joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450e06
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46ab5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004068d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004068d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004068d0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.004068d0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x80
call fcn.004068d0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x9c
call fcn.0041b1b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x118
call fcn.00403460
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x124
call fcn.00444b10
mov ecx, dword [ebp - 0x10]
add ecx, 0x134
call fcn.004068d0
mov ecx, dword [ebp - 0x10]
add ecx, 0x138
call fcn.004068d0
mov ecx, dword [ebp - 0x10]
add ecx, 0x140
call fcn.004068d0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x98], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x4c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x28], 3
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x50], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x60], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x48], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x64], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x6c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x94], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x84], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x88], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x8c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x13c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x144], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x148], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x150], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x154], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x90], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x436dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0
push 0
push 7
call fcn.00441870
add esp, 0xc
mov ecx, dword [ebp - 0xc]
call fcn.00437160
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436e12
jmp 0x436eed
mov ecx, dword [ebp - 0xc]
call fcn.00437390
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436e2d
jmp 0x436eed
mov ecx, dword [ebp - 0xc]
call fcn.00437510
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436e48
jmp 0x436eed
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.00442660
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436e66
jmp 0x436eed
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.004426d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436e7e
jmp 0x436eed
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.004427d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436e96
jmp 0x436eed
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.004428a0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x6c], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.00442950
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x70], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x6c], 0
je 0x436eca
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x70], 0
jne 0x436ed5
mov dword [ebp - 4], 1
jmp 0x436eed
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x6c]
push eax
mov ecx, 0x46b018
call fcn.00423510
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 9
call fcn.00441870
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
push eax
mov ecx, 0x46b018
call fcn.004234d0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x436f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x70]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x6c]
push eax
push 0xf
call fcn.00441870
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.004429e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436f69
jmp 0x436f70
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x12
call fcn.00441870
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
push eax
mov ecx, 0x46b018
call fcn.004234f0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x436fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.00442950
push eax
push 0x13
call fcn.00441870
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 0x44
call fcn.00442bb0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x437019
jmp 0x43702a
mov ecx, 0x46b7c0
call fcn.0043b600
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x16
call fcn.00441870
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
push eax
mov ecx, 0x46b018
call fcn.0042fbd0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x437510
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4515f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x46ab5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x46b648
call fcn.0042fca0
mov dword [ebp - 4], 0
push 3
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00406bc0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x20]
call fcn.004027e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401080
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4375d5
jmp 0x437664
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov cl, 0x14
call fcn.0044c1d0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0
ja 0x43764e
jb 0x4375f9
cmp dword [ebp - 0x2c], 0xc8
jae 0x43764e
push 0x455e30
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.00443e00
push str.fast
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.00443e00
push str.defend
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.00443e00
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov cl, 0x14
call fcn.0044c1d0
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040f280
push eax
mov ecx, 0x46b018
call fcn.00423530
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.00443ec0
test eax, eax
jne 0x437664
mov dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push str.KDubaUpdate::CheckDiskSize_diskSpace:_I64d_MB
push 0x46afbc
call fcn.00420980
add esp, 0x10
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401080
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437b00
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4516c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x46ab5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14]
call fcn.004068d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push str.update
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004165b0
add esp, 8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0040aa40
add esp, 0xc
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x34]
push edx
lea ecx, [ebp - 0x14]
call fcn.004027e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401080
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401080
push 0
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 8
test eax, eax
je 0x437bb9
jmp 0x437c07
push 0x80
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x10
jne 0x437c07
push 0
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401080
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43afe0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x24
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call fcn.0040f280
push eax
call fcn.00409ea0
add esp, 8
push str.KRebootConfigWritter::SetDonotNeedRebootUpdate_delete_all_back_files
push 0x46afbc
call fcn.00420980
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x43b500
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451d38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x46ab5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.004068d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x30], 0
je 0x43b558
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
push ecx
lea ecx, [ebp - 0x10]
call fcn.004027e0
jmp 0x43b567
mov edx, dword [ebp - 0x18]
add edx, 0x24
push edx
lea ecx, [ebp - 0x10]
call fcn.004027e0
push 3
lea ecx, [ebp - 0x10]
call fcn.0040f280
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x34
call fcn.0041e6d0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push str.KRebootConfigWritter::AddRebootFile_Save_config_file_return:_d
push 0x46afbc
call fcn.00420980
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x43b5ad
lea ecx, [ebp - 0x10]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x43b5dc
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
je 0x43b5ca
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x43b5dc
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x43b600
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450468
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x46ab5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x34
call fcn.0041e6b0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
call fcn.0040f290
test eax, eax
jne 0x43b64f
mov ecx, dword [ebp - 0x1c]
call fcn.0043afe0
jmp 0x43b700
mov eax, dword [ebp - 0x1c]
add eax, 0x24
push eax
lea ecx, [ebp - 0x10]
call fcn.00401de0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x30], 0
je 0x43b67d
mov edx, dword [ebp - 0x1c]
add edx, 0x28
push edx
lea ecx, [ebp - 0x10]
call fcn.004027e0
push 3
lea ecx, [ebp - 0x10]
call fcn.0040f280
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x34
call fcn.0041e6d0
mov dword [ebp - 0x18], 0
jmp 0x43b6a5
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.00444b40
cmp dword [ebp - 0x18], eax
jae 0x43b6d4
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0042e4e0
mov ecx, eax
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x43b69c
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0041ad70
push str.KRebootConfigWritter::SaveRebootConfig_end
push 0x46afbc
call fcn.00420980
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43d6f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 8]
call fcn.00444d70
mov eax, dword [ebp - 0x20]
add eax, 0x14
push eax
push 0x43c3c0
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x14
call fcn.00444d20
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
jmp 0x43d737
lea ecx, [ebp - 8]
call fcn.0043e7f0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x14
call fcn.00406d30
push eax
lea ecx, [ebp - 8]
call fcn.0043e6e0
movzx edx, al
test edx, edx
je 0x43d776
lea ecx, [ebp - 8]
call fcn.0041ede0
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x43d774
mov eax, 1
jmp 0x43d778
jmp 0x43d72f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x444440
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452626
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x46ab5c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x270], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004068d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004068d0
mov byte [ebp - 4], 1
mov dword [ebp - 0x274], 0xffffffff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.004010a0
mov ecx, dword [ebp + 8]
push ecx
push 0x4552bc
lea edx, [ebp - 0x14]
push edx
call fcn.0040a500
add esp, 0xc
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4444eb
jmp 0x444634
push 0x4552b8
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x44451d
push 0x4552b0
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x444522
jmp 0x44460e
mov eax, dword [ebp - 0x26c]
and eax, 0x10
je 0x444586
lea ecx, [ebp - 0x278]
call fcn.004068d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4552a4
lea eax, [ebp - 0x278]
push eax
call fcn.0040a500
add esp, 0x10
lea ecx, [ebp - 0x278]
call fcn.0040f280
push eax
mov ecx, dword [ebp - 0x288]
call fcn.00444440
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
call fcn.00401080
jmp 0x44460e
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x27c]
call fcn.00401000
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x27c]
call fcn.004033c0
lea ecx, [ebp - 0x27c]
call fcn.0040f280
push eax
mov ecx, dword [ebp - 0x288]
call fcn.00444760
test eax, eax
jne 0x4445ff
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x280]
push ecx
call fcn.0040a290
add esp, 0xc
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0x28c]
call fcn.0040f280
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x280]
call fcn.00401080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.00401080
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4444eb
mov dword [ebp - 0x270], 0
cmp dword [ebp - 0x274], 0xffffffff
je 0x44464a
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0x284], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401080
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0044be2c
mov esp, ebp
pop ebp
ret 4
Function at 0x4447b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450ff0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46ab5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x14]
call fcn.004068d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x46b648
call fcn.0042fca0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
push eax
push str._suplive.svr
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040a500
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401080
push 0
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 8
test eax, eax
je 0x44484d
jmp 0x4448a4
lea ecx, [ebp - 0x14]
call fcn.0040f280
push eax
push 0xffffffffffffffff
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
mov ecx, 0x46b648
call fcn.004306e0
test eax, eax
jle 0x444886
mov ecx, 0x46b648
call fcn.004306e0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
cmp edx, dword [0x46b864]
je 0x4448a4
mov dword [ebp - 0x18], 1
push 1
mov ecx, 0x46b648
call fcn.00430420
mov eax, dword [0x46b864]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.KUpdateInst::CheckTryNoChanged_newTryNo:_d_oldTryNo:_d
push 0x46afbc
call fcn.00420980
add esp, 0x10
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401080
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4484f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x448550
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x448544
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x449240
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x44a630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45298e
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x46ab5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x220]
call fcn.004068d0
mov dword [ebp - 4], 0
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.config.ini
lea ecx, [ebp - 0x224]
push ecx
call fcn.0044a780
add esp, 4
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040aa40
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x224]
call fcn.00401080
lea ecx, [ebp - 0x10]
call fcn.0040f280
push eax
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0
push str.Language
push 0x45d810
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.004010a0
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401de0
mov edx, dword [ebp - 0x228]
or edx, 1
mov dword [ebp - 0x228], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00401080
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044be2c
mov esp, ebp
pop ebp
ret
Function at 0x44be2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46ab5c]
jne 0x44be36
repz ret
jmp fcn.0044c500

Function at 0x44cd3c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46ab5c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0044cc7b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x44cd8b
cmp dword [ebp - 0x1c], 5
jb 0x44cda3
jmp 0x44cd9f
cmp dword [ebp - 0x10], 1
jne 0x44cda3
cmp dword [ebp - 0x1c], 4
ja 0x44cd9f
jne 0x44cda3
cmp dword [ebp - 0x18], 0
jbe 0x44cda3
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45d9a4
call fcn.0044cb11
test eax, eax
jge 0x44cdc4
mov byte [0x46ac78], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044be2c
add ebp, 0x78
leave
ret