Function at 0x4038e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Make an http request with a cookie
Read data from internet
Receive data
Receive data on socket
Resolve dns
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x29f4
call fcn.0040eaa0
push ebx
push esi
xor edx, edx
xor esi, esi
push edi
mov dword [esp + 0x18], edx
mov byte [esp + 0x1f], 1
cmp byte [0x422410], dl
je 0x403921
push 0x422410
push 0x410390
push str.https:__login.taobao.com
call dword [sym.imp.WININET.dll_InternetSetCookieA]
mov edx, dword [esp + 0x18]
mov edi, 0x353225
mov ebx, 0x363225
jmp 0x403930
mov al, byte [edx + 0x415ed7]
movsx ecx, al
add ecx, 0xffffffe0
cmp ecx, 0xb
ja case.0x403948.33
movzx ecx, byte [ecx + 0x4056d4]
jmp dword [ecx*4 + 0x4056c0]
mov byte [esp + esi + 0xac], 0x2b
jmp 0x403988
mov dword [esp + esi + 0xac], edi
add esi, 3
jmp 0x403989
mov dword [esp + esi + 0xac], ebx
add esi, 3
jmp 0x403989
mov dword [esp + esi + 0xac], 0x423225
add esi, 3
jmp 0x403989
mov byte [esp + esi + 0xac], al
inc esi
inc edx
cmp edx, 0x10
jae 0x403998
cmp byte [edx + 0x415ed7], 0
jne 0x403930
mov dword [esp + 0x18], edx
mov byte [esp + esi + 0xac], 0
mov ebx, dword [sym.imp.WININET.dll_HttpOpenRequestA]
lea edx, [esp + 0xac]
push edx
push 0x415eac
lea eax, [esp + 0xf8]
push str.XPL_checkcode1111TPL_username_sTPL_password_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [0x419ee8]
add esp, 0x10
push 0
push 0x84803000
push 0
push str.http:__login.taobao.com_member_login.jhtml
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
mov edi, eax
push ecx
mov dword [esp + 0x98], edi
call ebx
push 4
lea edx, [esp + 0x18]
push edx
mov esi, eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push edi
lea eax, [esp + 0xf4]
push eax
push 0x59
push str.Connection:_close_r_nAccept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea esp, [esp]
lea ecx, [esp + 0x18]
push ecx
mov edx, 0xfa0
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x403a74
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x403a74
cmp eax, 0xfa0
jb 0x403a40
test eax, eax
je 0x4053a1
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7fff
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x403aeb
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x403b0a
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7fff
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x403b61
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov eax, 0x2710
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x403b5a
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x403b5a
cmp edi, 0x2710
jb 0x403b21
mov byte [edi + 0x41a3f0], 0
push 0
lea edx, [esp + 0x18]
push edx
push 0x415ee8
push 0x16
push esi
mov dword [esp + 0x28], 0x1770
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str.:_uc3
push 0x415ee8
mov byte [eax + 0x415ee8], 0
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x403bce
add esi, 6
push 0x3b
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov ecx, 0x422410
add esp, 8
mov byte [eax], 0
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x403bc4
push str.__login.taobao.com_member_login_unusual.htm
push 0x41a3f0
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x403d95
add esi, 0x12
push 0x22
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
push str.user_num_id
push esi
mov byte [eax], 0
call edi
add eax, 0xc
push eax
call dword [sym.imp.MSVCRT.dll__atoi64]
mov ecx, dword [0x419ee8]
add esp, 0x14
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push esi
push 0x40f42c
push ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edx
call ebx
push 4
lea edx, [esp + 0x18]
push edx
mov esi, eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x28
push str.Connection:_close_r_nAccept_Encoding:_gzip
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
mov edx, 0xfa0
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x403ca4
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x403ca4
cmp eax, 0xfa0
jb 0x403c70
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7fff
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x403d13
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x403d36
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7fff
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x40471c
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov eax, 0x2710
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call ebx
mov edi, dword [esp + 0x14]
test eax, eax
je 0x404715
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x404715
cmp edi, 0x2710
jb 0x403d53
jmp 0x404715
push 0x4102e0
push 0x41a3f0
call edi
add esp, 8
test eax, eax
je 0x404723
push str.sessionid
push 0x41a3f0
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x404723
push 0x4102d0
push esi
call dword [sym.imp.MSVCRT.dll_strpbrk]
mov byte [eax], 0
lea eax, [esi + 0xa]
mov edx, 0x4150a3
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403de5
test byte [0x415d72], 0x20
push 0
jne 0x403e18
mov edx, dword [0x415ea0]
push 0x4026b0
push edx
push 0x67
push 0x400000
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x404343
mov eax, dword [0x4229b8]
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push str._get_img_sessionid
push 0x40f42c
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push 4
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x11
push str.Connection:_close
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x18]
push edx
mov ecx, 0xfa0
sub ecx, eax
push ecx
lea edx, [eax + 0x417270]
push edx
push esi
call edi
test eax, eax
je 0x403ea8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x403ea8
cmp eax, 0xfa0
jb 0x403e74
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x419f24]
push 0x419eec
push 0x4227b0
lea edx, [ecx + eax + 0x1e9]
mov eax, dword [0x422844]
push edx
push 0x415e54
push 0x415e54
push eax
push str.POST__Upload_Processing.aspx_HTTP_1.1_r_nHost:_upload.uuwise.net:9000_r_nSID:104136_r_nHASH:26bc1f2a5a573055f125dc433056dcb1_r_nUUVersion:1.1.0.1_r_nUID:_u_r_nUser_Agent:_s00e021ac7d_r_nKEY:_s00e021ac7d_r_nContent_Type:_multipart_form_data__boundary___r_nContent_Length:__u_r_n_r_n_____r_nContent_Disposition:_form_data__name_key__r_n_r_n_s_r_n_____r_nContent_Disposition:_form_data__name_sid__r_n_r_n104136_r_n_____r_nContent_Disposition:_form_data__name_skey__r_n_r_n_s_r_n_____r_nContent_Disposition:_form_data__name_TimeOut__r_n_r_n34000_r_n_____r_nContent_Disposition:_form_data__name_type__r_n_r_n1004_r_n_____r_nContent_Disposition:_form_data__name_Version__r_n_r_n100_r_n_____r_nContent_Disposition:_form_data__name_img___filename_1.jpg__r_nContent_Type:_image_jpg_r_n_r_n
push 0x415ee8
call dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, dword [esp + 0x34]
mov edi, eax
push esi
lea ecx, [edi + 0x415ee8]
push 0x417270
push ecx
call sub.MSVCRT.dll_memcpy
movq xmm0, qword [str._r_n_______r_n]
mov edx, dword [0x410004]
add edi, esi
movq qword [edi + 0x415ee8], xmm0
add esp, 0x2c
mov dword [edi + 0x415ef0], edx
add edi, 0xa
mov byte [esp + 0x1e], 6
lea esp, [esp]
mov ebx, dword [sym.imp.WS2_32.dll_socket]
push 0
push 1
push 2
call ebx
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
mov eax, dword [0x415d80]
push 1
push 0x40f2c9
push 1
push 6
push eax
call sub.WS2_32.dll_setsockopt
push 0x10
push 0x41a3ac
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x404001
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.upload.uuwise.net
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x403fb7
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [0x41a3b0], eax
push 0
push 1
push 2
call ebx
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 0x10
push 0x41a3ac
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x403f96
push 0
push edi
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0
push 0x5ac
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
mov ebx, eax
call dword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
jg 0x404066
dec byte [esp + 0x1e]
jne 0x403f30
mov eax, dword [esp + 0x5c]
cmp eax, 0xfffffffa
jne 0x4053c4
push 0
push 0x1000
push 0
push 0x40ffe4
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x40f738
push 0x415ee8
mov byte [ebx + 0x415ee8], 0
call dword [sym.imp.MSVCRT.dll_strstr]
add eax, 4
push eax
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 0xc
mov dword [esp + 0x5c], eax
test eax, eax
js 0x40403a
mov ecx, dword [0x422844]
push 0x415e54
push 0x415e54
push ecx
mov edx, eax
push edx
push 0x4227b0
push str.GET__Upload_GetResult.aspx_KEY_sID_u_HTTP_1.1_r_nHost:_upload.uuwise.net:9000_r_nSID:104136_r_nHASH:26bc1f2a5a573055f125dc433056dcb1_r_nUUVersion:1.1.0.1_r_nUID:_u_r_nUser_Agent:_s00e021ac7d_r_nKEY:_s00e021ac7d_r_n_r_n
push 0x415ee8
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
mov dword [esp + 0x7c], eax
mov byte [esp + 0x1e], 7
jmp 0x4040d0
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.WS2_32.dll_socket]
push 0
push 1
push 2
call edi
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
mov ebx, dword [sym.imp.WS2_32.dll_connect]
push 0x10
push 0x41a3ac
push esi
call ebx
test eax, eax
je 0x404198
lea ecx, [ecx]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.upload.uuwise.net
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x404152
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [0x41a3b0], edx
push 0
push 1
push 2
call edi
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 0x10
push 0x41a3ac
push esi
call ebx
test eax, eax
jne 0x404130
mov eax, dword [esp + 0x7c]
push 0
push eax
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0
push 0x5ac
push 0x4162e8
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push esi
mov edi, eax
call ebx
dec byte [esp + 0x1e]
je 0x404203
test edi, edi
jle 0x4040d0
push 0x40f738
push 0x4162e8
mov byte [edi + 0x4162e8], 0
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4040d0
cmp byte [eax + 4], 0x2d
je 0x4040d0
test edi, edi
jle 0x404339
push 0x40f738
push 0x4162e8
mov byte [edi + 0x4162e8], 0
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x404243
add eax, 4
lea ecx, [edi + 0x4162e4]
cmp eax, ecx
jne 0x404243
mov edx, dword [eax]
mov dword [0x415ee8], edx
jmp 0x404343
mov eax, dword [esp + 0x5c]
push 0x415e54
push 0x415e54
push 0x419eec
push eax
push 0x4227b0
push str.GET__Upload_ReportError.aspx_key_sID_usid104136skey_s_HTTP_1.1_r_nHost:_upload.uuwise.net:9000_r_nSID:104136_r_nHASH:26bc1f2a5a573055f125dc433056dcb1_r_nUUVersion:1.1.0.1_r_nUID:628597_r_nUser_Agent:82d66d57b6f00855191e898553cc8c4100e021ac7d_r_nKEY:82d66d57b6f00855191e898553cc8c4100e021ac7d_r_n_r_n
push 0x415ee8
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
push 0
push 1
push 2
mov edi, eax
call dword [sym.imp.WS2_32.dll_socket]
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 0x10
push 0x41a3ac
push esi
call dword [sym.imp.WS2_32.dll_connect]
push esi
call ebx
push str.upload.uuwise.net
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4042d8
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [0x41a3b0], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 0
push edi
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0
push 0x5ac
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
call ebx
mov dword [0x415ee8], 0x61616161
mov edx, dword [0x419ee8]
mov ecx, dword [0x415ee8]
mov ebx, dword [sym.imp.WININET.dll_HttpOpenRequestA]
push 0
push 0x84803000
push 0
push str.http:__login.taobao.com_member_login.jhtml
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push edx
mov byte [esp + 0x110], 0x54
mov dword [esp + 0x11e], ecx
call ebx
mov esi, eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov ecx, dword [esp + 0x78]
push ecx
lea edx, [esp + 0xf4]
push edx
push 0x59
push str.Connection:_close_r_nAccept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
mov edx, 0xfa0
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4043f9
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x4043f9
cmp eax, 0xfa0
jb 0x4043c5
test eax, eax
je 0x4053a1
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x2710
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x404470
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x40448f
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x2710
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x4044e6
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov eax, 0x2710
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4044df
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x4044df
cmp edi, 0x2710
jb 0x4044a6
mov byte [edi + 0x41a3f0], 0
push 0
lea edx, [esp + 0x18]
push edx
push 0x415ee8
push 0x16
push esi
mov dword [esp + 0x28], 0x1770
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [esp + 0x14]
push esi
mov byte [eax + 0x415ee8], 0
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str.:_uc3
push 0x415ee8
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x40455a
add esi, 6
push 0x3b
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov ecx, 0x422410
add esp, 8
mov byte [eax], 0
sub ecx, esi
lea esp, [esp]
mov al, byte [esi]
mov byte [esi + ecx], al
inc esi
test al, al
jne 0x404550
push str.__login.taobao.com_member_login_unusual.htm
push 0x41a3f0
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x404723
add esi, 0x12
push 0x22
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
push str.user_num_id
push esi
mov byte [eax], 0
call edi
add eax, 0xc
push eax
call dword [sym.imp.MSVCRT.dll__atoi64]
mov ecx, dword [0x419ee8]
add esp, 0x14
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push esi
push 0x40f42c
push ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edx
call ebx
push 4
lea edx, [esp + 0x18]
push edx
mov esi, eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x28
push str.Connection:_close_r_nAccept_Encoding:_gzip
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea esp, [esp]
lea ecx, [esp + 0x18]
push ecx
mov edx, 0xfa0
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x404634
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x404634
cmp eax, 0xfa0
jb 0x404600
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7fff
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x4046a3
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x4046c2
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7fff
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x40471c
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
nop
lea edx, [esp + 0x18]
push edx
mov eax, 0x2710
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call ebx
mov edi, dword [esp + 0x14]
test eax, eax
je 0x404715
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x404715
cmp edi, 0x2710
jb 0x4046e0
mov byte [edi + 0x41a3f0], 0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.__aq.taobao.com_durex_validate_param
push 0x41a3f0
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x404c72
add esi, 0x25
push 0x26
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov ecx, 0x415176
add esp, 8
mov byte [eax], 0
sub ecx, esi
lea esp, [esp]
mov al, byte [esi]
mov byte [esi + ecx], al
inc esi
test al, al
jne 0x404760
mov edx, dword [0x415dd0]
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push str._durex_validate_param
push 0x40f42c
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push 4
lea eax, [esp + 0x24]
push eax
push 0x1f
push esi
mov dword [esp + 0x30], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x28
push str.Connection:_close_r_nAccept_Encoding:_gzip
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x20], eax
lea esp, [esp]
lea ecx, [esp + 0x64]
push ecx
mov edx, 0x3fff
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0x20]
je 0x404804
mov ecx, dword [esp + 0x64]
add eax, ecx
mov dword [esp + 0x20], eax
test ecx, ecx
je 0x404804
cmp eax, 0x1b58
jb 0x4047d0
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7fff
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x404873
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x404892
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7fff
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x4048ec
mov edi, dword [esp + 0x20]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea esp, [esp]
lea edx, [esp + 0x64]
push edx
mov eax, 0x4650
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call ebx
mov edi, dword [esp + 0x20]
test eax, eax
je 0x4048e5
mov eax, dword [esp + 0x64]
add edi, eax
mov dword [esp + 0x20], edi
test eax, eax
je 0x4048e5
cmp edi, 0x4650
jb 0x4048b0
mov byte [edi + 0x41a3f0], 0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.cmd_uuid_:_
push 0x41a3f0
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x404ee0
lea esi, [eax + 0xb]
mov ecx, 0x40
lea edi, [esp + 0x1f0]
lea edx, [esp + 0x1f0]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x22
push edx
call edi
push str.cmd_content_:_
push 0x41a3f0
mov byte [eax], 0
call dword [sym.imp.MSVCRT.dll_strstr]
lea esi, [eax + 0xe]
push 0x22
push esi
call edi
add esp, 0x18
push 0x9c2
mov byte [eax], 0
lea eax, [esp + 0x1680]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x60]
push edx
push 0x413c18
push 1
push 0
lea ecx, [eax + eax - 2]
push 0x41a39c
mov dword [esp + 0x168c], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x404f0d
pxor xmm0, xmm0
movdqa xmmword [esp + 0x90], xmm0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x80], xmm0
lea edx, [esp + 0x167c]
mov dword [esp + 0x88], edx
lea edx, [esp + 0x74]
push edx
push 0x800
push 1
lea eax, [esp + 0x8c]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x6c]
push 0x415d60
mov ecx, 8
mov dword [esp + 0xa8], 1
mov word [esp + 0x90], cx
mov ecx, dword [eax]
push 0x413c08
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0xe8]
push edx
lea edx, [esp + 0x9c]
push edx
mov edx, dword [esp + 0x84]
push 1
push 0x800
push 0x413c08
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
jne 0x404f2f
mov ebx, dword [esp + 0xe8]
mov edi, dword [ebx - 4]
xor edx, edx
shr edi, 1
je 0x404a8e
mov cl, byte [ebx + edx*2]
cmp cl, 0x26
jne 0x404a6c
mov dword [esp + eax + 0x2f0], 0x363225
add eax, 3
jmp 0x404a89
cmp cl, 0x25
jne 0x404a81
mov dword [esp + eax + 0x2f0], 0x353225
add eax, 3
jmp 0x404a89
mov byte [esp + eax + 0x2f0], cl
inc eax
inc edx
cmp edx, edi
jb 0x404a54
mov byte [esp + eax + 0x2f0], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
jmp 0x404ab0
mov cl, byte [eax + 0x415176]
mov byte [eax + 0x415777], cl
inc eax
test cl, cl
jne 0x404ab0
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x2f0]
push eax
push esi
lea ecx, [esp + 0x1f8]
push ecx
push str.isOldWidgetfalsesupport1newCerttruecmd_uuid_scheckTypecertissuerOAlipay.comCorporation__OUMachine_CA_Center__CNAlipay.com_Corporation_Machine_CAisOldfalsesignParam_scmd_content_s
push 0x415ee8
call ebx
mov edx, dword [0x415dd0]
add esp, 0x14
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push str._durex_checkcode_param
push str.POST
push edx
mov edi, eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push 4
lea eax, [esp + 0x24]
push eax
push 0x1f
push esi
mov dword [esp + 0x30], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push edi
push 0x415ee8
push 0x2f
push 0x40f2fa
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
lea ecx, [esp + 0x20]
push ecx
push 0x3e8
push 0x415ee8
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x404b65
mov edx, dword [esp + 0x20]
mov byte [edx + 0x415ee8], 0
jmp 0x404b6c
mov byte [0x415ee8], 0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str._isSuccess_:true
push 0x415ee8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x404f3c
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
push eax
push ecx
push str._member_login_by_safe.htm_type1user_num_id_I64u
push 0x415ee8
call ebx
mov edx, dword [0x419ee8]
add esp, 0x10
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push 0x415ee8
push 0x40f42c
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x11
push str.Connection:_close
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
mov edx, 0xfa0
sub edx, eax
push edx
lea eax, [eax + 0x41a3f0]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x404c3a
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x404c3a
cmp eax, 0xfa0
jb 0x404c06
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x415ee8
push 0x16
push esi
mov byte [eax + 0x41a3f0], 0
mov dword [esp + 0x28], 0xfa0
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov edx, dword [esp + 0x14]
push esi
mov byte [edx + 0x415ee8], 0
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x404c78
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str.Set_Cookie:__tb_token_
push 0x415ee8
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x404d40
add esi, 0x17
push 0x4223f0
push esi
mov byte [esp + 0x27], 0
call edi
add esp, 8
test eax, eax
jne 0x404d40
movq xmm0, qword [esi]
movq qword [0x4223f0], xmm0
movq xmm0, qword [esi + 8]
movq qword [0x4223f8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x422400], xmm0
mov eax, dword [esi + 0x18]
mov dword [0x422408], eax
mov cx, word [esi + 0x1c]
mov word [0x42240c], cx
mov dl, byte [esi + 0x1e]
push 0x3b
push 0x4223f0
mov byte [0x42240e], dl
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, dword [sym.imp.WININET.dll_InternetSetCookieA]
add esp, 8
push 0x4223f0
push str._tb_token_
push str.https:__login.taobao.com
mov byte [eax], 0
call esi
push 0x4223f0
push str._tb_token_
push str.https:__mai.taobao.com
call esi
push 0x4223f0
push str._tb_token_
push str.https:__rate.taobao.com
call esi
push str.__mai.taobao.com_seller_admin.htm
push 0x41a3f0
call edi
add esp, 8
test eax, eax
jne 0x404f49
push str.__i.taobao.com_
push 0x41a3f0
call edi
add esp, 8
test eax, eax
jne 0x405410
push 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x40fcf8
push 0x41a3f0
call edi
add esp, 8
test eax, eax
jne 0x405643
push 0x40fcec
push 0x41a3f0
call edi
add esp, 8
test eax, eax
jne 0x405662
push 0x40fce0
push 0x41a3f0
call edi
add esp, 8
test eax, eax
je 0x4056a0
test byte [0x415d72], 0x20
je 0x405681
mov eax, dword [esp + 0x5c]
push 0x415e54
push 0x415e54
push 0x419eec
push eax
push 0x4227b0
push str.GET__Upload_ReportError.aspx_key_sID_usid104136skey_s_HTTP_1.1_r_nHost:_upload.uuwise.net:9000_r_nSID:104136_r_nHASH:26bc1f2a5a573055f125dc433056dcb1_r_nUUVersion:1.1.0.1_r_nUID:628597_r_nUser_Agent:82d66d57b6f00855191e898553cc8c4100e021ac7d_r_nKEY:82d66d57b6f00855191e898553cc8c4100e021ac7d_r_n_r_n
push 0x415ee8
call ebx
mov ebx, dword [sym.imp.WS2_32.dll_socket]
add esp, 0x1c
push 0
push 1
push 2
mov edi, eax
call ebx
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 0x10
push 0x41a3ac
push esi
call dword [sym.imp.WS2_32.dll_connect]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.upload.uuwise.net
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x404e5f
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [0x41a3b0], eax
push 0
push 1
push 2
call ebx
push 4
push 0x40f40c
push 0x1006
mov esi, eax
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 4
push 0x40f410
push 0x80
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push 0
push edi
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0
push 0x5ac
push 0x415ee8
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xbb8
push 0
push 0x1000
push 0
push 0x40fcc0
push 0
call dword [0x41a044]
jmp 0x4039a4
push 0
push 0
push 0
push 0x40fb40
mov esi, dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
call esi
push 0
push 0
push 0
push 0x40fc68
push 0
call esi
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push str._g5u
mov esi, dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
call esi
push 0
push 0
push 0
push str.peW_KfN_rT1Y_
jmp 0x404ef1
push 0
push 0
push 0
push str.peW_KfN
jmp 0x404f18
push 0
push 0
push 0
push 0x40fa1c
jmp 0x404eeb
mov ecx, dword [0x415e7c]
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push str._myRate.htm
push 0x40f42c
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push 4
lea edx, [esp + 0x18]
push edx
mov esi, eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x28
push str.Connection:_close_r_nAccept_Encoding:_gzip
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x404fb0
lea ecx, [esp + 0x18]
push ecx
mov edx, 0x3e80
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x404fe4
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x404fe4
cmp eax, 0x3e80
jb 0x404fb0
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7d00
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x405053
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x405072
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7d00
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x4050cc
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
nop
lea edx, [esp + 0x18]
push edx
mov eax, 0x7d00
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call ebx
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4050c5
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x4050c5
cmp edi, 0x7d00
jb 0x405090
mov byte [edi + 0x41a3f0], 0
push 0
push esi
push 0x415ee8
call fcn.00402d20
add esp, 0xc
test al, al
je 0x404f49
cmp dword [esp + 0x14], 0
je 0x404f49
push 0x40fc44
push 0x41a3f0
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x405135
push 0xbb8
push 0x40
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x1000
push 0x40fc38
push 0x40fc1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x1f], 0
je 0x405398
xor ebx, ebx
mov edx, dword [0x41a384]
push ebx
push 0x84803000
push ebx
push ebx
push str.HTTP_1.0
push str._seller_admin.htm
push 0x40f42c
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push ebx
push ebx
push 0x28
push str.Connection:_close_r_nAccept_Encoding:_gzip
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea esp, [esp]
lea ecx, [esp + 0x18]
push ecx
mov edx, 0x3e80
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4051d4
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x4051d4
cmp eax, 0x3e80
jb 0x4051a0
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], ebx
call fcn.0040c4c0
lea edx, [esp + 0x34]
push ebx
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7d00
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x40523e
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x40525c
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7d00
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], bl
jns 0x4052b2
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov eax, 0x7d00
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4052ac
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
cmp eax, ebx
je 0x4052ac
cmp edi, 0x7d00
jb 0x405273
mov byte [edi + 0x41a3f0], bl
push ebx
push esi
push 0x415ee8
call fcn.00402d20
add esp, 0xc
test al, al
je 0x405142
cmp dword [esp + 0x14], ebx
je 0x405142
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push 0x40fc10
push 0x41a3f0
call edi
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x405398
add esi, 0xb
push 0x4223f0
push esi
call edi
add esp, 8
test eax, eax
jne 0x405398
movq xmm0, qword [esi]
movq qword [0x4223f0], xmm0
movq xmm0, qword [esi + 8]
movq qword [0x4223f8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x422400], xmm0
mov edx, dword [esi + 0x18]
mov dword [0x422408], edx
mov ax, word [esi + 0x1c]
mov word [0x42240c], ax
mov cl, byte [esi + 0x1e]
push 0x40fc08
push 0x4223f0
mov byte [0x42240e], cl
call dword [sym.imp.MSVCRT.dll_strpbrk]
mov byte [eax], bl
mov esi, dword [sym.imp.WININET.dll_InternetSetCookieA]
add esp, 8
push 0x4223f0
push str._tb_token_
push str.https:__login.taobao.com
call esi
push 0x4223f0
push str._tb_token_
push str.https:__mai.taobao.com
call esi
push 0x4223f0
push str._tb_token_
push str.https:__rate.taobao.com
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
push 0
push 0
push 0x40fbfc
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffffd
jne 0x4053ec
mov eax, 0x41a354
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4053d1
sub eax, edx
push eax
call fcn.00402260
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2710
push 0
push 0x1000
push 0
push 0x40fbd0
push 0
call dword [0x41a044]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x1f], 0
je 0x405398
mov edx, dword [0x41a384]
push 0
push 0x84803000
push 0
push 0
push str.HTTP_1.0
push str._seller_admin.htm
push 0x40f42c
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x1f
push esi
mov dword [esp + 0x24], 0x3380
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x28
push str.Connection:_close_r_nAccept_Encoding:_gzip
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
mov edx, 0x3e80
sub edx, eax
push edx
lea eax, [eax + 0x415ee8]
push eax
push esi
call edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4054aa
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x4054aa
cmp eax, 0x3e80
jb 0x405476
push 0x38
push str.1.2.3
pxor xmm0, xmm0
lea ecx, [esp + 0x2c]
movq qword [esp + 0x2c], xmm0
push 0x1f
pxor xmm0, xmm0
push ecx
mov edi, eax
movq qword [esp + 0x54], xmm0
mov dword [esp + 0x5c], 0
call fcn.0040c4c0
lea edx, [esp + 0x34]
push 0
push edx
mov dword [esp + 0x3c], 0x415ee8
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x41a3f0
mov dword [esp + 0x4c], 0x7d00
call fcn.0040c680
add esp, 0x18
test eax, eax
jns 0x405519
lea eax, [esp + 0x24]
push eax
call fcn.0040dba0
add esp, 4
jmp 0x405538
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dba0
mov eax, 0x7d00
add esp, 4
sub eax, dword [esp + 0x34]
mov byte [eax + 0x41a3f0], 0
jns 0x405591
mov edi, dword [esp + 0x14]
push edi
push 0x415ee8
push 0x41a3f0
call sub.MSVCRT.dll_memcpy
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov eax, 0x7d00
sub eax, edi
push eax
lea ecx, [edi + 0x41a3f0]
push ecx
push esi
call ebx
mov edi, dword [esp + 0x14]
test eax, eax
je 0x40558a
mov eax, dword [esp + 0x18]
add edi, eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x40558a
cmp edi, 0x7d00
jb 0x405555
mov byte [edi + 0x41a3f0], 0
push 0
push esi
push 0x415ee8
call fcn.00402d20
add esp, 0xc
test al, al
je 0x405417
cmp dword [esp + 0x14], 0
je 0x405417
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push 0x40fc10
push 0x41a3f0
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x405398
add esi, 0xb
push 0x4223f0
push esi
call edi
add esp, 8
test eax, eax
jne 0x405398
movq xmm0, qword [esi]
movq qword [0x4223f0], xmm0
movq xmm0, qword [esi + 8]
movq qword [0x4223f8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x422400], xmm0
mov edx, dword [esi + 0x18]
mov dword [0x422408], edx
mov ax, word [esi + 0x1c]
mov word [0x42240c], ax
mov cl, byte [esi + 0x1e]
push 0x40fc08
push 0x4223f0
mov byte [0x42240e], cl
call dword [sym.imp.MSVCRT.dll_strpbrk]
mov byte [eax], 0
jmp 0x40535c
push 0
push 0x1000
push 0
push 0x40fbc0
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x1000
push 0
push 0x40fbac
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x1000
push 0
push 0x40fba0
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x1000
push 0
push 0x40fb94
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret