]
push 0xffffffffffffffff
push eax
call fcn.10012f10
lea ecx, [esi + 0xd0]
push ecx
call fcn.100c9da4
lea edx, [esp + 0x30]
mov edi, eax
push edx
call fcn.100c9da4
add esp, 0x18
cmp eax, edi
je 0x100591ab
push ebp
mov ecx, esi
call fcn.1005d4f0
lea eax, [esp + 0xc0]
mov dword [esp + 0x14], str.Conversations__
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x101cdf38
mov dword [esp + 0x1c], 0x101cdf2c
xor edi, edi
lea ebx, [esp + 0x14]
mov ecx, dword [ebx]
lea edx, [esp + 0xc0]
push ecx
push edx
call fcn.100ca359
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10059066
inc edi
add ebx, 4
cmp edi, 3
jb 0x1005903e
mov ebp, dword [esp + 0x10]
jmp 0x10059077
mov eax, dword [esp + edi*4 + 0x14]
push eax
call fcn.100c9da4
add esp, 4
lea ebp, [ebp + eax*2]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x20]
push 0x50
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push ebp
call fcn.10012f10
lea edx, [esp + 0x30]
push edx
call fcn.100c9da4
add esp, 0x14
mov ebp, 2
test eax, eax
jbe 0x10059145
lea eax, [esp + 0x20]
push 0x101cdf24
push eax
lea ebx, [esp + 0x28]
call fcn.100ca359
mov edi, eax
add esp, 8
test edi, edi
jne 0x100590f3
lea ecx, [esp + 0x20]
mov dword [esi + 0x20], 0x2020001
push ecx
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.1005d700
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.1005d7c0
jmp 0x10059145
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push edi
push ebx
call fcn.100591c0
push 0x101cdf24
call fcn.100c9da4
lea ebx, [edi + eax*2]
push 0x101cdf24
push ebx
call fcn.100ca359
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100590f3
test ebx, ebx
je 0x10059145
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.100c9da4
add esp, 4
lea eax, [esp + eax*2 + 0x24]
mov ecx, esi
push eax
push ebx
call fcn.100591c0
mov ecx, dword [esi + 0xb20]
mov eax, 1
cmp ecx, eax
jle 0x10059183
mov dword [esi + 0x20], 0x2020002
push 0x101fa2d8
mov ecx, esi
mov dword [esi + 0x24], ebp
mov dword [esi + 0xaec], eax
call fcn.1005d700
push 0x101fa2d8
mov ecx, esi
call fcn.1005d7c0
mov ecx, esi
call fcn.1005d8e0
mov eax, dword [0x10274670]
pop ebp
test eax, eax
je 0x100591ab
lea ecx, [esp + 0x1c]
push ecx
push 0x101cdef0
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x2b8
ret
Function at 0x100592b0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1018750b
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
push esi
mov esi, ecx
lea eax, [esi + 0xd0]
push eax
call fcn.100c9da4
add esp, 4
test eax, eax
jne 0x10059492
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10059492
mov edx, dword [esi + 0x14]
test edx, edx
je 0x10059492
push ebx
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xb2]
mov word [esp + 0xb0], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
stosw word es:[edi], ax
call ebx
lea edx, [esp + 0xb0]
push edx
call fcn.100c9da4
add esp, 4
test eax, eax
jbe 0x10059400
lea eax, [esp + 0xb0]
lea ecx, [esp + 0xc]
push eax
call fcn.101732db
push 0x101fa2d8
push 0x101cdeec
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c8], 0
call fcn.101702fd
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], 9
je 0x100593a7
cmp dword [esi + 0x20], 0x1020008
jne 0x100593ec
cmp dword [esi + 0x24], 2
jne 0x100593ec
lea ecx, [esp + 0x10]
push 0x50
push ecx
push 0xffffffffffffffff
push eax
call fcn.10012f10
add esp, 0x10
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.1005d700
mov eax, dword [0x10274670]
test eax, eax
je 0x100593ec
lea eax, [esp + 0x10]
push eax
push 0x101cdef0
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c0], 0xffffffff
call fcn.10173267
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xb0]
mov edx, dword [esi + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push ecx
push 0x104
push 0xd
push edx
call ebx
lea eax, [esp + 0xb0]
push eax
call fcn.100c9da4
add esp, 4
test eax, eax
pop edi
pop ebx
jbe 0x10059492
lea ecx, [esp + 8]
push 0x50
push ecx
lea edx, [esp + 0xb0]
push 0xffffffffffffffff
push edx
call fcn.10012f10
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.1005d7c0
mov eax, dword [0x10274670]
test eax, eax
je 0x10059492
lea ecx, [esp + 8]
push ecx
push str._ICQ___oppoinfo__nick___s
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov ecx, dword [esp + 0x2b0]
pop esi
mov dword fs:[0], ecx
add esp, 0x2b8
ret
Function at 0x10059820
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xe08
cmp eax, 1
push esi
push edi
mov esi, ecx
jne 0x10059899
mov ecx, 0x2ff
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xc]
stosw word es:[edi], ax
lea eax, [esp + 0x210]
push eax
push 0x600
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1005994f
mov edx, dword [esi + 0x1080]
push 0x600
push edx
lea eax, [esp + 0x218]
push 0xffffffffffffffff
push eax
call fcn.10012f10
add esp, 0x10
pop edi
pop esi
add esp, 0xe08
ret 8
cmp eax, 2
jne 0x1005994f
push ebx
mov ebx, dword [esi + 0x129c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
push ebp
mov ebp, dword [esp + 0xe20]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, ebp
sub ecx, ebx
cmp ecx, 1
stosw word es:[edi], ax
jle 0x100598d1
dec ebp
cmp ebx, ebp
jge 0x10059911
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
push 0x104
push edx
push ebx
push eax
mov ecx, esi
call fcn.1005e4e0
mov edx, dword [esi + 0x1080]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.100c9d55
add esp, 8
inc ebx
cmp ebx, ebp
jl 0x100598d5
mov eax, dword [esi + 0x1080]
push eax
call fcn.100c9da4
add esp, 4
cmp eax, 2
pop ebp
pop ebx
jb 0x1005994f
mov ecx, dword [esi + 0x1080]
cmp word [ecx + eax*2 - 4], 0xd
jne 0x1005994f
cmp word [ecx + eax*2 - 2], 0xa
jne 0x1005994f
xor edx, edx
mov word [ecx + eax*2 - 4], dx
mov ecx, dword [esi + 0x1080]
mov word [ecx + eax*2 - 2], dx
pop edi
pop esi
add esp, 0xe08
ret 8
Function at 0x1005ba70
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
xor eax, eax
push esi
cmp edx, eax
push edi
mov esi, ecx
je 0x1005bafd
cmp dword [esp + 0x218], eax
je 0x1005bab7
lea edi, [esi + 0x1290]
mov dword [esi + 0x6d4], eax
push 1
mov ecx, esi
mov eax, dword [edi]
push eax
call fcn.1005e8d0
mov ecx, edi
call fcn.101731ef
pop edi
pop esi
add esp, 0x208
ret 8
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
push edx
call fcn.100c9da4
add esp, 4
test eax, eax
jbe 0x1005bafd
lea eax, [esp + 8]
lea ecx, [esi + 0x1290]
push eax
call fcn.101733fe
pop edi
pop esi
add esp, 0x208
ret 8
Function at 0x1005cef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101878e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ecx, 0x28
mov dword [esi + 0x20], ebx
xor eax, eax
lea edi, [esi + 0x30]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xd0]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0x170]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0x210]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xb30]
rep stosd dword es:[edi], eax
mov ecx, 0x28
lea edi, [esi + 0xbd0]
rep stosd dword es:[edi], eax
mov ecx, 0x100
lea edi, [esi + 0x2b0]
rep stosd dword es:[edi], eax
push 0x101fa1a8
mov ecx, esi
call fcn.1005d6a0
lea eax, [esp + 0xc]
push eax
call fcn.101224e0
push eax
lea ecx, [esi + 0x6b0]
call fcn.101220a0
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 2
push ebx
push ebx
push ebx
call fcn.10122600
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.101224e0
mov ecx, eax
call fcn.101221d0
push eax
lea ecx, [esi + 0x6b4]
call fcn.101220a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x6b8], eax
mov eax, 3
mov dword [esi + 0x6d4], eax
mov dword [esi + 0x6d8], eax
mov dword [esi + 0x6c0], ebx
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x6dc]
mov dword [esi + 0x6c4], ebx
mov dword [esi + 0x6c8], ebx
mov dword [esi + 0x6cc], ebx
mov dword [esi + 0x6d0], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x8e4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str.msolimc2.dat
push eax
mov dword [esi + 0xaec], ebx
mov dword [esi + 0xaf0], ebx
mov dword [esi + 0xb10], ebx
mov dword [esi + 0xc70], ebx
call fcn.10001b90
add esp, 8
push eax
lea ecx, [esi + 0xc74]
mov dword [esp + 0x20], ebx
call fcn.101733ae
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10173267
mov ecx, 0x100
xor eax, eax
lea edi, [esi + 0xc7c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc78], ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x1005f9c0
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x1005fa03
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
test eax, eax
je 0x1005fa03
push edi
push str.SysPager
push edi
push eax
call esi
test eax, eax
je 0x1005fa03
push edi
push str.ToolbarWindow32
push edi
push eax
call esi
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x10063cf0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x710
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x312]
mov word [esp + 0x310], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x51a]
mov word [esp + 0x518], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esi + 0xc]
mov ebp, dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0x310]
push 0x104
push ecx
push edx
mov edi, eax
call ebp
lea eax, [esp + 0x518]
push 0x104
push eax
push edi
call ebp
lea ecx, [esp + 0x310]
push 0x101cf594
push ecx
call fcn.100ca324
add esp, 8
test eax, eax
je 0x10063e7e
lea edx, [esp + 0x518]
push 0x101cf594
push edx
call fcn.100ca324
add esp, 8
test eax, eax
je 0x10063e7e
mov eax, dword [esi + 0xc]
push eax
call sub.IMM32.dll_ImmGetContext
mov edx, eax
cmp edx, ebx
je 0x10063e7e
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x100
stosw word es:[edi], ax
push ecx
push 0x800
push edx
stosb byte es:[edi], al
call sub.IMM32.dll_ImmGetCompositionStringA
mov edx, eax
cmp edx, ebx
je 0x10063e7e
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x112]
mov word [esp + 0x110], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x110]
push 0x100
push eax
lea ecx, [esp + 0x18]
push edx
push ecx
call fcn.10013060
mov edx, dword [esi + 0x1080]
push edx
call fcn.100c9da4
mov edi, eax
lea eax, [esp + 0x124]
push eax
call fcn.100c9da4
add eax, edi
add esp, 0x18
cmp eax, 0xc00
jb 0x10063e58
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x3c]
mov eax, dword [esi + 0x1080]
push eax
call fcn.100c9da4
add esp, 4
mov edi, eax
mov edx, dword [esi + 0x1080]
lea ecx, [esp + 0x110]
push ecx
lea eax, [edx + edi*2]
push eax
call fcn.100c9d55
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1084], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x710
ret
Function at 0x10063eb0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10063fa9
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
je 0x10063fa2
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [esp + 0x14], eax
je 0x10063f99
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
lea edi, [ebx + ebx]
push edi
call fcn.10173930
mov esi, eax
add esp, 4
test esi, esi
je 0x10063f95
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
dec ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
push ebx
push eax
push esi
call fcn.100c9dc1
mov ecx, dword [ebp + 0x1080]
push ecx
call fcn.100c9da4
push esi
mov edi, eax
call fcn.100c9da4
add eax, edi
add esp, 0x14
cmp eax, 0xc00
jb 0x10063f6d
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x3c]
mov eax, dword [ebp + 0x1080]
push eax
call fcn.100c9da4
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0x1080]
push esi
lea edx, [ecx + edi*2]
push edx
call fcn.100c9d55
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov dword [ebp + 0x1084], eax
call fcn.10173959
add esp, 4
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
add esp, 8
ret

Function at 0x10064a40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10064b32
mov ecx, dword [0x10274670]
test ecx, ecx
je 0x10064a75
push eax
push str.GetText___x_
push 0x101bed58
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0xe
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
je 0x10064b32
lea edi, [ebx + ebx + 4]
push edi
call fcn.10173930
mov esi, eax
mov eax, dword [0x10274670]
add esp, 4
test eax, eax
je 0x10064aca
push esi
push ebx
push str.GetText___d____p_
push 0x101bed58
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
test esi, esi
je 0x10064b32
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
inc ebx
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push ebx
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x10274670]
test eax, eax
je 0x10064b14
push esi
push str.GetText___s_
push 0x101bed58
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
push esi
call fcn.100c9da4
add esp, 4
test eax, eax
jbe 0x10064b29
push esi
mov ecx, ebp
call fcn.10065890
push esi
call fcn.10173959
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10068080
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x10274670]
test eax, eax
je 0x100680a9
mov eax, dword [0x10270af8]
push eax
push str.LINEDestroyTmpWnd____x_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov eax, dword [0x10270af8]
test eax, eax
je 0x10068181
push esi
push edi
push 0
push 0
mov ecx, 0x101fadf8
call fcn.1001b160
mov ecx, dword [0x10270af8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x10270b0c]
mov eax, dword [0x10270b04]
mov edi, dword [0x101fa268]
sub edx, eax
cmp edi, 0x60000
mov dword [esp + 8], edx
fild dword [esp + 8]
sbb eax, eax
and al, 0xea
add eax, 0x28
mov dword [esp + 8], eax
fild dword [esp + 8]
fmul qword [0x101fb738]
fsubp st(1)
call fcn.100cb440
mov ecx, dword [0x10270b08]
mov edi, dword [0x10270b00]
sub ecx, edi
mov si, ax
mov dword [esp + 8], ecx
and esi, 0xffff
fild dword [esp + 8]
fld qword [0x101fb738]
fmul qword [0x101941e0]
shl esi, 0x10
fsubp st(1)
call fcn.100cb440
mov edx, dword [0x10270af4]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
and eax, 0xffff
or esi, eax
push esi
push 1
push 0x201
push edx
call edi
mov eax, dword [0x10270af4]
push esi
push 0
push 0x202
push eax
call edi
pop edi
mov dword [0x10270afc], 0
pop esi
pop ecx
ret