joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e50b70
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305f540
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov ebp, ecx
cmp edi, ebx
jne 0x12e50bad
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
push esi
push edi
lea ecx, [esp + 0x30]
xor esi, esi
call fcn.12f46b50
push 0x5c
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], ebx
call fcn.12f484a0
cmp eax, 0xffffffff
je 0x12e50c38
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
call fcn.12f49a30
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 1
call fcn.12f47480
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.12f472f0
mov edx, dword [esp + 0x2c]
push ebx
lea ecx, [esp + 0x18]
push ebx
push ecx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x12e50c38
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0x1c]
cmp eax, ecx
ja 0x12e50c36
jb 0x12e50c2f
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
cmp ecx, eax
jae 0x12e50c36
mov esi, 1
jmp 0x12e50c38
xor esi, esi
cmp dword [0x13199068], ebx
je 0x12e50c55
push edi
push esi
add ebp, 0x50
push str.CLocalBackupFileMgr::IsDriveSpaceNotEnough___d___s_
push ebp
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.12f472f0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x12e52790
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305f7a8
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
je 0x12e527e2
mov edi, dword [esp + 0x20]
cmp edi, ebx
je 0x12e527e2
push eax
lea ecx, [esp + 0x20]
call fcn.12f41810
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
jne 0x12e527f6
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.12f41f70
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e5282e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x12e52825
mov ebx, 1
jmp 0x12e52827
mov dword [edi], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.12f41f70
mov ecx, dword [esp + 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x12e562a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305fcd0
push eax
mov eax, dword [0x131b6170]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
je 0x12e562db
mov eax, dword [0x131b616c]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x34
ret
mov esi, 1
lea ecx, [esp + 0xc]
mov dword [0x131b6170], esi
mov dword [0x131b616c], ebx
call fcn.12e9bf00
push esi
push ebx
push ecx
mov dword [esp + 0x44], ebx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hookapi_sslmail_ctrl
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call fcn.12e9c110
lea ecx, [esp + 0xc]
call fcn.12e9c180
test eax, eax
je 0x12e56346
lea ecx, [esp + 0xc]
call fcn.12e9c670
cmp eax, esi
jne 0x12e5633b
mov dword [0x131b616c], esi
jmp 0x12e56346
cmp eax, 2
jne 0x12e56346
mov dword [0x131b616c], ebx
mov eax, dword [0x13199068]
cmp eax, ebx
je 0x12e56369
mov eax, dword [0x131b616c]
push eax
push str.CMailCtrlModeMgr::IsHookAPISSLCtrl___d_
push str.MailLog
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov esi, dword [0x131b616c]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret

Function at 0x12e57290
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push ebp
mov dword [esp + 0xc], eax
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x12e572be
push ebx
call fcn.12f5c51d
add esp, 4
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x12e572d3
push ebp
call fcn.12f5c51d
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add edx, ecx
lea edi, [edx + edx + 0x10]
push edi
call fcn.12f5c05b
mov esi, eax
add esp, 4
test esi, esi
jne 0x12e572f8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
mov eax, esi
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x12e5733a
mov edx, dword [esi]
lea eax, [esi + 0xc]
push edx
push ebx
push eax
call fcn.12f5c57b
add esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x12e57356
mov edx, dword [esi]
mov ecx, dword [esi + 4]
push ecx
push ebp
lea eax, [esi + edx*2 + 0xe]
push eax
call fcn.12f5c57b
add esp, 0xc
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
push 0
push esi
push 0x12e57260
push 0
mov dword [esi + 8], ecx
push 0
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x12e5738a
mov edx, dword [esp + 0x20]
mov dword [ecx], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x12e57d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, 0x131b63a8
jmp 0x12e57d30
push 0xffffffffffffffff
push 0x1305fd50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.12f55c40
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
call fcn.12f55c40
mov byte [esp + 0x18], 2
mov dword [esi + 0x58], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], edi
mov eax, dword [0x1307d24c]
lea ebx, [esi + 0x6c]
mov byte [esp + 0x18], 3
mov dword [ebx], eax
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 4
call fcn.12f4cc70
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 5
call fcn.12d96680
push 0x131912a8
mov ecx, ebx
mov byte [esp + 0x1c], 6
call fcn.12f47570
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], edi
mov dword [esi], edi
mov eax, esi
pop edi
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x12e57f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1305fde0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.12e9bf00
push 1
push 0
push ecx
mov dword [esp + 0x44], 0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hookapi_mstsc_doclog_disable
call fcn.12f46b50
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 0
call fcn.12e9c110
lea ecx, [esp + 0xc]
call fcn.12e9c180
test eax, eax
je 0x12e57f8f
lea ecx, [esp + 0xc]
call fcn.12e9c670
cmp eax, 1
jne 0x12e57f8f
mov esi, eax
jmp 0x12e57f91
xor esi, esi
mov dword [edi], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.12e9c070
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret
Function at 0x12e58010
Capabilities:
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305fe00
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x12e580e4
mov eax, dword [esi + 4]
test eax, eax
je 0x12e580e4
mov eax, dword [esi + 0x6c]
lea edi, [esi + 0x6c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x12e580e4
lea ecx, [esi + 0x38]
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.12f56170
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x58]
mov dword [esp + 0x28], 0
call fcn.12e5a1f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.12f561d0
push edi
lea edx, [esp + 0xc]
push str.TEC_MSTSC_IP
push edx
call fcn.12f47c40
mov eax, dword [esp + 8]
mov dword [esp + 0x20], 1
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push 0
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [0x13199068]
test eax, eax
je 0x12e580d3
mov ecx, dword [esp + 8]
push ecx
push str.SetIPtoClipBoard___s_
push str.MstscDoc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.12f472f0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x12e5b2d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
push edi
push 2
push 0
push 0xffffffffffffffb8
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x54]
push 0
push eax
lea ecx, [esp + 0x10]
push 0x48
push ecx
push esi
mov dword [esp + 0x68], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
test eax, eax
jne 0x12e5b322
add esp, 0x48
ret
cmp dword [esp + 0x4c], 0x48
jae 0x12e5b32f
xor eax, eax
add esp, 0x48
ret
push 0x10
lea edx, [esp + 4]
push str._TOSDEX_End__
push edx
call fcn.12f5e6c0
add esp, 0xc
neg eax
sbb eax, eax
inc eax
add esp, 0x48
ret
Function at 0x12e5dc30
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x13060238
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov edx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
test esi, esi
push edi
je 0x12e5dd39
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], eax
lea esi, [edx + 0x334]
lea ebx, [edx + 0x33c]
lea eax, [edx + 0x330]
push esi
add edx, 0x338
push eax
mov dword [esp + 0x2c], ecx
push edx
push ebx
mov ecx, 0x131bca88
call fcn.12e83960
mov ebp, dword [esi]
cmp ebp, 0x64
jbe 0x12e5dcbc
mov ebp, 0x64
test ebp, ebp
mov dword [esp + 0x40], 0
jbe 0x12e5dd39
mov eax, dword [0x13199068]
test eax, eax
je 0x12e5dd0f
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.12ebef80
add esp, 8
mov edx, dword [eax]
mov dword [esp + 0x38], 0
push edx
push str.CPolicyClsidsMsg::IsLocalIPv6___s_
push str.SCDTNWRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.12f472f0
test ebx, ebx
je 0x12e5dd29
mov ecx, 4
mov edi, ebx
lea esi, [esp + 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
sete al
test eax, eax
jne 0x12e5dd50
mov eax, dword [esp + 0x40]
add ebx, 0x14
inc eax
cmp eax, ebp
mov dword [esp + 0x40], eax
jb 0x12e5dcc8
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov eax, 1
jmp 0x12e5dd3b

Function at 0x12e60880
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x13197850]
push esi
push edi
cmp eax, 0xfe000
mov esi, ecx
mov edi, 0x100000
jbe 0x12e6089b
lea edi, [eax + 0x100000]
mov ecx, dword [0x13199068]
test ecx, ecx
je 0x12e608c6
mov ecx, dword [esi + 0x38]
mov edx, dword [0x1319784c]
push ecx
push edi
push eax
push edx
push str.CPolicyThread::CreatePolicyThread__Stack____08x__08x__08x___m_bStartThread:_08x_
push str.PolicyThread
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x1c
call fcn.12f9c640
test eax, eax
je 0x12e608ec
lea eax, [esi + 4]
push eax
push 0x10000
push esi
push 0x12e61150
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop edi
pop esi
ret
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x12e61150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop edi
pop esi
ret
Function at 0x12e60c60
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x12e60d5c
mov eax, dword [esi + 8]
test eax, eax
je 0x12e60d5c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call edi
mov edx, dword [esi + 0x14]
mov ecx, dword [esi]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 2
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [0x13199068]
test eax, eax
je 0x12e60cd9
mov ecx, dword [esi + 4]
push ebx
push ecx
push str.CPolicyThread::KillThread__tid___08x__08x______Terminate
push str.PolicyThread
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov edx, dword [esi]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x12e60d1b
mov eax, dword [0x13199068]
test eax, eax
je 0x12e60d10
mov eax, dword [esi + 4]
push ebx
push eax
push str.CPolicyThread::KillThread__tid___08x__08x________
push str.PolicyThread
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebp
call edi
mov edx, dword [esi + 8]
mov ebp, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
mov edi, eax
call ebp
mov eax, dword [esi + 0xc]
push eax
call ebp
mov eax, dword [0x13199068]
pop ebp
test eax, eax
je 0x12e60d5c
mov ecx, dword [esp + 0xc]
sub edi, ecx
mov ecx, dword [esi + 4]
push edi
push ebx
push ecx
push str.CPolicyThread::KillThread__tid___08x__08x___tick___d_
push str.PolicyThread
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x12e63b20
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push esi
push edi
xor edi, edi
mov esi, 0x2001f
mov dword [esp + 8], edi
call fcn.12f9c520
test eax, eax
je 0x12e63b3c
mov esi, 0x2021f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push esi
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x12e63ba9
mov eax, dword [esp + 8]
cmp eax, edi
je 0x12e63ba9
cmp dword [esp + 0x24], edi
je 0x12e63b81
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
inc ecx
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 1
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x12e63b8d
mov edx, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, edi
jne 0x12e63b96
mov edi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ecx
ret 0x18
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x18
Function at 0x12e674b0
Capabilities:
Copy file

Disassembly:
sub esp, 0x210
mov eax, 1
push ebx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov eax, dword [0x13199068]
xor ebx, ebx
push ebp
push esi
mov esi, dword [esp + 0x220]
cmp eax, ebx
push edi
je 0x12e67581
cmp esi, ebx
je 0x12e67691
mov ebp, dword [esp + 0x238]
cmp ebp, 9
ja 0x12e67581
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.12f5c51d
mov edi, eax
add esp, 4
cmp edi, 4
jle 0x12e67581
lea eax, [edi + 2]
cmp eax, 0x104
jae 0x12e67581
lea ecx, [edi - 4]
lea edx, [esp + 0x18]
push ecx
push esi
push edx
call fcn.12f5c57b
add esp, 0xc
lea eax, [esi + edi*2 - 8]
lea ecx, [esp + edi*2 + 0x10]
push eax
push ebp
push str.__d_s
push ecx
call fcn.12f5cfbf
add esp, 0x10
lea edx, [esp + 0x18]
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [0x13199068]
test ecx, ecx
je 0x12e6757f
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push str.CQQSnapEncodeCom::EncodeInt__Back____d____s_______s_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
xor ebx, ebx
test esi, esi
je 0x12e67691
mov eax, dword [esp + 0x228]
test eax, eax
je 0x12e67691
mov eax, dword [esp + 0x22c]
mov ebp, dword [esp + 0x230]
test eax, eax
je 0x12e67698
mov edx, ebp
and edx, 0x10
cmp dl, 0x10
jne 0x12e675d8
mov eax, dword [esp + 0x234]
test eax, eax
je 0x12e67698
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
jmp 0x12e67698
push esi
call fcn.12e67890
mov edi, eax
mov eax, dword [esp + 0x230]
add esp, 4
cmp eax, 1
jne 0x12e67642
mov eax, dword [esp + 0x228]
push eax
push esi
call fcn.12e67700
add esp, 8
test eax, eax
je 0x12e6768a
test edi, edi
jne 0x12e6768a
mov ecx, ebp
and ecx, 4
cmp cl, 4
jne 0x12e67629
push 1
push esi
call fcn.12e677d0
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x12e67698
mov edx, ebp
and edx, 1
cmp dl, 1
jne 0x12e6767a
push esi
call fcn.12e67940
add esp, 4
mov dword [esp + 0x14], eax
jmp 0x12e6767a
cmp eax, 2
jne 0x12e6768a
test edi, edi
je 0x12e6768a
mov eax, ebp
and eax, 2
cmp al, 2
jne 0x12e67661
push esi
call fcn.12e679a0
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, ebp
and ecx, 8
cmp cl, 8
jne 0x12e67682
push 0
push esi
call fcn.12e677d0
add esp, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12e67698
mov eax, dword [esp + 0x14]
test eax, eax
je 0x12e67698
mov ebx, 1
jmp 0x12e67698
mov ebp, dword [esp + 0x230]
mov eax, dword [0x13199068]
test eax, eax
je 0x12e676ec
mov eax, dword [esp + 0x234]
test eax, eax
jne 0x12e676b1
mov eax, 0x130c8c0c
test esi, esi
jne 0x12e676ba
mov esi, 0x130c8c0c
mov edx, dword [esp + 0x22c]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x22c]
push ebp
push edx
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
push edx
push ebx
push str.CQQSnapEncodeCom::EncodeInt___d____d__d____s____08x__08x____08x____s_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x2c
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x12e67700
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
push ebx
xor ebx, ebx
push esi
cmp eax, 1
push edi
jne 0x12e677af
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], bx
mov esi, dword [esp + 0x218]
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push esi
push eax
call fcn.12f5c57b
add esp, 0xc
lea ecx, [esp + 0xc]
push 0x1311b1c8
push ecx
call fcn.12f5c51d
add esp, 4
lea edx, [esp + eax*2 + 0xa]
push edx
call fcn.12f5c95f
lea eax, [esp + 0x14]
push eax
push esi
call fcn.12d93c00
add esp, 0x10
test eax, eax
je 0x12e677c3
push 1
lea ecx, [esp + 0x10]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
mov eax, dword [0x13199068]
cmp eax, ebx
je 0x12e677a3
push esi
push edi
push str.CQQSnapEncodeCom::PngToJpg___d____s_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x208
ret
cmp eax, 2
jne 0x12e677c3
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x12e677d0
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], bx
mov esi, dword [esp + 0x218]
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push esi
push eax
call fcn.12f5c57b
add esp, 0xc
lea ecx, [esp + 0xc]
push str.tmp2
push ecx
call fcn.12f5c51d
add esp, 4
lea edx, [esp + eax*2 + 0xa]
push edx
call fcn.12f5c95f
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
call fcn.12d93c20
add esp, 0x14
test eax, eax
je 0x12e6787a
push 1
lea edx, [esp + 0x10]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
mov eax, dword [0x13199068]
cmp eax, ebx
je 0x12e6786e
push esi
push edi
push str.CQQSnapEncodeCom::JpgConver___d____s_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x208
ret
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x12e67a50
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x12e67b32
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x12e67b32
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x12e67b32
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov ebp, SysReAllocStringLen
test ecx, ecx
jne 0x12e67a8e
mov ebp, 0xc0000000
push 0
push 0
push 3
push 0
push 3
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e67b05
mov edi, dword [esp + 0x28]
mov ebx, 1
test edi, edi
jbe 0x12e67ad4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp edi, eax
jae 0x12e67ad4
push 0
sub eax, edi
push 0
push eax
push esi
mov ebx, 2
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
test eax, eax
mov eax, dword [esp + 0x24]
push eax
push ecx
push edx
push esi
je 0x12e67af6
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x12e67afc
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x13199068]
test eax, eax
je 0x12e67b2b
mov eax, dword [esp + 0x14]
push ebp
push esi
push eax
push ebx
push edi
push str.CQQSnapEncodeCom::DealSnapFile______d___pos:__d____s____08x____08x_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
ret

Function at 0x12e6b7e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131b8078
jmp 0x12e6b810
push 0xffffffffffffffff
push 0x13060899
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.12f55c40
xor ebp, ebp
lea edi, [esi + 0x24]
mov dword [esp + 0x28], ebp
mov dword [edi], ebp
mov dword [edi + 0xc], ebp
mov dword [edi + 8], ebp
mov dword [edi + 4], ebp
mov byte [esp + 0x28], 1
mov dword [esi + 0x34], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x38], ebp
push 1
mov byte [esp + 0x2c], 2
push ebx
lea ecx, [esp + 0x1c]
mov dword [esi], 0x13079f04
call fcn.12f56170
push 0xffffffffffffffff
push ebp
mov ecx, edi
mov byte [esp + 0x30], 3
call fcn.12e6c5d0
mov eax, dword [esi + 0x34]
cmp eax, ebp
je 0x12e6b89a
push eax
call fcn.12f5c050
add esp, 4
mov dword [esi + 0x34], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x38], ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.12f561d0
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], ebp
mov eax, esi
pop edi
pop esi
mov dword [esp + 0x20], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret