joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445970
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x605460
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [edi]
xor ebx, ebx
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [edi + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x4459c1
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
call fcn.004467c0
mov eax, dword [edi + 4]
push eax
call esi
test eax, eax
jne 0x4459d8
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push edi
call fcn.004467c0
mov edx, dword [edi + 4]
mov ecx, dword [edi + 0xc]
push edi
call fcn.00446e40
push edi
call fcn.00447740
call fcn.0041a430
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
lea eax, [edi + 8]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], ebx
push ecx
mov ebx, str.SkinlistOrder.dat
call fcn.0040aab0
add esp, 8
lea edx, [esp + 0x1c]
mov byte [esp + 0x30], 1
mov eax, dword [eax]
push edx
push eax
call fcn.0048d940
xor ebx, ebx
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x445a49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x628b70
call fcn.00409dd0
lea edx, [esp + 0x14]
lea ebp, [edi + 0x24]
push edx
mov ecx, ebp
mov byte [esp + 0x34], 2
call fcn.0048b500
mov ecx, dword [eax + 4]
cmp ecx, ebx
je 0x445a89
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
je 0x445a89
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
call fcn.0048b710
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x445aad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x628b7c
call fcn.00409dd0
lea edx, [esp + 0x14]
push edx
mov ecx, ebp
mov byte [esp + 0x34], 3
call fcn.0048b500
mov ecx, dword [eax + 4]
cmp ecx, ebx
je 0x445aea
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
je 0x445aea
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
call fcn.0048b710
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x445b0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [esp + 0x1c]
call fcn.0044a010
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005d2367
mov eax, 1
add esp, 4
mov dword [edi + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x44b6a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x605090
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
lea edi, [esp + 0x14]
call fcn.0047ac70
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
cmp eax, ebx
jle 0x44b70b
lea ecx, [eax - 1]
cmp ecx, ebx
jl 0x44b844
cmp ecx, eax
jg 0x44b844
movzx eax, word [edx + ecx*2]
cmp ax, 0x5c
je 0x44b70b
push 0x5c
call fcn.0040af90
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
cmp eax, ebx
jle 0x44b7b6
lea eax, [edx - 0x10]
call fcn.0040a210
lea ecx, [eax + 0x10]
mov dword [esp + 0x28], ecx
mov byte [esp + 0x20], 1
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jle 0x44b759
lea edx, [eax - 1]
cmp edx, ebx
jl 0x44b844
cmp edx, eax
jg 0x44b844
movzx eax, word [ecx + edx*2]
cmp ax, 0x5c
je 0x44b759
push 0x5c
lea edi, [esp + 0x2c]
call fcn.0040af90
push 4
push str.log_
lea eax, [esp + 0x30]
push eax
call fcn.0040aee0
mov ecx, dword [esp + 0x28]
push ebx
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xc
push str.qqpinyin.log
lea edx, [esp + 0x30]
push edx
call fcn.0040aee0
mov esi, dword [esp + 0x28]
push 4
lea edi, [ebp + 0x74]
call fcn.0044bb70
lea eax, [esi - 0x10]
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44b7b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
mov dword [ebp + 0x7c], ecx
xor esi, esi
xor edi, edi
cmp dword [0x674508], ebx
mov dword [esp + 0x28], ebx
jne 0x44b7d3
mov dword [0x674508], ebx
mov edx, dword [esp + 0x28]
push edx
lea eax, [ebp + 0x20]
push eax
mov ebx, 0x6744d8
call fcn.0044c710
add esp, 8
push esi
push 0
push SysReAllocStringLen
movzx ebx, ax
push 0
push edi
mov eax, ebp
call fcn.0044c640
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b84e
lea esi, [ebp + 0x74]
push esi
call fcn.0044bcd0
push str.sw_st
push esi
call fcn.0044bdf0
lea ecx, [ebp + 0x24]
add esp, 8
mov dword [ecx], ebx
call fcn.0044ba50
test eax, eax
je 0x44b86d
mov ecx, dword [ebp + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x28], 1
jmp 0x44b86d
push 0x80070057
call fcn.00403650
add ebp, 0x74
push ebp
call fcn.0044bcd0
push str.sw_er
push ebp
call fcn.0044bdf0
add esp, 8
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44b895
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x44ba50
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov esi, ecx
call fcn.0044be10
test eax, eax
jne 0x44bb50
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x44baa9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test edi, edi
jne 0x44bb4e
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005d28b3
add esp, 0x1c
ret
xor ecx, ecx
mov dword [esp + 0xe], ecx
mov dword [esp + 0x12], ecx
mov dword [esp + 0x16], ecx
mov word [esp + 0x1a], cx
mov dword [esp + 0x10], ecx
mov word [esp + 0xe], cx
push 0x10
lea ecx, [esp + 0x10]
push ecx
push eax
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x44ba83
mov edx, dword [esi]
mov eax, dword [esi + 4]
push 1
push 0x82cb
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov edi, eax
cmp edi, 0xffffffff
je 0x44ba83
push 0x1f40
mov word [esi + 0x38], 0
mov byte [esi + 0x3b], 1
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0xe], ax
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x44bb1f
test eax, eax
jne 0x44bb3d
push str.srf.qq.com
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x44bb36
test eax, eax
jne 0x44bb3d
mov eax, esi
call fcn.0044be80
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x44bb4e
test eax, eax
je 0x44bb4e
call fcn.0044bf20
mov eax, edi
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0x1c
ret
Function at 0x44bb70
Capabilities:
Check if file exists
Delete file
Get file size
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5fbb58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
push 0
push 0x80
push ebp
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x44bc83
call fcn.0040f010
mov ebx, eax
test ebx, ebx
jl 0x44bcb8
mov ecx, dword [edi]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44bbf1
call fcn.0040f010
test eax, eax
jl 0x44bcb6
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
ja 0x44bc03
cmp eax, 0x40000
jbe 0x44bcb6
mov eax, dword [edi]
test eax, eax
je 0x44bc16
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.00409dd0
push 4
push str..old
lea eax, [esp + 0x34]
xor ebx, ebx
push eax
mov dword [esp + 0x30], ebx
call fcn.0040aee0
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44bc53
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
push 0x80
push ebp
push ebx
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x44bc8c
call fcn.0040f010
mov ebx, eax
jmp 0x44bc8e
mov dword [edi], eax
xor ebx, ebx
jmp 0x44bbc9
mov dword [edi], eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44bcb6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x44be10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x194], eax
cmp byte [esi + 0x3a], 0
jne 0x44be63
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44be5f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x44be65
or eax, 0xffffffff
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.005d28b3
add esp, 0x19c
ret
mov byte [esi + 0x3a], 1
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.005d28b3
add esp, 0x19c
ret
Function at 0x44bf20
Capabilities:
Send data
Send data on socket

Disassembly:
test esi, esi
push edi
je 0x44bf2a
lea edi, [esi - 0x24]
jmp 0x44bf2c
xor edi, edi
mov ecx, edi
call fcn.0044b300
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x24]
push 0x10
lea eax, [esi + 0xc]
push eax
mov eax, dword [esi + 4]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
add word [esi + 0x38], 1
movzx eax, word [esi + 0x38]
cmp ax, 3
jb 0x44bf69
cmp byte [esi + 0x3c], 0
jne 0x44bf69
call fcn.0044b8b0
pop edi
ret
mov ecx, dword [esi]
push 0
push 0x1388
push 0xc2d
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
ret

Function at 0x44c0b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fac20
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
jne 0x44c0fd
mov eax, 0x80004005
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], 0
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
lea edi, [esp + 0x1c]
mov byte [esp + 0x34], 1
call fcn.0040aca0
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x14]
call fcn.0044c240
push 2
push 0x628d84
lea ecx, [esp + 0x1c]
push ecx
call fcn.0044c560
mov eax, dword [esi]
push 2
lea edx, [esp + 0x24]
xor ebx, ebx
push edx
push ebx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44c189
call fcn.0040f010
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 0xc]
mov edx, dword [esi]
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x44c1ae
call fcn.0040f010
mov esi, eax
jmp 0x44c1b0
xor esi, esi
lea eax, [edi - 0x10]
mov byte [esp + 0x30], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c1d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c1f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44c300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x818], eax
cmp dword [ebp + 8], 0
push edi
jne 0x44c35e
lea eax, [esp + 4]
push eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x800
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jl 0x44c35e
cmp eax, 0x10
lea edi, [esi - 0x24]
jb 0x44c35e
lea eax, [esp + 0x18]
call fcn.0044b640
mov ecx, dword [esp + 0x81c]
pop edi
xor ecx, esp
call fcn.005d28b3
mov esp, ebp
pop ebp
ret 4

Function at 0x44c380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fa388
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
cmp dword [esi], 0
jne 0x44c3c9
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
lea edi, [esp + 0x14]
mov dword [esp + 0x2c], 0
call fcn.0044c480
mov edx, dword [esi]
push 2
lea ecx, [esp + 0x1c]
xor ebx, ebx
push ecx
push ebx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44c41c
call fcn.0040f010
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0xc]
mov edx, dword [esi]
push ebx
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x44c43f
call fcn.0040f010
mov ebx, eax
lea eax, [edi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c463
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x455d90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x455f77
mov eax, dword [ebp + 0xc]
cmp eax, 0x111
jne 0x455df7
mov eax, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 0x10
test cx, cx
jne 0x455f77
lea edx, [esp + 0xc]
movzx eax, ax
push edx
push eax
mov ecx, ebx
mov dword [esp + 0x14], 1
call fcn.00456cf0
cmp dword [esp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x455f77
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x110
jne 0x455e2f
lea edx, [esp + 0xc]
push edx
push ebx
mov dword [esp + 0x14], 1
call fcn.004567c0
cmp dword [esp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x455f77
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x112
jne 0x455e66
cmp dword [ebp + 0x10], 0xf060
jne 0x455e52
mov edx, dword [ebx + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ebx
call fcn.004574a0
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 2
jne 0x455e87
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 5
je 0x455f6e
cmp eax, 0x136
jne 0x455eab
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x138
jne 0x455ec6
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x135
je 0x455f6e
cmp eax, 0x14
jne 0x455f05
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
call fcn.00456e10
cmp dword [esp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x455f77
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x455f35
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
call fcn.00456e10
cmp dword [esp + 0xc], 0
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
je 0x455f77
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x7e9
jne 0x455f5a
mov eax, dword [ebp + 0x10]
push eax
mov edi, ebx
call fcn.004574f0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x113
jne 0x455f77
cmp dword [ebp + 0x10], 1
jne 0x455f6e
mov eax, ebx
call fcn.00457ea0
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x456cf0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5f9e18
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
mov esi, ecx
cmp eax, 3
ja 0x456d4c
je 0x456d42
sub eax, 1
je 0x456d38
sub eax, 1
jne 0x456ded
call fcn.004574a0
jmp 0x456ded
call fcn.00457390
jmp 0x456ded
call fcn.00457420
jmp 0x456ded
sub eax, 0x4c7
je 0x456d73
sub eax, 1
jne 0x456ded
push 1
push eax
push eax
push str.http:__support.qq.com_title.html_fid39
push 0x625c98
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x456ded
lea ebx, [esp + 0x20]
call fcn.0047a980
mov eax, ebx
mov dword [esp + 0x18], 0
call fcn.00576f50
push 0xe
push str.QQPYWizard.exe
mov eax, ebx
push eax
call fcn.0040aee0
mov ecx, dword [esp + 0x20]
push 1
push 0
push 0
push ecx
push 0x625c98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [0x6784cc]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x456ded
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov dword [ecx], 0
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x4574a0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x6784c9], 0
je 0x4574bd
mov byte [0x6784c9], 0
push esi
call fcn.00457040
mov eax, dword [0x68300c]
sub eax, 1
test eax, eax
mov dword [0x68300c], eax
jg 0x4574ea
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop ecx
ret

Function at 0x4574f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
mov eax, dword [edi + 0x34c]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
lea esi, [edi + 0x348]
mov dword [esp + 0x14], eax
lea ebx, [esp + 0x24]
lea eax, [esp + 0x18]
mov dword [esp + 0x24], ebp
call fcn.00458d70
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x457527
cmp eax, esi
je 0x45752c
call fcn.005d29f1
mov ecx, dword [esp + 0x14]
cmp dword [ebx + 4], ecx
je 0x457603
lea ebx, [esp + 0x24]
mov eax, esi
mov dword [esp + 0x24], ebp
call fcn.00458cf0
mov ecx, dword [edi + 0x354]
cmp ecx, dword [eax]
je 0x457622
test ecx, ecx
je 0x457565
mov edx, dword [ecx]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [esp + 0x24]
mov eax, esi
mov dword [esp + 0x24], ebp
call fcn.00458cf0
cmp ebp, 0x15
mov eax, dword [eax]
mov dword [edi + 0x354], eax
je 0x4575ea
cmp ebp, 0x16
je 0x4575ea
cmp ebp, 0x17
je 0x4575ea
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0xbd2
push eax
call esi
cmp ebp, 0x34
jne 0x4575cb
cmp dword [edi + 0x378], 0
je 0x4575cb
mov ecx, dword [edi + 0x354]
push 0
push 0
mov dword [edi + 0x378], 0
mov edx, dword [ecx]
push 0xbd3
push edx
call esi
mov eax, dword [edi + 0x354]
mov ecx, dword [eax]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov edx, dword [eax]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov eax, dword [edi + 0x354]
test eax, eax
je 0x457622
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [edi + 0x354], 0
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 4
Function at 0x458810
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [0x6784cc]
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], edi
je 0x458837
push edi
push eax
call esi
mov edi, eax
lea eax, [esp + 0x10]
push eax
push ebp
call esi
push 1
mov ecx, str.user32.dll
mov esi, eax
call fcn.00577150
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x458874
push str.AllowSetForegroundWindow
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45886d
mov ecx, dword [esp + 0x10]
push ecx
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, esi
je 0x45889b
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
mov ebp, eax
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret