joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70232350
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x7030f325
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
xor eax, eax
mov dword [esp + 0x38], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea edi, [esi + 0x40]
mov ebx, edi
call fcn.70248e30
mov edx, dword [edi + 0xc]
mov ebp, dword [esp + 0x28]
sub ebp, dword [esp + 0x20]
lea ebx, [esi + 0x24]
mov dword [esp + 0x14], edx
call fcn.70248e30
mov eax, dword [esp + 0x14]
sub eax, dword [ebx + 0xc]
mov esi, dword [esp + 0x44]
cdq
sub eax, edx
mov ecx, eax
mov eax, ebp
cdq
sub eax, edx
mov edx, dword [edi]
sar ecx, 1
sar eax, 1
push 0
lea ebp, [ecx + eax - 0xa]
mov eax, dword [edx + 4]
push ebp
push 0
push 0
push esi
mov ecx, edi
call eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x20]
push eax
push eax
sub ecx, ebp
push ecx
push ebp
call fcn.70248730
mov edi, dword [esp + 0x2c]
sub edi, dword [esp + 0x24]
call fcn.70248e30
mov eax, dword [esp + 0x40]
xor edx, edx
cmp dword [eax + 0xa4], edx
mov eax, dword [ebx + 0x10]
setne dl
push edx
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
push ebp
mov edx, esi
sub eax, ecx
push edx
mov ecx, ebx
call fcn.702486a0
mov edi, dword [esp + 0x2c]
sub edi, dword [esp + 0x24]
call fcn.70248e30
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x14], eax
call fcn.70248e30
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0x18], ecx
call fcn.70248e30
mov edx, dword [ebx + 0xc]
mov esi, dword [esp + 0x2c]
sub esi, dword [esp + 0x24]
mov dword [esp + 0x1c], edx
call fcn.70248e30
mov eax, dword [esp + 0x14]
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
sar ecx, 1
sub eax, ecx
add eax, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_SetRect]
push eax
mov eax, dword [ebx + 0x10]
add edx, ebp
push edx
cdq
sub eax, edx
mov ecx, eax
mov eax, esi
mov esi, dword [esp + 0x48]
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub eax, ecx
push eax
push ebp
lea edx, [esi + 0x80]
push edx
call edi
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
cmp eax, 0x2be
jl 0x7023250e
push 0x18
lea ecx, [eax - 0x11]
push ecx
push 0xd
add eax, 0xffffffe4
push eax
lea ebx, [esi + 0x90]
push ebx
call edi
mov eax, dword [ebx]
mov ecx, dword [esp + 0x44]
xor edx, edx
cmp dword [esi + 0xa8], edx
setne dl
push edx
push eax
mov eax, dword [esi + 0x94]
push ecx
lea ecx, [esi + 0x64]
call fcn.702486a0
jmp 0x7023251b
add esi, 0x90
push esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x70232ce0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x7031040d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x34], ebx
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp + 0x24]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edi, eax
cmp edi, 0xffffffff
je 0x70232d65
push ebx
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
push 2
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ExtTextOutW]
push edi
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
cmp dword [ebp + 0x30], ebx
je 0x70232d9d
cmp dword [ebp + 0x38], ebx
je 0x70232d76
mov eax, 1
jmp 0x70232d7e
xor eax, eax
cmp dword [ebp + 0x34], ebx
setne al
mov ecx, dword [ebp + 0x30]
mov edx, dword [ecx]
mov edx, dword [edx]
push eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push eax
push ebx
push ebx
push esi
call edx
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x3c], edi
mov byte [esp + 0x34], 1
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x70232dde
mov ecx, 0x104
lea eax, [esp + 0x3c]
call fcn.7020b270
mov edi, dword [esp + 0x3c]
mov eax, dword [ebp + 4]
push 0x104
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.702e36e0
add esp, 8
cmp eax, ebx
jl 0x70232e93
cmp eax, dword [edi - 8]
jg 0x70232e93
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
cmp dword [edi - 0xc], ebx
je 0x70232e5d
mov eax, dword [ebp + 0x2c]
mov ebx, dword [sym.imp.GDI32.dll_SetTextColor]
push eax
push esi
call ebx
mov ebp, dword [ebp + 0x28]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x44], eax
call ebp
push 0x25
lea edx, [esp + 0x1c]
push edx
push 0xffffffffffffffff
push edi
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [esp + 0x3c]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x14]
push ecx
push esi
call ebp
add edi, 0xfffffff0
mov byte [esp + 0x34], 0
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x70232e7e
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x28
ret 4
push 0x80070057
call fcn.702042c0
int3
Function at 0x70234ac0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0xe4]
call fcn.70235c00
mov eax, dword [ebx + 0xfc]
cmp dword [eax - 0xc], 0
je 0x70234b12
mov ecx, dword [ebx + 0x174]
mov edx, dword [ebx + 4]
push 0
push 0xbb8
push ecx
push edx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push ebx
push 0x70235480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x70234b12
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0xec]
cmp dword [ecx - 0xc], 0
lea eax, [ebx + 0xec]
je 0x70234b2a
push eax
call fcn.70235820
pop esi
pop ebx
ret
Function at 0x70235090
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x7030f2c5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x3e
push 0x172
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov ebp, dword [sym.imp.USER32.dll_SetRect]
push 0x2c
push 0xaf
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call ebp
call fcn.70232990
add eax, 0x18
mov eax, dword [eax]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x9b03e
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [edi + 0x124]
push 0x8020
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push edx
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_DrawTextW]
push 0x56
push 0x172
push 0x44
push 0xaf
lea eax, [esp + 0x28]
push eax
call ebp
mov edx, dword [edi + 0x128]
push 0x8020
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push edx
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x14]
push ecx
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [edi + 0x1a4]
cmp ecx, ebx
je 0x70235183
push ebx
push 0xa
push esi
lea eax, [ebx + 0x2c]
call fcn.702486a0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x702352a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x70314a36
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x238]
push 0x208
lea eax, [esp + 0x20]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x24], edi
call fcn.702e95e0
add esp, 0xc
lea esi, [esp + 0x1c]
call fcn.702179d0
test eax, eax
je 0x702353f8
push str.360WDmsico
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x702353f8
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x70235343
push eax
mov eax, esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x702353f8
lea edx, [esp + 0x1c]
call fcn.7020b380
mov eax, dword [ebp]
push 0x2f
push eax
call fcn.702e5376
add esp, 8
test eax, eax
je 0x702353f8
sub eax, dword [ebp]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x702353f8
mov edx, dword [0x703580e4]
mov eax, dword [edx + 0xc]
mov ecx, 0x703580e4
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
lea ecx, [esi + 1]
lea esi, [esp + 0x14]
mov edx, ebp
mov dword [esp + 0x230], 0
call fcn.70226410
lea edi, [esp + 0x10]
mov byte [esp + 0x230], 1
call fcn.70208e30
mov byte [esp + 0x230], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x702353db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x702353fc
lea eax, [esp + 0x10]
call fcn.7020c950
xor eax, eax
jmp 0x70235417
mov edi, dword [esp + 0x18]
lea edx, [esp + 0x1c]
call fcn.7020b380
lea eax, [esp + 0x10]
call fcn.7020c950
mov eax, 1
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x224
ret 4

Function at 0x70235820
Capabilities:
Check if file exists
Create thread

Disassembly:
push esi
mov esi, dword [ebx + 0x140]
push edi
test esi, esi
je 0x7023583b
call fcn.70235bc0
mov dword [ebx + 0x140], 0
mov eax, dword [esp + 0xc]
lea edi, [ebx + 0x13c]
push eax
mov ecx, edi
call fcn.702352a0
test eax, eax
je 0x70235888
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x7023588d
push 0x1c
call fcn.702e1f8d
mov esi, eax
add esp, 4
test esi, esi
je 0x70235880
mov eax, dword [edi]
call fcn.70248350
pop edi
mov dword [ebx + 0x140], eax
pop esi
ret 4
xor eax, eax
mov dword [ebx + 0x140], eax
pop edi
pop esi
ret 4
push 0
push 0
push ebx
push 0x70235440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x70235888
pop edi
pop esi
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
Function at 0x702358c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7031565d
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.7025a430
push 0x21
push str.http:__s.360.cn_safe_instcomp.htm
lea ecx, [esp + 0x30]
mov dword [esp + 0x9c], 0
call fcn.7020c1f0
mov ecx, dword [esp + 0x9c]
push ecx
push 0x7032628c
mov ecx, 0x14
lea edi, [esp + 0x78]
call fcn.7021b4f0
add esp, 8
push str.soft
mov ecx, esi
lea ebx, [esp + 0x10]
call fcn.7025a5a0
push str.status
mov ecx, edi
call fcn.7025a5a0
cmp byte [0x703593d0], 0
jne 0x7023596b
push 0x703593d0
call fcn.70215770
add esp, 4
push 0x7032a9f8
mov ecx, 0x703593d0
lea ebx, [esp + 0x10]
call fcn.7025a5a0
call fcn.702e4fe9
push eax
push 0x7032628c
mov ecx, 0x14
lea edi, [esp + 0x78]
call fcn.7021b4f0
add esp, 8
push 0x7032a9fc
mov ecx, edi
call fcn.7025a5a0
mov ecx, ebx
call fcn.7025af10
mov edx, ebx
push edx
mov dword [esp + 0x98], 0xffffffff
call fcn.7025a4a0
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x8c
ret 4
Function at 0x70237880
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
push ebx
push esi
push edi
call fcn.702237c0
or eax, 0xffffffff
mov ecx, 0x40
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor esi, esi
lea ebx, [ebx]
call edi
mov dword [esp + esi*4 + 0x10], eax
cmp eax, 0xffffffff
je 0x702378c6
cmp eax, 0x40
ja 0x702378c6
inc esi
cmp esi, 0x40
jl 0x702378b0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [edi + 4], ebx
je 0x702378ef
test ebx, ebx
je 0x702378dd
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
push ebx
call ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x702378ec
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi + 4], ebx
cmp byte [0x7035947f], 0
jne 0x70237931
mov ecx, dword [0x7037101c]
test ecx, ecx
jne 0x70237931
mov edi, dword [sym.imp.KERNEL32.dll_TlsFree]
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esp + esi*4 + 0x10]
cmp eax, 0xffffffff
je 0x70237a9b
push eax
call edi
inc esi
cmp esi, 0x40
jl 0x70237910
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.70215fb0
test ebx, ebx
je 0x70237a2a
call fcn.70202720
cmp byte [0x7034d46b], 0
jne 0x70237955
cmp byte [0x7034d493], 0
je 0x7023795a
call fcn.70201bb0
cmp dword [0x703593cc], 0
jne 0x7023796c
call fcn.70215a50
test eax, eax
je 0x70237978
mov eax, dword [0x7035903c]
cmp eax, 0xa
ja 0x7023797d
je 0x7023797d
call fcn.7027df20
call fcn.70201300
mov esi, eax
call fcn.70201000
xor esi, esi
cmp dword [edi + 0x1ec], esi
jne 0x702379d3
push 0x18
call fcn.702e1f8d
add esp, 4
cmp eax, esi
je 0x702379b8
mov dword [eax], vtable.CHookMouse.0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0xc], esi
jmp 0x702379ba
xor eax, eax
mov ecx, ebx
mov dword [edi + 0x1ec], eax
call fcn.7026e630
mov ecx, dword [edi + 0x1ec]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push esi
call fcn.702a9600
mov eax, dword [edi + 0x70]
lea esi, [edi + 0x70]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x70237a0a
push esi
mov dword [esi], 0
mov ecx, dword [ebx]
mov edx, dword [ecx]
push 0x703260bc
push ebx
call edx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x70237a0a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edx, dword [esi]
lea ecx, [edi + 0xc]
call fcn.702451a0
lea ebx, [esp + 0x10]
mov esi, eax
call fcn.70202630
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x70237a45
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [edi + 0xa4], 0
mov ecx, dword [edi + 0x1ec]
test ecx, ecx
je 0x70237a6f
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov esi, dword [edi + 0x1ec]
test esi, esi
je 0x70237a65
call fcn.70237ab0
mov dword [edi + 0x1ec], 0
mov eax, dword [edi + 0x38]
test eax, eax
je 0x70237a92
mov ecx, dword [edi + 0x34]
push ecx
push 0x7031c83c
call fcn.70247a10
mov dword [edi + 0x34], 0xfefefefe
mov dword [edi + 0x38], 0
lea ebx, [esp + 0x10]
call fcn.70202630
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x7023a900
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x490
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x48c], eax
mov eax, dword [esp + 0x494]
mov eax, dword [eax]
push 0
push 2
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x90]
push edx
push eax
mov dword [esp + 0x14], 0xff
call dword [sym.imp.SHLWAPI.dll_UrlGetPartW]
test eax, eax
jge 0x7023a95a
xor eax, eax
mov ecx, dword [esp + 0x48c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x490
ret 4
push ebx
push str.weibo.com
lea ebx, [esp + 0x8c]
call fcn.70216550
add esp, 4
test eax, eax
jne 0x7023ab63
push str.t.qq.com
call fcn.70216550
add esp, 4
test eax, eax
jne 0x7023ab63
push str.renren.com
call fcn.70216550
add esp, 4
test eax, eax
jne 0x7023ab63
push str.kaixin001.com
call fcn.70216550
add esp, 4
test eax, eax
jne 0x7023ab63
push eax
push 1
push 0x7036ee18
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x7023aa5e
push 0x800
call fcn.702df932
add esp, 4
mov dword [0x7036ee1c], eax
test eax, eax
je 0x7023aa5e
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x292]
push ecx
mov word [esp + 0x294], ax
call fcn.702e95e0
add esp, 0xc
push 0x7032ae18
push 0x70359d48
lea edx, [esp + 0x290]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [0x7036ee1c]
lea eax, [esp + 0x288]
push eax
push 0x400
push ecx
push 0x70326328
push str.snsxssprotect_sites
push 0x7032ae50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [0x7036ee1c]
push 2
xor edx, edx
push 0x7036ee18
mov word [eax + 0x7fe], dx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [0x7036ee18]
cmp ecx, 2
je 0x7023aa83
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x48c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x490
ret 4
push ebp
push edi
mov edi, dword [0x7036ee1c]
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0x1a]
push eax
mov word [esp + 0x1c], dx
call fcn.702e95e0
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyNW]
add esp, 0xc
push esi
lea esp, [esp]
movzx eax, word [edi]
mov esi, edi
test ax, ax
je 0x7023aad2
movzx eax, ax
lea ecx, [ecx]
cmp ax, 0x3a
je 0x7023aad2
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x7023aac0
lea ecx, [edi + 6]
cmp ecx, esi
jae 0x7023ab2b
lea edx, [edi + 0x80]
cmp edx, esi
jbe 0x7023ab2b
mov eax, edi
cmp edi, esi
jae 0x7023aafd
lea esp, [esp]
cmp word [eax], 0x2e
je 0x7023ab03
add eax, 2
cmp eax, esi
jb 0x7023aaf0
cmp word [eax], 0x2e
jne 0x7023ab2b
mov eax, esi
sub eax, edi
sar eax, 1
inc eax
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea ebx, [esp + 0x98]
call fcn.70216550
add esp, 4
test eax, eax
jne 0x7023ab5c
cmp word [esi], 0
je 0x7023ab3f
cmp word [esi + 2], 0
lea edi, [esi + 2]
jne 0x7023aab0
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x490
ret 4
mov eax, 1
jmp 0x7023ab41
mov ecx, dword [esp + 0x490]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.702e1c2f
add esp, 0x490
ret 4
Function at 0x7023c120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x703170c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, edx
mov edx, dword [0x703580e4]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0xc]
mov dword [esp + 0x24], ecx
xor esi, esi
mov ecx, 0x703580e4
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], esi
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], esi
cmp byte [0x7034d285], 0
je 0x7023c2e4
test byte [0x7036e624], 1
jne 0x7023c1b4
or dword [0x7036e624], 1
call fcn.7021b8d0
push 0x7031ac80
call fcn.702e1d65
add esp, 4
mov eax, 0x7036e628
call fcn.7021c900
test eax, eax
je 0x7023c2e4
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x244], eax
call fcn.70222e50
mov esi, eax
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [esi + 0x1c]
call fcn.70224da0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
add edx, 0x248
push edx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.7029e420
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x28]
mov esi, eax
test ebx, ebx
je 0x7023c22f
push ebx
mov ebx, dword [esp + 0x28]
call fcn.70240150
mov edx, dword [esp + 0x24]
mov ecx, dword [edi + 0x70]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
mov edx, dword [edi + 0x244]
push eax
push edx
lea ebx, [edi + 0x248]
push esi
mov esi, ebx
mov dword [esp + 0x2c], 0
call fcn.702934d0
cmp dword [esp + 0x20], 0
je 0x7023c276
mov ecx, ebx
call fcn.7029ec50
cmp dword [esp + 0x10], 0
je 0x7023c2a7
cmp dword [edi + 0x12cc], 0
je 0x7023c2a7
lea eax, [edi + 0x12b4]
call fcn.702448b0
mov eax, dword [eax]
test eax, eax
je 0x7023c2a7
push 0xffffffffffffffff
push 0
push eax
lea ecx, [edi + 0x1414]
call fcn.7020c5f0
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x7023c2cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x20], 0
jmp 0x7023c221
Function at 0x7023e3a0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x70314788
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x703548b4]
mov dword [esp + 0xc], 0
cmp eax, 0xffffffff
je 0x7023e460
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
test eax, eax
je 0x7023e3f8
mov dword [esp + ecx*4 + 0xc], eax
mov eax, dword [eax + 0x1f0]
inc ecx
cmp ecx, 1
jb 0x7023e3e4
test ecx, ecx
jbe 0x7023e460
mov esi, dword [esp + 0xc]
test esi, esi
je 0x7023e460
push 0x1438
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x7023e460
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x78]
call eax
mov edx, dword [esp + 0xc]
test eax, eax
je 0x7023e439
mov edx, 0x70326328
call fcn.7020b380
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x7023e480
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x70312e98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [0x703548b4]
mov dword [esp + 8], 0
cmp eax, 0xffffffff
je 0x7023e53d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
test eax, eax
je 0x7023e4d5
mov dword [esp + ecx*4 + 8], eax
mov eax, dword [eax + 0x1f0]
inc ecx
cmp ecx, 1
jb 0x7023e4c1
test ecx, ecx
jbe 0x7023e53d
mov esi, dword [esp + 8]
test esi, esi
je 0x7023e53d
push 0x1438
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x7023e53d
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x78]
call eax
test eax, eax
mov eax, dword [esp + 8]
push ebx
je 0x7023e517
mov eax, 0x70326328
call fcn.7020f580
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret