joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445079
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x445098
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.00444f30
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x446313
Capabilities:
Create thread
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, str.u.155.com
xor ebx, ebx
push edi
mov dword [esi + 0x30], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
jne 0x446336
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x44633d
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push ebx
push ebx
push esi
push 0x44624d
push ebx
push ebx
mov dword [esi + 0x64], eax
call fcn.0046d985
add esp, 0x18
pop edi
mov dword [esi + 0xb4], eax
pop esi
pop ebx
ret

Function at 0x446c4c
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x446c68
xor eax, eax
jmp 0x446c8f
push ebx
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x4469e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0x446c8c
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x4491e7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x449206
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.0044900c
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x44932e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449397
cmp dword [ebp + 0x10], 1
je 0x44936f
cmp dword [ebp + 0x10], 2
je 0x44936f
push 0xd
pop eax
jmp 0x449397
mov eax, dword [ebp - 4]
test edi, edi
je 0x449391
test eax, eax
je 0x44938c
test al, 1
jne 0x44936a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x449391
jmp 0x44936a
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x449dcf
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x10004]
mov eax, 0x10004
call fcn.0046f9c0
push 0xffffffffffffffff
push 0x496e34
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp + 0x10000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x1000c]
mov ebx, dword [ebp + 0x10010]
and dword [ebp - 4], 0
push 0
push 0x10000
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.00450be4
mov dword [ebp - 0x14], 0x65ef0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
call fcn.00450ded
cmp dword [esi + 0x18], 8
jb 0x449e50
mov edi, dword [esi + 4]
jmp 0x449e53
lea edi, [esi + 4]
test edi, edi
je 0x449e66
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x449e6a
xor eax, eax
jmp 0x449e83
lea esi, [eax + eax]
mov eax, esi
call fcn.0046f1d0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00449286
push eax
lea ecx, [ebp - 0x40]
call fcn.004023fc
push eax
lea ecx, [ebp - 0x24]
call fcn.004522a5
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004027d0
cmp dword [ebx + 0x18], 8
jb 0x449eac
mov edi, dword [ebx + 4]
jmp 0x449eaf
lea edi, [ebx + 4]
test edi, edi
je 0x449ec2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x449ec6
xor eax, eax
jmp 0x449edf
lea esi, [eax + eax]
mov eax, esi
call fcn.0046f1d0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00449286
push 0x4a23e4
push eax
call fcn.00470d57
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x449f1e
push esi
lea ecx, [ebp - 0x24]
call fcn.00450c2f
push eax
push 1
lea eax, [ebp]
push eax
call fcn.00470c11
push esi
call fcn.00470a33
add esp, 0x14
mov al, 1
jmp 0x449f20
xor al, al
lea esp, [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10000]
xor ecx, ebp
call fcn.0046cc2a
add ebp, 0x10004
leave
ret
Function at 0x44a4ad
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1d4]
sub esp, 0x254
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp + 0x1d0], eax
push ebx
push esi
mov esi, dword [ebp + 0x1dc]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x36]
push ebx
push eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.0046cbb0
add esp, 0xc
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x64], 0x208
mov byte [ebp - 0x55], bl
call fcn.00446865
test eax, eax
jne 0x44a5c8
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x38]
push eax
push str.CommonFilesDir
lea ecx, [ebp - 0x60]
call fcn.0044932e
test eax, eax
jne 0x44a5c8
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb3e
pop ecx
test eax, eax
jbe 0x44a5c8
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x54]
call fcn.004018f6
push 0x20
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0044a262
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x54]
call fcn.004019a1
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a58
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x44a589
lea eax, [ebp - 0x50]
push eax
call fcn.004658eb
pop ecx
test al, al
je 0x44a5b0
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x44a5a0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb86
pop ecx
pop ecx
mov byte [ebp - 0x55], 1
lea ecx, [ebp - 0x60]
call fcn.0044684a
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00401a58
cmp byte [ebp - 0x55], bl
jne 0x44a60a
push 0x104
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4a24d0
test eax, eax
je 0x44a5ef
call fcn.0046cb3e
pop ecx
xor ecx, ecx
mov word [ebp + eax*2 - 0x38], cx
jmp 0x44a5fa
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb86
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push str.Program_FilesCommon_Files
push eax
call fcn.0046cb58
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb3e
pop ecx
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x3a]
je 0x44a639
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb3e
pop ecx
push 0x2f
pop ecx
cmp cx, word [ebp + eax*2 - 0x3a]
je 0x44a639
push str.Thunder_NetworkTP_
jmp 0x44a63e
push 0x4a2444
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb58
cmp dword [0x4bc798], 8
mov eax, dword [0x4bc784]
pop ecx
pop ecx
jae 0x44a65c
mov eax, 0x4bc784
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046cb58
lea eax, [ebp - 0x38]
push 0x4a7b78
push eax
call fcn.0046cb58
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.004018f6
lea ecx, [ebp - 0x60]
call fcn.0044684a
mov ecx, dword [ebp + 0x1d0]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cc2a
add ebp, 0x1d4
leave
ret
Function at 0x44bf84
Capabilities:
Compare security identifiers

Disassembly:
mov ecx, dword [esp + 4]
push ebx
lea ebx, [ecx + 4]
push esi
push edi
test ebx, ebx
je 0x44bfc1
mov edi, dword [esp + 0x14]
lea esi, [edi + 4]
test esi, esi
je 0x44bfc1
call fcn.0044bf1c
test al, al
je 0x44bfc1
mov ecx, edi
call fcn.0044bf1c
test al, al
je 0x44bfc1
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x44bfc3
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x44d229
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp + 0x1fc], eax
push esi
push edi
mov edi, dword [ebp + 0x208]
xor eax, eax
push 0x206
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
push esi
push eax
call fcn.0046cbb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0xc]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44d318
push edi
push 0x4a2814
lea ecx, [ebp - 0x80]
call fcn.004018f6
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00426e2e
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a58
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0046cbb0
lea eax, [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.open
jae 0x44d2f7
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401a58
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.0046cc2a
add ebp, 0x200
leave
ret
Function at 0x44d32f
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp + 0x1fc], eax
push esi
push edi
mov edi, dword [ebp + 0x208]
xor eax, eax
push 0x206
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
push esi
push eax
call fcn.0046cbb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0xc]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44d41e
push edi
push str._i_net_monitor.dll
lea ecx, [ebp - 0x80]
call fcn.004018f6
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00426e2e
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a58
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0046cbb0
lea eax, [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.open
jae 0x44d3fd
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401a58
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.0046cc2a
add ebp, 0x200
leave
ret

Function at 0x44d7fa
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x4a287c
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040f161
push esi
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.0040f161
mov ecx, dword [ebp - 0x1c]
add esp, 0x18
cmp dword [ebp - 8], 8
pop edi
pop esi
jae 0x44d83e
lea ecx, [ebp - 0x1c]
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x44d84a
lea eax, [ebp - 0x38]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a58
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401a58
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cc2a
leave
ret 8
Function at 0x44d9df
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xe4
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.0044bce2
mov ecx, eax
call fcn.004525c5
mov ebx, str.cid_store.dat
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0040f161
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp dword [ebp + 0x70], 8
jae 0x44da29
lea eax, [ebp + 0x5c]
push eax
call fcn.00465dc5
xor edi, edi
pop ecx
push edi
test al, al
je 0x44da3f
xor esi, esi
inc esi
jmp 0x44db85
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x54], 7
call fcn.00401cdf
lea eax, [ebp + 0x3c]
push eax
call fcn.0045301b
xor esi, esi
inc esi
pop ecx
test al, al
je 0x44db0d
lea eax, [ebp + 0x3c]
push eax
call fcn.00452ca5
lea ecx, [ebp - 0x6c]
mov dword [esp], 0x4a28d4
call fcn.004018f6
push eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00426e2e
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp + 0x3c]
call fcn.004019a1
push edi
push esi
lea ecx, [ebp - 0x50]
call fcn.00401a58
push edi
push esi
lea ecx, [ebp - 0x6c]
call fcn.00401a58
push ebx
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0040f161
mov ecx, dword [ebp + 0x5c]
add esp, 0xc
cmp dword [ebp + 0x70], 8
jae 0x44dac9
lea ecx, [ebp + 0x5c]
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x44dad5
lea eax, [ebp + 0x24]
push ecx
push eax
call fcn.00465f2f
pop ecx
pop ecx
test eax, eax
je 0x44db03
cmp dword [ebp + 0x70], 8
mov ecx, dword [ebp + 0x5c]
jae 0x44daee
lea ecx, [ebp + 0x5c]
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x44dafa
lea eax, [ebp + 0x24]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push esi
lea ecx, [ebp + 0x20]
call fcn.00401a58
push edi
lea ecx, [ebp + 4]
mov dword [ebp + 0x1c], 7
call fcn.00401cdf
lea eax, [ebp + 4]
push eax
call fcn.00452f28
pop ecx
test al, al
je 0x44db70
lea eax, [ebp + 4]
push eax
call fcn.00452ca5
push ebx
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040f161
mov ecx, dword [ebp + 0x5c]
add esp, 0x10
cmp dword [ebp + 0x70], 8
jae 0x44db51
lea ecx, [ebp + 0x5c]
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x44db5d
lea eax, [ebp - 0x30]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push esi
lea ecx, [ebp - 0x34]
call fcn.00401a58
push edi
push esi
lea ecx, [ebp + 4]
call fcn.00401a58
push edi
push esi
lea ecx, [ebp + 0x3c]
call fcn.00401a58
push edi
push esi
lea ecx, [ebp + 0x58]
call fcn.00401a58
push edi
push esi
lea ecx, [ebp - 0x18]
call fcn.00401a58
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cc2a
add ebp, 0x78
leave
ret
Function at 0x44e350
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
mov dword [ebp - 0x48], eax
call fcn.00452ca5
push esi
call fcn.00452ca5
xor ebx, ebx
pop ecx
pop ecx
cmp dword [esi + 0x14], ebx
je 0x44e396
cmp dword [esi + 0x18], 8
jb 0x44e38c
mov eax, dword [esi + 4]
jmp 0x44e38f
lea eax, [esi + 4]
push eax
call fcn.0046592e
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00419025
push str.bootstrap.dat
lea ecx, [ebp - 0x20]
call fcn.004018f6
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040d9f9
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a58
push str.dhtnodes.dat
lea ecx, [ebp - 0x20]
call fcn.004018f6
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040d9f9
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a58
push str.nodes.dat
lea ecx, [ebp - 0x20]
call fcn.004018f6
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040d9f9
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a58
push str.server.met
lea ecx, [ebp - 0x20]
call fcn.004018f6
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040d9f9
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a58
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x44]
call fcn.00403dfb
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.00403dfb
jmp 0x44e4b8
lea ecx, [ebp - 0x44]
call fcn.0040e19a
push eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x20]
push eax
call fcn.00426e2e
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0040e19a
push eax
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00426e2e
mov ecx, dword [ebp - 0x38]
add esp, 0xc
cmp dword [ebp - 0x24], 8
jae 0x44e487
lea ecx, [ebp - 0x38]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44e493
lea eax, [ebp - 0x1c]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push edi
lea ecx, [ebp - 0x3c]
call fcn.00401a58
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a58
lea ecx, [ebp - 0x44]
call fcn.00403d8e
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x44]
call fcn.00403dbd
test al, al
je 0x44e44d
lea ecx, [ebp - 0x60]
call fcn.0040de67
push dword [ebp - 0x60]
call fcn.0046c701
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cc2a
leave
ret 8
Function at 0x452651
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0x3c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [ebp - 0x24], 7
call fcn.00401cdf
lea eax, [ebp - 0x3c]
push eax
call fcn.004341a8
mov ecx, eax
call fcn.00432530
push str.dl_uac_tool.dll
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f161
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x4526b4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x45270a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetSingleProcessUseDir
push ebx
call edi
push str.GetProfileDir
push ebx
mov dword [esi], eax
call edi
push str.GetComponentsDir
push ebx
mov dword [esi + 4], eax
call edi
push str.GetSingleProcessUseDir
push ebx
mov dword [esi + 8], eax
call edi
push str.SetMultiProcessUseDir
push ebx
mov dword [esi + 0xc], eax
call edi
push str.GetMultiProcessUseDir
push ebx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a58
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401a58
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cc2a
leave
ret

Function at 0x452954
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4bca6c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 8
xor ecx, ecx
pop ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
cmp dword [0x4bca80], ebx
jae 0x45298a
mov eax, 0x4bca6c
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push eax
push closesocket
lea ecx, [ebp - 0x28]
call fcn.00452860
test eax, eax
jne 0x452a52
push str.AppName
lea ecx, [ebp - 0x20]
call fcn.004018f6
cmp dword [edi + 0x18], ebx
jb 0x4529c0
mov edi, dword [edi + 4]
jmp 0x4529c3
add edi, 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x4529ce
lea eax, [ebp - 0x1c]
push 1
push edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004528ba
push str.AppPath
lea ecx, [ebp - 0x20]
call fcn.00401a34
cmp dword [esi + 0x18], ebx
jb 0x4529f1
mov esi, dword [esi + 4]
jmp 0x4529f4
add esi, 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x4529ff
lea eax, [ebp - 0x1c]
push 1
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.004528ba
push 0x4a2df0
lea ecx, [ebp - 0x20]
call fcn.00401a34
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x452a23
lea eax, [ebp - 0x1c]
push 4
lea ecx, [ebp - 0x2c]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x28]
call fcn.0044684a
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a58
lea ecx, [ebp - 0x28]
call fcn.0044684a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0046cc2a
leave
ret
Function at 0x452a6b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4b7f10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.0046cbb0
push 0x10
lea eax, [ebp - 0x34]
push ebx
push eax
mov dword [ebp - 0x94], 0x44
mov dword [ebp - 0x68], 0x80
call fcn.0046cbb0
add esp, 0x18
mov eax, 0x49cb4c
push eax
push edi
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00408158
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f161
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.00401a58
cmp esi, ebx
je 0x452afe
push 0x4a7854
lea ecx, [ebp - 0x20]
call fcn.0040197d
push esi
lea ecx, [ebp - 0x20]
call fcn.0040197d
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x20]
call fcn.00412486
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x452b44
mov byte [ebp - 0x21], bl
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a58
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cc2a
leave
ret
cmp byte [ebp + 0x10], bl
je 0x452b54
push 0xffffffffffffffff
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov byte [ebp - 0x21], 1
jmp 0x452b27