joyce8/EMBER2024-capa huggingface dataset:
Function at 0x133b2060
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
test eax, eax
je 0x133b208a
push str.winbrosqlite3_module_is_Loaded
push str.History
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x10
mov eax, 1
pop esi
ret
push str.winbrosqlite3.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x30], eax
jne 0x133b20c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winbrosqlite3_module_load_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x14
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open16
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x30]
push str.sqlite3_prepare16_v2
push eax
call edi
mov ecx, dword [esi + 0x30]
push str.sqlite3_bind_int64
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x30]
push str.sqlite3_bind_text16
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x30]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi + 0x30]
push str.sqlite3_column_int64
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x30]
push str.sqlite3_column_text16
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
push str.sqlite3_column_blob
push eax
call edi
mov ecx, dword [esi + 0x30]
push str.sqlite3_column_bytes
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi + 0x30]
push str.sqlite3_close
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x30]
push str.sqlite3_finalize
push eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x2c], eax
test ecx, ecx
pop edi
je 0x133b21cc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x133b21cc
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x133b21cc
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x133b21cc
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x133b21cc
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x133b21cc
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x133b21cc
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x133b21cc
test eax, eax
je 0x133b21cc
mov eax, dword [esi + 0x20]
test eax, eax
je 0x133b21cc
mov eax, dword [esi + 0x24]
test eax, eax
je 0x133b21cc
push str.winbrosqlite3_module_load_successful
push str.History
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x10
mov eax, 1
mov dword [esi + 0x34], eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_winbrosqlite3_function_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x14
mov ecx, esi
call fcn.133b2200
xor eax, eax
pop esi
ret
Function at 0x133b4ea0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x133b4efe
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x133b4eda
push esi
call fcn.1342ad3d
add esp, 4
lea eax, [eax + eax + 2]
jmp 0x133b4edc
xor eax, eax
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x133b4f10
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x133b4f57
mov ecx, dword [esp]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret 0xc

Function at 0x133b4f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push 0x80000002
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x133b4ffa
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x133b4fe4
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.1342ad5a
mov esi, eax
add esp, 4
test esi, esi
je 0x133b4fe4
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x133b5010
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
push ecx
push 0x80000002
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x133b5074
mov dword [esp + 8], eax
lea edx, [esp + 0x10]
lea eax, [esp + 4]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0xc
ret 8
Function at 0x133b6e90
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x13512430]
test eax, eax
jne 0x133b7004
mov ecx, dword [esp + 4]
mov eax, str.DtsFrame32.dll
test ecx, ecx
je 0x133b6eac
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x13512434], eax
je 0x133b6fff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallDetours
push eax
call esi
mov dword [0x13512438], eax
mov eax, dword [0x13512434]
push str.UninstallDetours
push eax
call esi
mov ecx, dword [0x13512434]
push str.RegisterFunc
push ecx
mov dword [0x1351243c], eax
call esi
mov edx, dword [0x13512434]
push str.UnRegisterFunc
push edx
mov dword [0x13512440], eax
call esi
mov dword [0x13512444], eax
mov eax, dword [0x13512434]
push str.DtsInstallDetours
push eax
call esi
mov ecx, dword [0x13512434]
push str.DtsUninstallDetours
push ecx
mov dword [0x13512448], eax
call esi
mov edx, dword [0x13512434]
push str.DtsRegisterFunc
push edx
mov dword [0x1351244c], eax
call esi
mov dword [0x13512450], eax
mov eax, dword [0x13512434]
push str.DtsUnRegisterFunc
push eax
call esi
mov ecx, dword [0x13512434]
push str.DtsCallNext
push ecx
mov dword [0x13512454], eax
call esi
mov ecx, dword [0x13512438]
mov dword [0x13512458], eax
test ecx, ecx
pop esi
je 0x133b6fd8
mov ecx, dword [0x1351243c]
test ecx, ecx
je 0x133b6fd8
mov ecx, dword [0x13512440]
test ecx, ecx
je 0x133b6fd8
mov ecx, dword [0x13512444]
test ecx, ecx
je 0x133b6fd8
mov ecx, dword [0x13512448]
test ecx, ecx
je 0x133b6fd8
mov ecx, dword [0x1351244c]
test ecx, ecx
je 0x133b6fd8
mov ecx, dword [0x13512450]
test ecx, ecx
je 0x133b6fd8
mov ecx, dword [0x13512454]
test ecx, ecx
je 0x133b6fd8
test eax, eax
je 0x133b6fd8
mov eax, dword [0x13511b00]
mov dword [0x13512430], 1
test eax, eax
je 0x133b6fff
push str.CDtSockeFrame_Init_Ok
jmp 0x133b6feb
call fcn.133b7010
mov eax, dword [0x13511b00]
test eax, eax
je 0x133b6fff
push str.CDtSockeFrame_Init_Failed
push str.SockethfMgr
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x10
mov eax, dword [0x13512430]
ret
Function at 0x133bc910
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x134bccd8
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
je 0x133bc962
mov edi, dword [esp + 0x20]
cmp edi, ebx
je 0x133bc962
push eax
lea ecx, [esp + 0x20]
call fcn.1343e9b0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
jne 0x133bc976
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.1343f110
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x133bc9ae
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x133bc9a5
mov ebx, 1
jmp 0x133bc9a7
mov dword [edi], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.1343f110
mov ecx, dword [esp + 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x133bfd30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x134bd138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov eax, dword [0x134d0d90]
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x18], eax
mov byte [esp + 0x58], 1
mov dword [esp + 0x14], eax
mov byte [esp + 0x58], 2
mov dword [esp + 0x10], eax
mov byte [esp + 0x58], 3
mov dword [esp + 0xc], eax
mov byte [esp + 0x58], 4
mov dword [esp + 8], eax
mov byte [esp + 0x58], 5
mov dword [esp + 4], eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x58], 6
call fcn.13449e10
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 7
call fcn.13449e10
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 8
call fcn.134504d0
mov esi, dword [esp + 0x60]
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x58], 9
lea eax, [esi + 0x14]
push eax
push ecx
lea ecx, [esp + 0x48]
call fcn.1344a420
lea edx, [esi + 0x10]
lea ecx, [esp + 0x60]
push edx
call fcn.13443a90
push eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x60], 0xa
call fcn.1344a420
lea ecx, [esp + 0x60]
mov byte [esp + 0x58], 9
call fcn.13444490
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x24]
push esi
push ecx
lea ecx, [esp + 0x28]
call fcn.13450710
lea edx, [esp + 0x20]
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x40]
push edx
push 4
push 0x134f0a38
call fcn.133d03f0
add esp, 0x30
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 8
call fcn.134504e0
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 7
call fcn.13449e20
lea ecx, [esp + 0x40]
mov byte [esp + 0x58], 6
call fcn.13449e20
lea ecx, [esp + 4]
mov byte [esp + 0x58], 5
call fcn.13444490
lea ecx, [esp + 8]
mov byte [esp + 0x58], 4
call fcn.13444490
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 3
call fcn.13444490
lea ecx, [esp + 0x10]
mov byte [esp + 0x58], 2
call fcn.13444490
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 1
call fcn.13444490
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 0
call fcn.13444490
lea ecx, [esp + 0x1c]
mov dword [esp + 0x58], 0xffffffff
call fcn.13444490
mov ecx, dword [esp + 0x50]
pop esi
mov dword fs:[0], ecx
add esp, 0x58
ret
Function at 0x133c9a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x134be573
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
mov ecx, dword [0x134d0d90]
mov dword [esp], eax
mov dword [eax + 0x1c], ecx
mov edx, dword [0x134d0d90]
mov dword [esp + 0xc], 0
mov dword [eax + 0x20], edx
mov ecx, dword [0x134d0d90]
mov byte [esp + 0xc], 1
mov dword [eax + 0x24], ecx
mov edx, dword [0x134d0d90]
mov byte [esp + 0xc], 2
mov dword [eax + 0x28], edx
mov ecx, dword [0x134d0d90]
mov byte [esp + 0xc], 3
mov dword [eax + 0x2c], ecx
mov edx, dword [0x134d0d90]
mov byte [esp + 0xc], 4
mov dword [eax + 0x30], edx
mov ecx, dword [0x134d0d90]
mov byte [esp + 0xc], 5
mov dword [eax + 0x34], ecx
mov edx, dword [0x134d0d90]
mov byte [esp + 0xc], 6
mov dword [eax + 0x38], edx
mov ecx, dword [0x134d0d8c]
mov byte [esp + 0xc], 7
mov dword [eax + 0x3c], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 0xffffffff
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x133cb620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x134bea47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], 0
test edi, edi
je 0x133cb7dd
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x133cb7dd
push ebx
push ebp
push 0x13512ab0
lea ecx, [esp + 0x34]
call fcn.13443cf0
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x24], 1
test ebp, ebp
je 0x133cb77a
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x133cb77a
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
push ebp
push eax
push ecx
call fcn.133be650
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x133cb77a
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov esi, ecx
mov ecx, dword [esp + 0x34]
add esi, ebx
push edx
add esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
not ecx
dec ecx
sub eax, ebx
sub eax, ecx
push eax
push esi
call fcn.133be650
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
je 0x133cb776
push ebp
push esi
lea ecx, [esp + 0x1c]
call fcn.13443f40
mov eax, dword [esp + 0x30]
mov byte [esp + 0x24], 2
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x133cb71b
push 0x134ef390
lea ecx, [esp + 0x34]
call fcn.134450e0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
call fcn.13445140
mov edi, dword [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x24], 1
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x3c]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
add ebp, edx
mov edx, dword [esp + 0x34]
not ecx
dec ecx
add ecx, ebp
add ecx, ebx
add edx, ecx
sub eax, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], edx
mov dword [esp + 0x10], eax
call fcn.13444490
mov ebp, dword [esp + 0x38]
jmp 0x133cb692
mov ebp, dword [esp + 0x38]
mov eax, dword [0x13511b00]
test eax, eax
je 0x133cb7a2
mov eax, dword [esp + 0x30]
push eax
push ebp
push str.GetEMailSpecialstrLoopW___S___s_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x18
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.13443a90
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 0
call fcn.13444490
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov esi, dword [esp + 0x24]
push 0x13512ab0
mov ecx, esi
call fcn.13443cf0
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x133d3160
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x134bfc98
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test ebp, ebp
je 0x133d3318
mov edi, dword [esp + 0x24]
test edi, edi
je 0x133d3318
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x133d3318
push 0x1001
xor ebx, ebx
call fcn.1342ad5a
mov esi, eax
add esp, 4
test esi, esi
je 0x133d32d9
push 0x180
push 0x8000
push ebp
call fcn.1342bac5
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
je 0x133d32ca
cmp edi, 0x1000
mov ebx, edi
jbe 0x133d31e3
mov ebx, 0x1000
mov ecx, 0x400
xor eax, eax
mov edi, esi
push ebx
push esi
push ebp
rep stosd dword es:[edi], eax
call fcn.1342c26b
push ebp
call fcn.1342b7f5
push 0x134f0044
push str.sha
push ebx
lea eax, [esp + 0x40]
push esi
push eax
call fcn.133cb4b0
add esp, 0x24
mov edi, dword [esp + 0x28]
push eax
mov ecx, edi
mov dword [esp + 0x1c], 0
call fcn.13444620
or ebp, 0xffffffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.13444490
mov ecx, dword [edi]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x133d3278
push 0x134effa8
push str.sha
push ebx
lea edx, [esp + 0x34]
push esi
push edx
call fcn.133cb4b0
add esp, 0x14
push eax
mov ecx, edi
mov dword [esp + 0x1c], 1
call fcn.13444620
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebp
call fcn.13444490
push 0x134f0044
push str.size
push ebx
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.133cb4b0
mov ecx, dword [esp + 0x34]
push 0xa
push 0
push ecx
mov dword [esp + 0x38], 2
call fcn.1342b462
mov edx, dword [esp + 0x4c]
add esp, 0x20
lea ecx, [esp + 0x20]
mov ebx, 1
mov dword [edx], eax
mov dword [esp + 0x18], ebp
call fcn.13444490
push esi
call fcn.13429bc8
add esp, 4
jmp 0x133d32dd
mov edi, dword [esp + 0x28]
push esi
call fcn.13429bc8
add esp, 4
jmp 0x133d32dd
mov edi, dword [esp + 0x28]
mov eax, dword [0x13511b00]
test eax, eax
je 0x133d3303
mov eax, dword [edi]
push eax
push ebx
push str.GetQQexAttachHeadData__bRet:_d____s_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x18
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x133d4850
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x13511b00]
push esi
mov esi, dword [esp + 8]
push edi
test eax, eax
je 0x133d4879
push esi
push str.CorrectAttachData__type:_08x_
push str.Combine
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x14
cmp esi, 0x3d0
jne 0x133d4923
mov edi, dword [esp + 0x18]
mov esi, dword [edi + 4]
cmp esi, 1
jl 0x133d4923
dec esi
js 0x133d4923
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x28]
mov eax, dword [ebx]
cmp dword [eax + esi*4], 0x3d1
jne 0x133d491e
mov eax, dword [0x13511b00]
test eax, eax
je 0x133d48e8
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 4]
mov eax, dword [edi + 4]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
mov edx, dword [ecx + 4]
push edx
push esi
push str.CorrectAttachData__remove__i_:__d____d__d__d__d_
push str.Combine
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x24
mov eax, dword [edi]
mov ecx, dword [eax + esi*4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x1c]
push 1
push esi
call fcn.1344a9f0
push 1
push esi
mov ecx, edi
call fcn.1344a9f0
push 1
push esi
mov ecx, ebp
call fcn.134507f0
push 1
push esi
mov ecx, ebx
call fcn.134507f0
dec esi
jns 0x133d48a6
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x13400f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x134c61b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], 0x134cd798
lea edi, [esi + 0x1b8]
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1d0]
mov dword [esp + 0x2c], 0
test eax, eax
jne 0x13400fce
mov eax, dword [esp + 0x34]
test eax, eax
je 0x13400fce
mov ebp, dword [esp + 0x3c]
cmp ebp, 2
je 0x13400ff3
cmp ebp, 1
je 0x13400ff3
push edi
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
lea eax, [esi + 0xe8]
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.13451330
mov edx, dword [esp + 0x34]
mov eax, dword [esi + 0x12c]
lea ecx, [esi + 0x128]
push edx
push eax
mov byte [esp + 0x34], 1
call fcn.13449640
mov eax, dword [0x134d0d90]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov byte [esp + 0x2c], 2
test eax, eax
je 0x13401041
push eax
lea ecx, [esp + 0x10]
call fcn.13444710
mov eax, dword [esi + 0x14c]
lea ecx, [esi + 0x148]
lea edx, [esp + 0xc]
push edx
push eax
call fcn.1344a420
mov eax, dword [esi + 0x13c]
lea ecx, [esi + 0x138]
push ebp
push eax
call fcn.13450710
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.13444490
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.13451390
push edi
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x13403700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x134c65a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
xor eax, eax
lea ecx, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push esi
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
call dword [0x1350dea0]
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
call fcn.134597a0
add esp, 8
mov dword [esp + 0x28], 1
call fcn.133b1210
push eax
lea ecx, [esp + 8]
call fcn.1343e7e0
push 0x134f0330
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.1343fd20
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 8]
call fcn.1343fd80
push 0x134f5784
lea ecx, [esp + 8]
call fcn.1343fd20
mov esi, dword [esp + 0x30]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.1343e6e0
mov dword [esp + 0x1c], 1
lea ecx, [esp + 4]
mov byte [esp + 0x28], 1
call fcn.1343f110
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.1343f110
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret