joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421df2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 0xc]
call fcn.00402c90
cmp eax, 0xfe
jle 0x421e63
mov dword [ebp - 0x118], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x118]
jmp 0x421f6b
lea ecx, [ebp + 0xc]
call fcn.004077f0
push eax
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x114]
push ecx
push 0x20006
push 0
mov ecx, dword [ebp - 0x124]
add ecx, 0xc
call fcn.004077f0
push eax
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x421edc
mov dword [ebp - 0x11c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x11c]
jmp 0x421f6b
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004077f0
push eax
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x421f1b
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x124]
cmp dword [ecx + 8], 0
jne 0x421f34
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x120], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4222a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x4222f6
push 0x104
push str.C:Temp
lea ecx, [ebp - 0x104]
push ecx
call fcn.00422770
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0
push 0x445a1c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x422343
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
jmp 0x422361
push 0x4496a8
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp - 0x214]
or al, 1
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x422365
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4399b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov dword [ebp - 0x118], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x114]
push eax
push 0
push 0x445a20
lea ecx, [ebp + 0xc]
call fcn.004077f0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4223e9
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x118]
or edx, 1
mov dword [ebp - 0x118], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
jmp 0x422413
push 0x4496ac
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp - 0x118]
or al, 1
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4224a7
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4224e1
cmp dword [ebp - 0x210], 0x104
jb 0x4224e8
xor al, al
jmp 0x4225d5
push 0x104
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x214], 0
je 0x422525
cmp dword [ebp - 0x214], 0x104
jb 0x42252c
xor al, al
jmp 0x4225d5
call fcn.00415a49
and eax, 0xff
test eax, eax
je 0x42255e
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x218], eax
xor eax, eax
cmp dword [ebp - 0x218], 0
setne al
jmp 0x4225d5
push 0x104
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x4225d3
cmp dword [ebp - 0x21c], 0x104
jae 0x4225d3
push 0x445a24
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x4225cf
lea edx, [ebp - 0x320]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x445a34
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x324], eax
xor eax, eax
cmp dword [ebp - 0x324], 0
setne al
jmp 0x4225d5
xor al, al
jmp 0x4225d5
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4225d9
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x104
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x422613
cmp dword [ebp - 0x108], 0x104
jb 0x42261a
xor al, al
jmp 0x4226c3
call fcn.00415a49
and eax, 0xff
test eax, eax
je 0x42264c
push 5
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10c], eax
xor eax, eax
cmp dword [ebp - 0x10c], 0
setne al
jmp 0x4226c3
push 0x104
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x4226c1
cmp dword [ebp - 0x110], 0x104
jae 0x4226c1
push str.WinInit.ini
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x4226bd
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x218], eax
xor eax, eax
cmp dword [ebp - 0x218], 0
setne al
jmp 0x4226c3
xor al, al
jmp 0x4226c3
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x422746
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
test eax, eax
jne 0x422762
mov al, 1
jmp 0x422764
xor al, al
pop ebp
ret

Function at 0x424ab5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.004137d0
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x424af1
xor eax, eax
jmp 0x424b30
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.004137d0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x424b21
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x424b30
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x424b34
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.004137d0
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x424b70
xor eax, eax
jmp 0x424bc0
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.004137d0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x424b98
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x424bc0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.004137d0
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42f840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
mov edi, ecx
jne 0x42f86f
mov eax, dword [esp + 0x10]
push eax
push 2
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
pop edi
pop esi
pop ebx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x42f88f
pop edi
pop esi
pop ebx
ret 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call fcn.0042f770
pop edi
pop esi
pop ebx
ret 8
Function at 0x432b00
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4497d0]
sub esp, 0x104
test eax, eax
jne 0x432ce1
mov eax, dword [0x4497d4]
test eax, eax
jne 0x432d18
mov eax, dword [0x4473dc]
test eax, eax
je 0x432b3e
push 0x4497b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4473dc], 0
push 0x4497b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4497d0]
test eax, eax
jne 0x432cd6
mov al, byte [0x44a2a4]
test al, al
je 0x432b79
push 0x44a2a4
lea eax, [esp + 4]
push str._sGLJPG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x432b8c
lea ecx, [esp]
push str.GLJPG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4497d0], eax
jne 0x432bbe
push 0x4497b8
mov dword [0x4497d4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadJpgFileImageData
push eax
call esi
mov dword [0x4497d8], eax
mov eax, dword [0x4497d0]
push str.LoadJpgImageDataFromMem
push eax
call esi
mov ecx, dword [0x4497d0]
push str.LoadJpgFile
push ecx
mov dword [0x4497dc], eax
call esi
mov edx, dword [0x4497d0]
push str.LoadJpgFromMem
push edx
mov dword [0x4497e0], eax
call esi
mov dword [0x4497e4], eax
mov eax, dword [0x4497d0]
push str.WriteBitmapToJpeg
push eax
call esi
mov ecx, dword [0x4497d0]
push str.WriteDibToJpeg
push ecx
mov dword [0x4497e8], eax
call esi
mov edx, dword [0x4497d0]
push str.WriteDibToJpegMEM
push edx
mov dword [0x4497ec], eax
call esi
mov dword [0x4497f0], eax
mov eax, dword [0x4497d0]
push str.GetPointerFromHandleLock
push eax
call esi
mov ecx, dword [0x4497d0]
push str.UnLockDataHandle
push ecx
mov dword [0x4497f4], eax
call esi
mov edx, dword [0x4497d0]
push str.FreeDataHandle
push edx
mov dword [0x4497f8], eax
call esi
mov ecx, dword [0x4497d8]
mov dword [0x4497fc], eax
test ecx, ecx
pop esi
je 0x432ced
mov ecx, dword [0x4497dc]
test ecx, ecx
je 0x432ced
mov ecx, dword [0x4497e0]
test ecx, ecx
je 0x432ced
mov ecx, dword [0x4497e4]
test ecx, ecx
je 0x432ced
mov ecx, dword [0x4497e8]
test ecx, ecx
je 0x432ced
mov ecx, dword [0x4497ec]
test ecx, ecx
je 0x432ced
test eax, eax
je 0x432ced
mov eax, dword [0x4497f0]
test eax, eax
je 0x432ced
mov eax, dword [0x4497f4]
test eax, eax
je 0x432ced
mov eax, dword [0x4497f8]
test eax, eax
je 0x432ced
push 0x4497b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov eax, dword [0x4497d0]
mov dword [0x4497d4], 1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4497b8
mov dword [0x4497d0], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x432d70
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x44982c]
sub esp, 0x104
test eax, eax
jne 0x432ec4
mov eax, dword [0x449830]
test eax, eax
jne 0x432efc
mov eax, dword [0x4474c0]
test eax, eax
je 0x432dae
push 0x449800
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4474c0], 0
push 0x449800
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44982c]
test eax, eax
jne 0x432eb9
mov al, byte [0x44a2a4]
test al, al
je 0x432de9
push 0x44a2a4
lea eax, [esp + 4]
push str._sGLPNG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x432dfc
lea ecx, [esp]
push str.GLPNG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x44982c], eax
jne 0x432e2e
push 0x449800
mov dword [0x449830], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadPNGFile
push eax
call esi
mov dword [0x449818], eax
mov eax, dword [0x44982c]
push str.LoadPNGFromMem
push eax
call esi
mov ecx, dword [0x44982c]
push str.WriteBmpToPNGMem
push ecx
mov dword [0x44981c], eax
call esi
mov edx, dword [0x44982c]
push str.WriteBmpToPNGFile
push edx
mov dword [0x449820], eax
call esi
mov dword [0x449824], eax
mov eax, dword [0x44982c]
push str.WriteImageDataToPNGMem
push eax
call esi
mov ecx, dword [0x449818]
mov dword [0x449828], eax
test ecx, ecx
pop esi
je 0x432ed0
mov ecx, dword [0x44981c]
test ecx, ecx
je 0x432ed0
mov ecx, dword [0x449820]
test ecx, ecx
je 0x432ed0
mov ecx, dword [0x449824]
test ecx, ecx
je 0x432ed0
test eax, eax
je 0x432ed0
push 0x449800
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov ecx, dword [0x44982c]
mov dword [0x449830], 1
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x449800
mov dword [0x44982c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x432f70
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x439fc8
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
mov edx, dword [esp + 0x14]
sub esp, 0x40
lea ecx, [esp]
push ebp
push esi
push eax
mov eax, dword [esp + 0x5c]
push 0x40
push ecx
push 0x449720
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x432fc8
mov eax, dword [esp + 0x60]
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
xor ebp, ebp
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], ebp
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x64]
cmp dword [eax - 8], 2
jge 0x43301f
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x64]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x433079
mov edx, dword [esp + 0x64]
push edx
call fcn.004326a0
mov esi, eax
mov ecx, eax
and esi, 0xff
and eax, 0xff00
shl esi, 0x10
sar ecx, 0x10
add esi, ecx
add esp, 4
lea ecx, [esp + 0x64]
add esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov esi, dword [esp + 0x64]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
push edi
push esi
call ebx
mov dword [esp + 0x68], eax
mov al, byte [esi]
add esp, 4
xor edi, edi
test al, al
je 0x4330a3
cmp al, 0x2c
je 0x4330a3
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x433097
cmp byte [esi], 0x2c
jne 0x4330d1
inc esi
push esi
call ebx
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x4330c3
cmp al, 0x2c
je 0x4330c3
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4330b7
cmp byte [esi], 0x2c
jne 0x4330d1
inc esi
push esi
call ebx
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x6c]
shl edi, 8
add edi, ebp
mov dword [esp + 0x58], 0xffffffff
shl edi, 8
add edi, eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x433110
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x439fe8
push eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x40
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x54]
push 0x40
push ecx
push 0x449720
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp]
test al, al
je 0x4331be
push ebx
push esi
push edi
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0
push ecx
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0x68]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push esi
call edi
mov ebx, dword [esp + 0x68]
add esp, 4
mov dword [ebx], eax
mov al, byte [esi]
test al, al
je 0x43319b
cmp al, 0x2c
je 0x43319b
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x43318f
cmp byte [esi], 0x2c
jne 0x4331aa
inc esi
push esi
call edi
add esp, 4
mov dword [ebx + 4], eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x401174
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push dword [0x4ada24]
push str.http:__qqpet.wapsns.3g.qq.com_qqpet_fcgi_bin_phone_pet_sid
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, str.User_Agent:_Mozilla_5.0__iPhone__U__CPU_OS_4_2_1_like_Mac_OS_X__AppleWebKit_532.9__KHTML__like_Gecko__Version_5.0.3_Mobile_8B5097d_Safari_6531.22.7
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004013b6
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4011fd
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40120d
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40121d
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40122d
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40123d
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40124d
push ebx
call fcn.0040ae52
add esp, 4
lea eax, [ebp - 0x20]
push eax
call fcn.00402893
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x401269
push ebx
call fcn.0040ae52
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [0x4ada20]
test ebx, ebx
je 0x401280
push ebx
call fcn.0040ae52
add esp, 4
pop eax
mov dword [0x4ada20], eax
mov eax, 0x487dbc
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, 0x487dbe
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x4ada20
call fcn.00403156
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4012bb
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4012cb
push ebx
call fcn.0040ae52
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4012df
push ebx
call fcn.0040ae52
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push 0x12
push 0x16011567
push 0x52010001
call fcn.0040ae5e
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40134b
push 0x487dc5
push dword [ebp - 4]
call fcn.004010d7
add esp, 8
cmp eax, 0
jne 0x401329
call fcn.004033a8
jmp 0x401346
push 0
push 0
push 0xffffffffffffffff
push 6
push 0x16011563
push 0x52010001
call fcn.0040ae64
add esp, 0x18
jmp 0x40134b
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40135b
push ebx
call fcn.0040ae52
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4033a8
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor ecx, ecx
lea eax, [ebp - 4]
mov ebx, eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, 0x1b
jg 0x40357a
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x40c120
call fcn.0040ae58
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x487fac
push dword [ebp - 0xc]
push str.g_f0cmd5courseid
push dword [0x4ada28]
push str.petid
push dword [0x4ada24]
push str.http:__qqpet.wapsns.3g.qq.com_qqpet_fcgi_bin_phone_pet_sid
mov ecx, 7
call fcn.0040107b
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x403436
push ebx
call fcn.0040ae52
add esp, 4
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
push 1
mov eax, str.User_Agent:_Mozilla_5.0__iPhone__U__CPU_OS_4_2_1_like_Mac_OS_X__AppleWebKit_532.9__KHTML__like_Gecko__Version_5.0.3_Mobile_8B5097d_Safari_6531.22.7
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004013b6
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x403494
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x4034a4
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x4034b4
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4034c4
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4034d4
push ebx
call fcn.0040ae52
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4034e4
push ebx
call fcn.0040ae52
add esp, 4
lea eax, [ebp - 0x28]
push eax
call fcn.00402893
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x403500
push ebx
call fcn.0040ae52
add esp, 4
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403514
push ebx
call fcn.0040ae52
add esp, 4
pop eax
mov dword [ebp - 8], eax
push closesocket
push 0
push 0
push 0
push 0
push 0
push getpeername
push 0
push 0x487fd4
push getpeername
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x403549
mov eax, 0x487dfd
push eax
push 4
mov ebx, 0x40b450
call fcn.0040ae58
add esp, 0x34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x403573
call fcn.00403599
jmp 0x40357a
pop ebx
pop ecx
jmp 0x4033c6
add esp, 8
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40358d
push ebx
call fcn.0040ae52
add esp, 4
mov esp, ebp
pop ebp
ret