joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4418c2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x558
push ebx
push esi
push edi
lea eax, [ebp - 0x24c]
push eax
mov edi, 0x53ec98
push edi
push str.PreviousInstaller
push str.Software
call fcn.004449e7
lea eax, [ebp - 0x24c]
push eax
call fcn.00401d29
xor ebx, ebx
test al, al
jne 0x441903
mov word [ebp - 0x24c], bx
cmp word [ebp - 0x24c], bx
mov esi, 0x1388
mov dword [0x62b218], esi
mov dword [0x62b21c], 0x56c30c
mov dword [0x62b220], 0x56c330
mov dword [0x62b224], 0x1389
mov dword [0x62b228], 0x56c3b8
mov dword [0x62b22c], 0x56c3f0
je 0x44197b
mov dword [0x62b230], 0x138a
mov dword [0x62b234], 0x56c470
mov dword [0x62b238], 0x56c4a8
mov dword [0x62b23c], ebx
mov dword [0x62b240], ebx
mov dword [0x62b244], ebx
jmp 0x44198d
mov dword [0x62b230], ebx
mov dword [0x62b234], ebx
mov dword [0x62b238], ebx
push ebx
push esi
push 0x62b218
push edi
push str.This_is_a_recent_release_of_Express_Burn._r_nIf_you_find_any_problems_with_this_release_please_let_us_know_by_reporting_them.
push str.Express_Burn___v_12.00_Beta
push dword [ebp + 8]
lea eax, [ebp - 0x554]
call fcn.004704ca
lea edi, [ebp - 0x554]
call fcn.00470d45
sub eax, esi
je 0x441a0a
dec eax
je 0x441a00
dec eax
jne 0x441a0f
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.005251f0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x30], eax
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x100
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x34], 0x5675cc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x441a0f
push dword [ebp + 8]
call fcn.0046e09f
jmp 0x441a0f
call fcn.00441712
lea esi, [ebp - 0x554]
call fcn.00441a21
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4437c0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x443822
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x443819
cmp dword [ebp - 4], 1
sete bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, bl
pop ebx
leave
ret
Function at 0x443827
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
push esi
push edi
call fcn.004437c0
neg al
sbb eax, eax
neg eax
push eax
push str.llinad
push str.UsageStatsChoice
call fcn.004248a7
mov eax, dword [0x5a9c94]
mov esi, 0x5a9c94
jmp 0x44387f
push eax
push 0x5a9a38
lea eax, [ebp - 0x468]
push eax
call fcn.00401dde
push 0
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x443859
call fcn.0042a461
call fcn.00423932
test al, al
je 0x443991
lea eax, [ebp - 0x878]
call fcn.0044936f
lea eax, [ebp - 0x670]
call fcn.00449381
push 2
lea eax, [ebp - 0x878]
pop edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov ecx, 0x56ed30
lea esi, [ebp - 0x260]
call fcn.00401d5c
jmp 0x443974
push 0x12
lea esi, [ebp - 0x230]
mov eax, esi
push 0x56ed3c
push eax
call fcn.0052094c
add esp, 0xc
test eax, eax
jne 0x443900
push 0x12
pop eax
cmp word [esi], 0
je 0x443934
add esi, edi
dec eax
test eax, eax
jg 0x4438f1
jmp 0x443934
push 9
lea eax, [ebp - 0x230]
push str.NCH_Suite
push eax
call fcn.0052094c
add esp, 0xc
test eax, eax
jne 0x443969
push 9
pop eax
cmp word [esi], 0
je 0x443934
add esi, edi
dec eax
test eax, eax
jg 0x44391d
jmp 0x443934
cmp ax, 0x28
je 0x44393c
add esi, edi
movzx eax, word [esi]
test ax, ax
jne 0x44392c
cmp word [esi], 0x28
jne 0x443969
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x468]
push eax
call fcn.00401dde
lea eax, [ebp - 0x468]
push eax
mov eax, 0xbb8
call fcn.00449190
lea esi, [ebp - 0x260]
call fcn.00401d99
cmp dword [ebp - 0x260], 0xffffffff
jne 0x4438d2
add dword [ebp - 4], 0x208
dec dword [ebp - 8]
jne 0x4438ba
call fcn.00473059
pop edi
mov al, 1
pop esi
leave
ret
Function at 0x444a1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push edi
push str.Scheduler
lea edi, [ebp - 0x210]
call fcn.004448b2
lea eax, [ebp - 4]
push eax
push 1
push 0
mov eax, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444a8b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 8], 0x208
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x444a87
cmp edi, 0xea
jne 0x444a8b
mov al, 1
jmp 0x444a8d
xor al, al
pop edi
leave
ret 4

Function at 0x444b7f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push edi
push dword [ebp + 8]
lea edi, [ebp - 0x20c]
call fcn.004448b2
lea eax, [ebp + 8]
push eax
push 1
push 0
mov eax, edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444bee
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x208
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x444bea
cmp edi, 0xea
jne 0x444bee
mov al, 1
jmp 0x444bf0
xor al, al
pop edi
leave
ret 8

Function at 0x445435
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
inc eax
cmp dword [ebp - 0x20], 5
ja 0x44546a
jne 0x445468
cmp dword [ebp - 0x1c], eax
jne 0x445468
cmp word [ebp + 0x70], 3
jae 0x44546a
xor eax, eax
add ebp, 0x78
leave
ret
Function at 0x445716
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x82c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0
mov esi, eax
mov eax, dword [ebx]
push str.Initializing_run_on_demand...
mov ecx, ebx
call dword [eax + 0x20]
test esi, esi
je 0x445762
cmp word [esi], 0
je 0x445762
push esi
push str._s...
mov esi, 0x104
lea edi, [esp + 0x638]
call fcn.0044b138
pop ecx
pop ecx
push 1
mov ecx, edi
push ecx
jmp 0x445767
push 1
push dword [ebp + 0x10]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
test al, al
je 0x445786
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x4458b7
call fcn.004893bd
test al, al
jne 0x44579d
mov eax, dword [ebp + 8]
mov dword [eax], 2
jmp 0x4458b7
lea eax, [esp + 0x220]
push eax
call fcn.00401c20
push str..exe
push dword [ebp + 0x10]
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0044a0d6
lea ecx, [esp + 0x18]
lea eax, [esp + 0x428]
call fcn.004019a9
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x42c]
push eax
push str.audiochannel.net
push ebx
lea eax, [esp + 0x20]
push eax
call fcn.004286c5
push 2
pop esi
cmp dword [esp + 0x10], esi
jne 0x44581d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x42c]
push eax
push str.www.nch.com.au
push ebx
lea eax, [esp + 0x24]
push eax
call fcn.004286c5
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x445887
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x14], esi
call fcn.00401a98
test eax, eax
jbe 0x445887
mov eax, dword [ebx]
push 0
push str.Running_install_on_demand
mov ecx, ebx
call dword [eax + 0x20]
push dword [ebp + 0x18]
lea eax, [esp + 0x18]
push dword [ebp + 0x14]
push eax
lea eax, [esp + 0x24]
call fcn.0044546f
mov eax, dword [esp + 0x14]
push dword [ebp + 0x10]
mov edi, ebx
mov dword [esp + 0x14], eax
call fcn.004456cf
test al, al
jne 0x445872
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], 0
jne 0x445887
mov eax, dword [ebx]
push 0
push str.Completed
mov ecx, ebx
call dword [eax + 0x20]
fld1
mov eax, dword [ebx]
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call dword [eax + 0x24]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x220]
mov dword [esi], eax
call fcn.0044a673
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x445e4b
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
xor eax, eax
lea ecx, [ebp - 0x208]
push ecx
push eax
push eax
push 0x26
push eax
mov word [ebp - 0x208], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x53ec98
push esi
push 0x548c40
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
push esi
push str.Components
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.0044a0d6
push str.Shared
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 8]
call fcn.00401dde
push dword [ebp + 8]
call fcn.00401f7b
test al, al
pop esi
je 0x445ecc
mov al, 1
jmp 0x445ed4
mov ecx, dword [ebp + 8]
call fcn.0044a4b7
leave
ret 4

Function at 0x445f9b
Capabilities:
Delete directory
Delete registry key
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa48
push ebx
push esi
xor ecx, ecx
push edi
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edi, 0x548c40
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], str.NCH_Swift_Sound
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], SysReAllocString
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, edi
push esi
lea eax, [ebp - 0x228]
push str.Software_sComponents
push eax
call fcn.00401000
add esp, 0xc
push dword [ebp - 4]
lea eax, [ebp - 0x228]
call fcn.0044b530
push esi
lea eax, [ebp - 0x228]
push str.Software_s
push eax
call fcn.00401000
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
mov esi, dword [ebp + ebx*4 - 0x10]
inc ebx
test esi, esi
jne 0x445fd7
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x20]
test eax, eax
mov dword [ebp - 4], eax
jne 0x445fd3
lea eax, [ebp - 0x840]
push eax
push esi
push esi
push 0x26
push esi
mov word [ebp - 0x840], si
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x638]
call fcn.00449281
cmp word [ebp - 0x840], si
mov word [ebp - 0x430], si
mov dword [ebp - 4], esi
je 0x4460e5
lea ebx, [ebp - 0x840]
jmp 0x44607a
xor esi, esi
mov eax, edi
push eax
push ebx
lea eax, [ebp - 0x228]
push eax
call fcn.00401dde
push 0x53ec98
push str.Components
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0xa48]
push eax
call fcn.0044a0d6
mov edx, 0xbb8
lea ecx, [ebp - 0xa48]
call fcn.0044a59d
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp + esi*4 - 0x10]
inc esi
test eax, eax
jne 0x44607c
inc dword [ebp - 4]
mov ebx, dword [ebp - 4]
imul ebx, ebx, 0x208
lea ebx, [ebp + ebx - 0x840]
cmp word [ebx], ax
jne 0x446078
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446271
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov byte [ebp - 8], 0x4a
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x33
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x32
mov byte [ebp - 0xf], 0x30
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0xc], bl
xor esi, esi
mov ecx, dword [esi*4 + 0x5a524c]
lea eax, [ebp - 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4462d5
cmp dl, bl
je 0x4462d1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4462d5
inc eax
inc eax
inc ecx
inc ecx
cmp dl, bl
jne 0x4462b7
xor eax, eax
jmp 0x4462da
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4462e6
inc esi
cmp esi, 0xc
jl 0x4462ad
jmp 0x4462e9
lea edi, [esi + 1]
lea eax, [ebp - 4]
push eax
call fcn.005227bd
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.005227bd
pop ecx
pop ecx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.00446178
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4463b1
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push 0x3e8
push eax
lea esi, [ebp - 8]
call fcn.00401f2b
cmp dword [ebp - 8], 0xffffffff
je 0x4464a5
mov ebx, dword [edi + 0x219]
test ebx, ebx
mov dword [ebp - 0xc], ebx
je 0x446471
mov esi, 0x228
jmp 0x4463f6
mov ebx, dword [ebp - 0xc]
lea eax, [ebx + 4]
push eax
push str.__s__r_n
lea edi, [ebp - 0x45c]
call fcn.0044b138
pop ecx
pop ecx
mov eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044ab5a
mov ebx, dword [ebx + 0x20c]
jmp 0x446450
lea eax, [ebx + 0x20c]
push eax
lea eax, [ebx + 4]
push eax
push str._s_s_r_n
lea edi, [ebp - 0x45c]
call fcn.0044b138
add esp, 0xc
mov eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044ab5a
test ebx, ebx
je 0x446454
mov ebx, dword [ebx]
test ebx, ebx
jne 0x446420
push 0x54e638
lea eax, [ebp - 8]
push eax
call fcn.0044ab5a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x4463f3
mov edi, dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 4]
push esi
call fcn.004240c1
push esi
mov dword [edi + 0x211], eax
call fcn.00401a98
mov dword [edi + 0x215], eax
mov byte [edi + 0x210], 0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x44652b
Capabilities:
Hide graphical window

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x446548
push 0
push dword [esi + 0xde]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x446591
push ebx
push edi
push 5
push dword [esi + 0xde]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
call edi
push 0x15
mov ebx, eax
call edi
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
push 0x104
push eax
sub ecx, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
push ecx
sub eax, ebx
push eax
push 0
push dword [esi + 0xde]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
ret 8

Function at 0x446abd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5aac38]
sub esp, 0x410
cmp eax, 0xffffffff
je 0x446ade
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x5aac38], 0xffffffff
push esi
push edi
push 0x5aaa30
call fcn.00401bf4
lea eax, [ebp - 0x410]
call fcn.00449281
mov edi, str..dmp
push edi
push str.ExpressBurn_IP_768428
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0044a0d6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x208]
push eax
call esi
push edi
push str.ExpressBurn_HM_768428
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x208]
push eax
call esi
pop edi
pop esi
leave
ret
Function at 0x44742b
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
push ebx
push esi
push edi
lea edi, [ebp - 0x894]
call fcn.0042388f
call fcn.004238d1
mov dword [ebp - 0x14], eax
call fcn.0044b2a4
neg al
mov dword [ebp - 0x74], 0x40
sbb eax, eax
or dword [ebp - 0x6c], 0xffffffff
or dword [ebp - 0x68], 0xffffffff
and eax, 0x20
add eax, 0x20
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
shrd eax, ecx, 0x14
mov esi, 0x53ec98
push esi
push str.ProcessorNameString
push str.HardwareDescriptionSystemCentralProcessor0
mov dword [ebp - 0x18], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x27c]
shr ecx, 0x14
call fcn.004010db
lea ecx, [ebp - 0x27c]
call fcn.0041efd5
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x484]
call fcn.0040145f
lea eax, [ebp - 0x68c]
push eax
call fcn.00448eab
xor ebx, ebx
push str.Software
lea edi, [ebp - 0x27c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.004448b2
push str.SVar
mov eax, edi
push eax
lea eax, [ebp - 0x30]
call fcn.0044b477
mov edi, dword [ebp - 0x30]
cmp edi, ebx
jne 0x44750b
mov edi, esi
lea eax, [ebp - 0x10]
push 0x104
mov esi, eax
mov dword [ebp - 0x34], eax
call fcn.0041d38d
push edi
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xc], ebx
call fcn.004fb0d7
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x447538
mov ecx, dword [ebp - 0xc]
mov word [eax + ecx*2], bx
push dword [ebp - 0x30]
call fcn.00520947
pop ecx
call fcn.0044b250
test al, al
mov ecx, str.admin
jne 0x447554
mov ecx, 0x5708b0
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x447560
mov eax, 0x53ec98
push eax
lea eax, [ebp - 0x68c]
push eax
push ecx
push str.paid
lea eax, [ebp - 0x484]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x894]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push eax
push str.osver_s__dosbits_dappbits32memphys_dcpu_spaybld_suser_srdf_ssvnr768428svar_s
push dword [ebp + 8]
call fcn.004e5c20
add esp, 0x2c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x24]
call fcn.0045abcb
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
shrd eax, ecx, 0x14
push eax
mov eax, dword [ebp - 0x1c]
shr ecx, 0x14
mov ecx, dword [ebp - 0x18]
shrd eax, ecx, 0x14
push eax
push str.pgsize_dpgused_d
push dword [ebp + 8]
shr ecx, 0x14
call fcn.004e5c20
push dword [ebp - 0x10]
call fcn.00520947
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x447cd3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
xor ebx, ebx
cmp dword [esi], ebx
je 0x447e94
cmp dword [esi + 4], ebx
jne 0x447cfa
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x447e94
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call edi
push str.SymCleanup
push dword [esi + 4]
mov dword [esi + 0x2c], eax
call edi
push str.StackWalk64
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.SymGetOptions
push dword [esi + 4]
mov dword [esi + 0x38], eax
call edi
push str.SymSetOptions
push dword [esi + 4]
mov dword [esi + 0x24], eax
call edi
push str.SymFunctionTableAccess64
push dword [esi + 4]
mov dword [esi + 0x34], eax
call edi
push str.SymGetLineFromAddr64
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.SymGetModuleBase64
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.SymGetModuleInfo64
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
cmp eax, ebx
mov dword [esi + 0x20], eax
jne 0x447d99
call fcn.0044b365
test al, al
je 0x447d99
push str.SymGetModuleInfo
push dword [esi + 4]
call edi
mov dword [esi + 0x20], eax
push str.SymGetSymFromAddr64
push dword [esi + 4]
call edi
push str.UnDecorateSymbolName
push dword [esi + 4]
mov dword [esi + 0x28], eax
call edi
push str.SymLoadModule64
push dword [esi + 4]
mov dword [esi + 0x3c], eax
call edi
push str.SymGetSearchPath
push dword [esi + 4]
mov dword [esi + 0x30], eax
call edi
cmp dword [esi + 0x10], ebx
mov dword [esi + 0x40], eax
pop edi
je 0x447e85
cmp dword [esi + 0x14], ebx
je 0x447e85
cmp dword [esi + 0x1c], ebx
je 0x447e85
cmp dword [esi + 0x20], ebx
je 0x447e85
cmp dword [esi + 0x24], ebx
je 0x447e85
cmp dword [esi + 0x28], ebx
je 0x447e85
cmp dword [esi + 0x2c], ebx
je 0x447e85
cmp dword [esi + 0x34], ebx
je 0x447e85
cmp dword [esi + 0x38], ebx
je 0x447e85
cmp dword [esi + 0x3c], ebx
je 0x447e85
cmp dword [esi + 0x30], ebx
je 0x447e85
cmp dword [ebp + 8], ebx
je 0x447e4d
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x447e28
sub eax, edx
inc eax
push eax
call fcn.005223fb
cmp eax, ebx
pop ecx
mov dword [esi + 0xc], eax
je 0x447e4d
mov edx, dword [ebp + 8]
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
cmp cl, bl
jne 0x447e43
push ebx
push dword [esi + 0xc]
push dword [esi + 8]
call dword [esi + 0x2c]
call dword [esi + 0x24]
or eax, 0x210
push eax
call dword [esi + 0x34]
mov eax, dword [esi + 0x40]
cmp eax, ebx
mov byte [ebp - 0x400], bl
je 0x447e81
push 0x400
lea ecx, [ebp - 0x400]
push ecx
push dword [esi + 8]
call eax
mov al, 1
jmp 0x447e96
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
xor al, al
pop ebx
leave
ret 4
Function at 0x4491ce
Capabilities:
Move file

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push 0x18
mov ebx, 0xbb8
pop edi
jmp 0x4491fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x44920f
cmp ebx, edi
jbe 0x44920f
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, edi
add edi, edi
push 3
push dword [esp + 0x18]
push dword [esp + 0x18]
call esi
test eax, eax
je 0x4491e1
mov al, 1
jmp 0x449211
xor al, al
pop edi
pop esi
pop ebx
ret 8

Function at 0x449381
Capabilities:
Get common file path

Disassembly:
xor ecx, ecx
push eax
push ecx
push ecx
push 2
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
ret

Function at 0x44a500
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x44a519
xor al, al
jmp 0x44a59a
push esi
mov ecx, 0x548c7c
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.00401d5c
jmp 0x44a583
lea eax, [ebp - 0x254]
call fcn.00401dba
test al, al
jne 0x44a578
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401dde
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x44a56b
lea ecx, [ebp - 0x45c]
call fcn.0044a500
jmp 0x44a578
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.00401d99
cmp dword [ebp - 0x254], 0xffffffff
jne 0x44a52e
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret

Function at 0x44a59d
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
mov ebx, ecx
cmp word [ebx], 0
push edi
mov edi, edx
jne 0x44a5b9
xor al, al
jmp 0x44a66f
push esi
mov ecx, 0x548c7c
mov eax, ebx
lea esi, [ebp - 0x258]
call fcn.00401d5c
jmp 0x44a626
lea eax, [ebp - 0x258]
call fcn.00401dba
test al, al
jne 0x44a61b
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x460]
push eax
call fcn.00401dde
mov eax, dword [ebp - 0x254]
shr eax, 4
test al, 1
je 0x44a60d
mov edx, edi
lea ecx, [ebp - 0x460]
call fcn.0044a59d
jmp 0x44a61b
lea eax, [ebp - 0x460]
push eax
mov eax, edi
call fcn.00449190
lea esi, [ebp - 0x258]
call fcn.00401d99
cmp dword [ebp - 0x258], 0xffffffff
jne 0x44a5ce
lea esi, [edi + 0x7f]
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
shr esi, 7
jmp 0x44a661
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x44a66c
cmp eax, 3
je 0x44a66c
cmp dword [ebp - 4], esi
jbe 0x44a66c
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 4], esi
add esi, esi
push ebx
call edi
test eax, eax
je 0x44a640
mov al, 1
jmp 0x44a66e
xor al, al
pop esi
pop edi
pop ebx
leave
ret