joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443720
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
push 0
push 0
mov edi, ecx
push 0
push 0x3e7
lea eax, [esp + 0x28]
push edi
push eax
lea esi, [edi + 0x7cd0]
push 0x50800000
push 0x4500bc
push 0x4475e0
mov ecx, esi
mov dword [esp + 0x3c], 0x1cc
mov dword [esp + 0x40], 0xf0
mov dword [esp + 0x44], 0x2b2
mov dword [esp + 0x48], 0x21c
call sub.MFC42.DLL_CWnd::CreateControl
push 7
push 0x11
mov ecx, esi
call fcn.00434c20
push 1
mov ecx, esi
call fcn.00434990
lea ecx, [edi + 0x7dac]
push ecx
mov ecx, esi
call fcn.00434a20
push 0x3c747b
push 6
mov ecx, esi
call fcn.00434c20
push 0
push 5
mov ecx, esi
call fcn.00434c20
push 0xa16606
push 0xc
mov ecx, esi
call fcn.00434c20
push 0x3c747b
push 4
mov ecx, esi
call fcn.00434c20
push 0
push 3
mov ecx, esi
call fcn.00434c20
push 0xff
push 0xe
mov ecx, esi
call fcn.00434c20
push 0xff
push 9
mov ecx, esi
call fcn.00434c20
push 0x85ab9b
push 0xf
mov ecx, esi
call fcn.00434c20
lea edx, [esp + 0x28]
mov eax, 0xa
push edx
mov ecx, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x3e8
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 0x1e
mov dword [esp + 0x2c], eax
call fcn.00434ae0
lea eax, [esp + 0xc]
push eax
call fcn.0043dae6
add esp, 4
push str.picplayerlisttitle_bg.bmp
mov dword [esp + 0x48], 0
push eax
lea ecx, [esp + 0x10]
push ecx
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 2
call fcn.00434c50
lea eax, [esp + 0x14]
push eax
call fcn.0043dae6
add esp, 4
push str.picplayerlisttitle_line.bmp
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x50], 3
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 1
call fcn.00434c50
push 0x12
push 0
push 0x4500bc
mov ecx, esi
call fcn.00434b00
push 0x3c
push 0x44f0a4
mov ecx, esi
call fcn.00434790
push 0x3c
push 0x44f09c
mov ecx, esi
call fcn.00434760
push 0x3c
push 0x44f094
mov ecx, esi
call fcn.00434790
push 0x3c
push 0x44f08c
mov ecx, esi
call fcn.00434760
push 0x3c
push 0x44f084
mov ecx, esi
call fcn.00434760
push 0x3c
push 0x44f078
mov ecx, esi
call fcn.00434790
push 2
push 3
mov ecx, esi
call fcn.00434ab0
mov ecx, esi
call fcn.004347f0
push 4
mov ecx, esi
call fcn.00434b50
push 1
mov ecx, esi
call fcn.00434b70
push esi
lea ecx, [edi + 0x7d10]
call fcn.00434ee0
push 0xd200a3
push str.__s10_
mov ecx, esi
call fcn.004349b0
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x42a370
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, ecx
push eax
mov ecx, 0x450840
call fcn.00425a30
mov esi, eax
test esi, esi
jne 0x42a38e
pop edi
pop esi
ret 8
test byte [esi + 0x20], 0x40
je 0x42a3a8
mov ecx, dword [esi]
add edi, 0x7cd0
push 4
push ecx
mov ecx, edi
call fcn.004348f0
jmp 0x42a3ba
mov edx, dword [esi]
add edi, 0x7cd0
push 4
push edx
mov ecx, edi
call fcn.00434920
mov eax, dword [esi + 0x20]
push 3
test eax, 0x10000000
je 0x42a3d2
mov eax, dword [esi]
mov ecx, edi
push eax
call fcn.004348f0
jmp 0x42a3dc
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.00434920
mov eax, dword [esi + 0x20]
push 2
test eax, 0x20000000
je 0x42a3f4
mov edx, dword [esi]
mov ecx, edi
push edx
call fcn.004348f0
jmp 0x42a3fe
mov eax, dword [esi]
mov ecx, edi
push eax
call fcn.00434920
mov eax, dword [esi + 0x20]
push 8
test eax, 0x40000000
je 0x42a416
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.004348f0
jmp 0x42a420
mov edx, dword [esi]
mov ecx, edi
push edx
call fcn.00434920
mov eax, dword [esi + 0x20]
push 8
test eax, 0x80000000
je 0x42a440
mov eax, dword [esi]
mov ecx, edi
push eax
call fcn.004348f0
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.00434920
pop edi
mov eax, 1
pop esi
ret 8

Function at 0x42adf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4437e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
xor eax, eax
mov dword [esp], eax
mov dword [esp], 0x10
mov dword [esp + 4], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], edx
call fcn.004357d0
lea eax, [esp]
push 2
push eax
push 0x10
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
call fcn.00435850
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x450838
call fcn.00435710
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00435810
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x42c8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp], eax
push esi
mov dword [esp + 8], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xe
call fcn.004357d0
lea edx, [esp + 4]
push 0xffffffffffffffff
push edx
push 0xe
push 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0
call fcn.00435850
lea eax, [esp + 0x10]
mov ecx, 0x450838
push eax
call fcn.00435710
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00435810
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x434f50
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x443e20
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
lea ebx, [esi + 0x14]
sub eax, ecx
jne 0x434f9f
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x24]
sub ecx, eax
jne 0x434f9f
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esi]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [esi + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub ecx, eax
push 1
push ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
lea edi, [esi + 0x44]
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
push ebx
mov ebx, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
call ebx
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x447780
lea ecx, [esi + 0x24]
mov dword [esp + 0x2c], 0
push ecx
call ebx
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, edx
test edi, edi
jne 0x435043
xor ecx, ecx
jmp 0x435046
mov ecx, dword [edi + 4]
mov edx, dword [esi + 0x48]
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CombineRgn]
test edi, edi
je 0x43505b
mov edi, dword [edi + 4]
mov eax, dword [esi]
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov ecx, dword [esi]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0xc], 0x445aec
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4362d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x443ef6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x18
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi], 0x4478a0
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x436338
mov ecx, eax
call fcn.004380e0
jmp 0x43633a
xor eax, eax
push 0x54
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 4], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x14], 1
je 0x43637c
mov ecx, eax
call fcn.0043a5f0
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x436770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x443f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea edx, [esp + 8]
push str._s_s
push edx
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
add esp, 0x10
push eax
push ecx
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x436e00
Capabilities:
Get file version info

Disassembly:
sub esp, 0x214
push ebx
push ebp
mov ebp, dword [esp + 0x220]
mov ebx, ecx
test ebp, ebp
mov dword [esp + 0xc], ebx
je 0x436fe6
mov eax, dword [esp + 0x224]
mov ecx, dword [ebp + 4]
cmp eax, ecx
jne 0x436fe6
push esi
push edi
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x436e74
mov esi, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea edx, [esp + 0x1c]
push 0x5c
push edx
call esi
add esp, 8
test eax, eax
je 0x436e60
mov byte [eax], 0
lea eax, [esp + 0x1c]
push 0x5c
push eax
call esi
add esp, 8
test eax, eax
je 0x436e74
mov byte [eax + 1], 0
lea ecx, [esp + 0x120]
push 0x104
push ecx
lea edx, [esp + 0x24]
push str.QQGame.exe
push edx
call fcn.00436770
add esp, 0x10
xor esi, esi
lea eax, [esp + 0x120]
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x436fa5
lea ecx, [edi + 1]
push ecx
call sub.MFC42.DLL_operatornew
mov ebp, eax
xor eax, eax
add esp, 4
cmp ebp, eax
mov byte [edi + ebp], 0
je 0x436f9e
push ebp
push edi
lea edx, [esp + 0x128]
push eax
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x436f59
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x44fce4
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x436f59
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
mov esi, eax
and eax, 0xffff
mov ecx, edi
mov ebx, eax
shr ecx, 0x10
mov eax, 0x51eb851f
mul ecx
shr edx, 5
shr esi, 0x10
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
shl eax, 2
sub ecx, eax
lea eax, [esi + esi*4]
and edi, 0xffff
lea eax, [eax + eax*4]
lea eax, [ebx + eax*4]
mov ebx, dword [esp + 0x14]
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [ecx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [edi + eax*4]
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
cmp esi, 0x13154e8
jl 0x436f9e
mov edx, dword [esp + 0x22c]
mov eax, dword [ebx + 0x24]
push edx
mov edx, dword [esp + 0x22c]
mov ecx, dword [eax]
mov edx, dword [edx]
push edx
push str._ii_
push 0xa
push eax
call dword [ecx + 0x1c]
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
mov ebp, dword [esp + 0x228]
mov edx, dword [esp + 0x22c]
mov eax, dword [ebx + 0x24]
push edx
push 0x44fcd8
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x1c]
mov edx, dword [ebp]
mov eax, dword [ebx + 0x24]
add esp, 0x10
mov ecx, dword [eax]
push edx
push 0x44fcd8
push 4
push eax
call dword [ecx + 0x1c]
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
pop ebp
xor al, al
pop ebx
add esp, 0x214
ret 8
Function at 0x43cd10
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x43cdd2
mov eax, dword [0x4509c0]
test eax, eax
jbe 0x43cdd2
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x110]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [0x4509c0]
lea edx, [esp + 0x10c]
push ecx
push edx
push str._sTencentQQGameusers_ugamecomm.ini
lea eax, [esp + 0x14]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0043ced0
lea edx, [esp + 8]
push edx
push 0
push str.panelpage
push str.sprit
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push eax
mov ecx, esi
call fcn.0043c110
mov dword [esi + 4], 0
pop edi
pop esi
add esp, 0x208
ret

Function at 0x43cde0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4509c0]
sub esp, 0x30c
test eax, eax
push esi
mov esi, ecx
jbe 0x43cec6
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
lea eax, [esp + 0x114]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [0x4509c0]
mov ebp, dword [sym.imp.MSVCRT.dll__snprintf]
lea edx, [esp + 0x110]
push ecx
push edx
push str._sTencentQQGameusers_ugamecomm.ini
lea eax, [esp + 0x18]
push 0x103
push eax
call ebp
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0043ced0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
mov edx, dword [esi + 0x4c]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push 0x44e070
lea eax, [esp + 0x21c]
push 0x103
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0xc]
lea edx, [esp + 0x214]
push ecx
push edx
push str.panelpage
push str.sprit
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop ebp
pop esi
add esp, 0x30c
ret
Function at 0x43ced0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x118]
push 0x103
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
mov ebp, dword [sym.imp.MSVCRT.dll__access]
mov ebx, dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 0xc
lea edi, [esp + 0x10]
push 0x5c
push edi
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x43cf36
push 0x2f
push edi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x43cf76
lea edx, [esp + 0x10]
push 0
push edx
mov byte [esi], 0
call ebp
add esp, 8
test eax, eax
je 0x43cf5b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
test eax, eax
jne 0x43cf67
test esi, esi
mov byte [esi], 0x5c
lea edi, [esi + 1]
je 0x43cf76
jmp 0x43cf1a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret 4

Function at 0x43ddcf
Capabilities:
Get file version info

Disassembly:
mov eax, 0x444370
call fcn.004416c0
sub esp, 0x24
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [ebp - 0x18]
mov esi, eax
call sub.MFC42.DLL_CString::CString_2
cmp esi, edi
mov byte [ebp - 4], 1
jne 0x43de06
or esi, 0xffffffff
jmp 0x43de89
lea eax, [esi + 2]
push ebx
push eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x10], eax
push eax
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x44fce4
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x14]
push 0x64
xor edx, edx
pop ebx
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, eax
mov edi, ecx
and eax, 0xffff
push dword [ebp - 0x10]
shr edi, 0x10
mov dword [ebp - 0x2c], eax
mov eax, edi
div ebx
and ecx, 0xffff
shr esi, 0x10
mov dword [ebp - 0x20], ecx
mov ebx, eax
imul eax, eax, 0x64
sub edi, eax
call sub.MFC42.DLL_operatordelete
imul esi, esi, 0x64
add esi, dword [ebp - 0x2c]
pop ecx
lea eax, [esi + esi*4]
lea esi, [ebx + eax*2]
pop ebx
imul esi, esi, 0x64
add esi, edi
imul esi, esi, 0x64
add esi, dword [ebp - 0x20]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x43fb50
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x4666e8]
sub esp, 0x208
cmp dword [eax + 0x1c], 0x2710
ja 0x43fbca
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4666dc]
pop edi
test eax, eax
jne 0x43fb8a
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push str._s....configDynamicInfo.ini
lea ecx, [esp + 8]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [0x4666e8]
add esp, 0x10
lea edx, [esp]
mov ecx, dword [eax + 0x1c]
push edx
push ecx
push str.LastQQUin
push str.Public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [0x4666e8]
mov dword [edx + 0x1c], eax
add esp, 0x208
ret
Function at 0x4402f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x94
xor eax, eax
mov edx, dword [esp + 0x98]
mov dword [esp + 9], eax
push ebx
mov dword [esp + 0x11], eax
mov ebx, ecx
mov ecx, dword [esp + 0xa8]
mov word [esp + 0x15], ax
mov byte [esp + 0x17], al
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], ecx
test eax, eax
mov dword [esp + 0x14], edx
je 0x440436
mov eax, dword [str.EPIPEMAGQQ]
mov ecx, dword [0x450044]
mov dx, word [0x450048]
mov dword [esp + 0x18], eax
mov al, byte [0x45004a]
push ebp
push esi
push edi
mov dword [esp + 0x28], ecx
mov byte [esp + 0x2e], al
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x2f]
mov word [esp + 0x2c], dx
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x24]
lea esi, [ebx + 0x24]
stosb byte es:[edi], al
mov edi, dword [esp + 0xac]
mov ecx, esi
push edi
call dword [edx]
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0xb4]
lea edx, [esp + 0x28]
push ebp
push edx
push edi
push ecx
mov ecx, esi
call dword [eax + 4]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [ebx + 0x10]
lea eax, [esp + 0x14]
push esi
mov dword [esp + 0x20], edx
mov edx, dword [ebx + 8]
push eax
lea ecx, [esp + 0x20]
push 0xc
push ecx
push edx
call edi
test eax, eax
jne 0x44040e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc
push eax
mov ecx, ebx
call fcn.00440470
cmp eax, 1
jne 0x44042a
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 8]
lea eax, [esp + 0x14]
push esi
push eax
push ecx
push ebp
push edx
call edi
test eax, eax
jne 0x440417
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.00440470
jmp 0x44042a
cmp dword [esp + 0x14], 0xc
je 0x4403e3
jmp 0x440423
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
je 0x44042a
mov ecx, ebx
call fcn.004404c0
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x10

Function at 0x440560
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [0x46673c], ecx
mov ecx, esi
call fcn.004408a0
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push 0
push eax
push 0x4405b0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret 8
Function at 0x440c10
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [edi + 4]
mov esi, eax
push ecx
call sub.WS2_32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov edi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WS2_32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x440c46
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edx, edi
sub eax, 0x61c88647
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x440c6d
push esi
call sub.WS2_32.dll_htonl
mov esi, dword [esp + 0x2c]
push edi
mov dword [esi], eax
call sub.WS2_32.dll_htonl
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x440ce0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [esi + 4]
mov edi, eax
push ecx
call sub.WS2_32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov esi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WS2_32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x440d16
mov ecx, dword [esp + 0x14]
mov eax, 0xe3779b90
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, edi
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x10]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add eax, 0x61c88647
sub edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x440d40
push edi
call sub.WS2_32.dll_htonl
mov edi, dword [esp + 0x2c]
push esi
mov dword [edi], eax
call sub.WS2_32.dll_htonl
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret