joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001366d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10012c4a
lea ecx, [0x100121a8]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x3c], 0x139a00
mov edx, dword [0x1002813c]
mov dword [esp + 0x54], edx
mov edx, dword [0x10028140]
mov dword [esp + 0x80], edx
mov edx, dword [0x10028144]
mov dword [esp + 0x8c], edx
mov edx, dword [0x10028148]
mov dword [esp + 0x38], edx
mov dword [0x10028154], 0x12e0
mov edx, dword [0x1002814c]
mov dword [esp + 0x58], edx
mov dword [0x10028150], 0xcd5
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10013735
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [0x10028154], 0x16c2
mov dword [0x10028150], 0x84
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], edx
call fcn.1001298a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1001376c
jmp 0x100137a0
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10013758
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x100136f9
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10013735
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10012214
mov dword [0x10028150], 0x104
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10006ae2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10006af1
pop dword [ebp - 0x44]
mov eax, 0x58e5f6b3
sub eax, 0x48e58bc2
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x602abc31
add dword [ebp - 0x54], 0xee27891a
mov dword [ebp - 0x50], 0x530f4d28
add dword [ebp - 0x50], 0xdf23ff1d
mov dword [ebp - 0x4c], 0x2542c892
add dword [ebp - 0x4c], 0x27097b9c
mov dword [ebp - 0x48], 0xc05d5ba2
add dword [ebp - 0x48], 0x3fa2a45e
lea eax, [ebp - 0x54]
push eax
mov eax, 0x1d2648b2
sub eax, 0xd259812
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf07eadee
add dword [ebp - 0x54], 0x83f3bb68
mov dword [ebp - 0x50], 0x4264946b
sub dword [ebp - 0x50], 0xf832f6
mov dword [ebp - 0x4c], 0xff138050
add dword [ebp - 0x4c], 0x645bec1c
mov dword [ebp - 0x48], 0x389fab2b
sub dword [ebp - 0x48], 0x389fab2b
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39c0c
push 0
call eax
mov ecx, 0xaa949f17
sub ecx, 0xaa944dee
xor edx, edx
add edx, eax
mov esi, 0x8fd64e43
add esi, 0x802e29bd
add esi, dword [ebp - 0x44]
mov ebx, 0x7adae6a9
sub ebx, 0x470f2bae
xor dword [ebp - 0x24], 0x888fa07
mov edi, dword [esi]
sub dword [ebp - 0xc], esi
sub edi, ebx
add dword [ebp - 0x20], eax
mov dword [edx], edi
add dword [ebp - 0x10], 0xe7314504
add edx, 0xc42aea1c
sub edx, 0xc42aea18
add esi, 0xcf62d52f
add esi, 0x309d2ad5
loop 0x10006c10
add eax, 0x13777
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40b1d1
pop dword [ebp - 4]
mov eax, 0xc2e26081
add eax, 0x3d5e5150
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x3bf0b
push 0
mov eax, 0x6c19745a
sub eax, 0x6bd89382
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x527e
mov edx, eax
mov esi, 0x413bc4
add esi, dword [ebp - 4]
mov ebx, 0x1b9a67a0
sub ebx, 0x5a4329eb
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 0xba45caeb
add edx, 0x45ba3519
add esi, 0xa9bfb7ef
add esi, 0x56404815
loop 0x40b224
add eax, 0x56b43fe2
add eax, 0xa94cfce9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1af2df69
add ecx, 0xe54d2097
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x401e10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401e5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e54
test esi, esi
je 0x401e54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e30
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402040
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402168
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4020ce
cmp eax, 4
jne 0x4020f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4020de
cmp edx, 4
je 0x4020de
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402040
Function at 0x408b2e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00403dc9
xor ebx, ebx
cmp dword [0x40f964], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x408c04
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x408ce4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40c474
push edi
call esi
cmp eax, ebx
je 0x408ce4
push eax
call fcn.00403d5b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f964], eax
call esi
push eax
call fcn.00403d5b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f968], eax
call esi
push eax
call fcn.00403d5b
mov dword [0x40f96c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040551f
test eax, eax
pop ecx
pop ecx
je 0x408bd2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004042b5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x408c04
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00403d5b
cmp eax, ebx
pop ecx
mov dword [0x40f974], eax
je 0x408c04
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403d5b
pop ecx
mov dword [0x40f970], eax
mov eax, dword [0x40f970]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x408c89
cmp dword [0x40f974], ecx
je 0x408c89
push eax
call fcn.00403dd2
push dword [0x40f974]
mov esi, eax
call fcn.00403dd2
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x408c89
cmp edi, ebx
je 0x408c89
call esi
cmp eax, ebx
je 0x408c56
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408c56
test byte [ebp - 0x18], 1
jne 0x408c89
lea eax, [ebp - 0x10]
push eax
call fcn.00405556
test eax, eax
pop ecx
je 0x408c71
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004042b5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x408c80
or dword [ebp + 0x10], 0x200000
jmp 0x408cc4
or dword [ebp + 0x10], 0x40000
jmp 0x408cc4
mov eax, dword [0x40f968]
cmp eax, dword [ebp - 8]
je 0x408cc4
push eax
call fcn.00403dd2
cmp eax, ebx
pop ecx
je 0x408cc4
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x408cc4
mov eax, dword [0x40f96c]
cmp eax, dword [ebp - 8]
je 0x408cc4
push eax
call fcn.00403dd2
cmp eax, ebx
pop ecx
je 0x408cc4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f964]
call fcn.00403dd2
cmp eax, ebx
pop ecx
je 0x408ce4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408ce6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40a4c5
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x40a4da
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 8], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x1c
pop esi
push esi
mov ebx, eax
lea eax, [ebp - 0x1c]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 4
mov dword [ebp - 0x1c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.KERNEL32.dll_Thread32First
jmp 0x40a53f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x10]
jne 0x40a535
cmp ebx, dword [ebp - 0x14]
je 0x40a535
push dword [ebp - 0x14]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x40a535
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40a510
pop esi
pop ebx
leave
ret
Function at 0x4170ad
Capabilities:
Accept command line arguments
Create process on windows
Delete file

Disassembly:
push 0x29c
mov eax, 0x42b92b
call fcn.00428dbe
call fcn.004171e6
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
push str..tmp
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.MSVCR80.dll_wcslen]
mov edi, 0x4315c8
push edi
call esi
pop ecx
mov dword [ebp - 0x24c], edi
lea eax, [eax*2 + 0x4315c8]
mov edi, str.__restart
push edi
mov dword [ebp - 0x238], eax
call esi
pop ecx
push dword [ebp - 0x238]
mov dword [ebp - 0x244], edi
push dword [ebp - 0x24c]
lea eax, [eax*2 + str.__restart]
mov dword [ebp - 0x240], eax
sub esp, 0xc
mov edi, esp
lea esi, [ebp - 0x244]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x234]
push eax
movsd dword es:[edi], dword [esi]
call fcn.004173ba
push 0x40
lea eax, [ebp - 0x2a4]
push ebx
push eax
mov dword [ebp - 0x2a8], ebx
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [ebp - 0x25c], ebx
lea edi, [ebp - 0x258]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x24
cmp dword [ebp - 0x21c], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x230]
jae 0x4171b4
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x2a8]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
call fcn.00428e41
ret
Function at 0x4171e6
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x44201c]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, edi
push edi
push 2
mov dword [ebp - 0x80], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4172a7
push 0x228
lea eax, [ebp - 0x78]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x417258
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x74], eax
je 0x41725e
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x417246
jmp 0x41726d
push dword [ebp - 0x64]
call fcn.004172be
test al, al
je 0x41726d
mov edi, dword [ebp - 0x64]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x4172a7
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4172a4
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4172a4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call esi
mov ecx, dword [ebp + 0x1b0]
pop edi
xor ecx, ebp
pop esi
call fcn.00424d84
add ebp, 0x1b4
leave
ret

Function at 0x4172be
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x44201c]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push edi
push dword [ebp + 0x3ac]
xor ebx, ebx
push ebx
push 0x410
mov byte [ebp - 0x75], bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x41739e
push 0x208
lea eax, [ebp + 0x196]
push ebx
push eax
mov word [ebp + 0x194], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 4
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x417397
push esi
mov esi, 0x104
push esi
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x7c]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x417396
push 0x206
lea eax, [ebp - 0x72]
push ebx
push eax
mov word [ebp - 0x74], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea eax, [ebp + 0x194]
push eax
call esi
push eax
lea eax, [ebp - 0x74]
push eax
call esi
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x417396
mov byte [ebp - 0x75], 1
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x3a0]
mov al, byte [ebp - 0x75]
pop edi
xor ecx, ebp
pop ebx
call fcn.00424d84
add ebp, 0x3a4
leave
ret 4
Function at 0x418252
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x44201c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
push edi
xor edi, edi
push 0x7fe
lea eax, [ebp - 0x76]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x78], di
call sub.MSVCR80.dll_memset
lea eax, [esi + 0x2a8]
push eax
lea eax, [esi + 0x228]
push eax
lea eax, [esi + 0x1a8]
push eax
lea eax, [esi + 0x128]
push eax
lea eax, [esi + 0xa8]
push eax
push dword [esi + 0xa4]
lea eax, [ebp - 0x78]
push dword [esi + 0xa0]
push dword [esi + 0x9c]
push dword [esi + 0x98]
push dword [esi + 0x94]
push str._cgi_bin_wgp_stat_new_oss_no_skey_billType10fieldCount26field1_1field2_1field3_1field432field532field60field7_1field8_1field9_1field10_1field11_1field12_1field13_1field140field15_1field16_1field17_dfield18_dfield19_dfield20_dfield21_dfield22_sfield23_sfield24_sfield25_sfield26_s
push 0xffffffffffffffff
push 0x400
push eax
call dword [sym.imp.MSVCR80.dll__snwprintf_s]
add esp, 0x44
push edi
push edi
push edi
push edi
push str.QQGame
call dword [sym.imp.WININET.dll_InternetOpenW]
push edi
push edi
push 3
push edi
push edi
push 0x50
push str.log.minigame.qq.com
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.WININET.dll_InternetConnectW]
push edi
push edi
push edi
push str.http:__www.qq.com
push 0x432bb4
lea ecx, [ebp - 0x78]
push ecx
push 0x432bc8
push eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push edi
push edi
push edi
mov esi, eax
push edi
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
cmp esi, edi
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x418341
push esi
call ebx
cmp dword [ebp - 0x80], edi
je 0x41834b
push dword [ebp - 0x80]
call ebx
cmp dword [ebp - 0x7c], edi
je 0x418355
push dword [ebp - 0x7c]
call ebx
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424d84
add ebp, 0x78c
leave
ret
Function at 0x420c95
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
cmp byte [0x44e7a4], 0
push esi
push edi
je 0x420cb7
cmp byte [0x45f99c], 0
je 0x420cb7
mov esi, eax
call fcn.00420bba
mov edi, eax
jmp 0x420cb9
xor edi, edi
test edi, edi
jne 0x420cdf
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x40
push eax
push 1
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
jmp 0x420d66
push ebx
push ebp
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [esp + 0x1c]
mov esi, dword [sym.imp.MSVCR80.dll___iob_func]
mov dword [esp + 0x10], eax
call esi
mov ebp, dword [sym.imp.MSVCR80.dll_fflush]
add eax, 0x40
push eax
call ebp
mov eax, edi
dec eax
pop ecx
je 0x420d2c
dec eax
je 0x420d28
dec eax
je 0x420d24
xor eax, eax
jmp 0x420d2f
push 6
jmp 0x420d2e
push 2
jmp 0x420d2e
push 4
pop eax
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push ebx
call edi
call esi
add eax, 0x40
push eax
push 1
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [sym.imp.MSVCR80.dll_fwrite]
call esi
add eax, 0x40
push eax
call ebp
add esp, 0x14
push dword [esp + 0x10]
push ebx
call edi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x420d6c
Capabilities:
Write file on windows

Disassembly:
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x40
push eax
push 1
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
ret
Function at 0x422a1c
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x42a1ab
call fcn.00428dbe
mov eax, dword [0x44fa14]
lea esi, [eax + 8]
mov ebx, dword [esi]
lea edi, [eax + 4]
cmp dword [edi], ebx
mov dword [ebp - 0x11c], eax
jbe 0x422a48
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, dword [edi]
cmp edi, dword [esi]
jbe 0x422a54
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp edi, ebx
je 0x422a6f
push dword [esi]
mov eax, edi
mov ecx, ebx
call fcn.00423570
pop ecx
push dword [esi]
mov edi, eax
call fcn.00401bab
mov dword [esi], edi
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x422abe
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x138]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
and dword [ebp - 4], 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x11c]
call fcn.00401a92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push str.C:_tmp_
lea ecx, [ebp - 0x138]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 4], 1
call fcn.00401a92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push str.C:_temp_
lea ecx, [ebp - 0x154]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 4], 2
call fcn.00401a92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
call fcn.00428e41
ret