joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444531
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x60]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
lea ecx, [esi + 0x78]
call fcn.0044430f
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
cmp dword [esi + 0x54], eax
jne 0x44457d
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push 0x443edb
push eax
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x54], eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x448223
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.00447e56
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xf3
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xf4
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x4ac478
push eax
call ebx
push 0xf5
push dword [esi + 4]
call edi
push 0x4ac46c
push eax
call ebx
push 0xe9
push dword [esi + 4]
call edi
push 0x4ac464
push eax
call ebx
push 0xec
push dword [esi + 4]
call edi
push 0x4ac43c
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x448ca8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.00447e56
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [eax + 9]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x30]
mov ebx, 0xe9
lea edx, [ecx + 6]
push ebx
push dword [edi + 4]
add eax, 0x3b
add ecx, 0x1a
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
call esi
mov dword [ebp - 0x24], eax
push 4
lea eax, [ebp - 0x44]
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.0043e1f9
push ebx
push dword [edi + 4]
call esi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call ebx
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + 0xa]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 0xef
push dword [edi + 4]
lea edx, [eax - 0x1e]
add ecx, 0x55
add eax, 0xfffffff8
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x24], eax
push 4
lea eax, [ebp - 0x44]
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.0043e1f9
push 0xef
push dword [edi + 4]
call esi
push 5
push eax
call ebx
push 0xf3
push dword [edi + 4]
call esi
push 0
push eax
call ebx
push 0xf4
push dword [edi + 4]
call esi
push 0x4ac5c8
push eax
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
call ebx
push 0xf5
push dword [edi + 4]
call esi
push 0x4ac5c0
push eax
call ebx
push 0xe9
push dword [edi + 4]
call esi
push 0x4ac5b8
push eax
call ebx
push 0xec
push dword [edi + 4]
call esi
push 0x4ac550
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.00401903
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x448dee
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call ebx
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.0044829a
push 0xec
push dword [edi + 4]
call esi
mov dword [ebp - 0x24], eax
push 4
lea eax, [ebp - 0x54]
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.0043e1f9
push 0xec
push dword [edi + 4]
call esi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xef
push dword [edi + 4]
call esi
push 0x4ac53c
push eax
call ebx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a65
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0047654a
leave
ret
Function at 0x449365
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4493ee
push edi
call fcn.00476464
pop ecx
test eax, eax
je 0x4493ee
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004764d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea esi, [ebp - 0x20c]
mov eax, esi
push eax
jmp 0x4493e3
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4493df
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x449400
add esi, 8
push esi
call fcn.00476464
pop ecx
cmp eax, 3
je 0x4493c7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047654a
leave
ret 4
xor eax, eax
inc eax
jmp 0x4493f0

Function at 0x449982
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44999d
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi - 0x20]
call fcn.00449856
xor eax, eax
pop esi
ret
Function at 0x44a43c
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x604]
sub esp, 0x684
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp + 0x600], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x4b28f8
push edi
lea ecx, [ebp - 0x34]
call fcn.00401903
mov ecx, dword [ebx + 0x44]
lea eax, [ebp - 0x34]
push eax
call fcn.00421530
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp + 0x3f8], ax
lea eax, [ebp + 0x3fa]
push eax
call fcn.004764d0
push 0x208
lea eax, [ebp + 0x3f8]
push 0
push eax
call fcn.004764d0
mov eax, 0x104
add esp, 0x18
cmp dword [ebp - 0x20], eax
jae 0x44a4b5
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x30]
jae 0x44a4c1
lea ecx, [ebp - 0x30]
inc eax
push eax
push ecx
lea eax, [ebp + 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp + 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [ebp + 0x3f8]
push eax
lea ecx, [ebp - 0x34]
call fcn.00401a41
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x44a4f9
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cbw
add ax, 0x41
movzx eax, ax
mov dword [ebp - 0x70], eax
xor eax, eax
push esi
push eax
mov word [ebp + 0x1f0], ax
lea eax, [ebp + 0x1f2]
push eax
call fcn.004764d0
movzx eax, word [ebp - 0x70]
push eax
lea eax, [ebp + 0x1f0]
push str._c:_
push eax
call fcn.00476d05
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
add esp, 0x18
lea eax, [ebp + 0x1f0]
push eax
mov ecx, ebx
call fcn.00449365
test eax, eax
je 0x44a577
push 0
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x70], eax
push edi
lea ecx, [ebp - 0x50]
call fcn.00401903
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x70]
mov ecx, ebx
push dword [ebp - 0x74]
call fcn.0044a20b
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
call fcn.00403c1c
mov ecx, eax
call fcn.00403cbc
push edi
lea ecx, [ebp - 0x6c]
call fcn.00401903
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x78]
cdq
push edx
push eax
mov ecx, ebx
call fcn.0044a20b
xor eax, eax
push esi
mov word [ebp - 0x18], ax
xor esi, esi
lea eax, [ebp - 0x16]
push esi
push eax
call fcn.004764d0
mov eax, dword [ebp - 0x4c]
add esp, 0xc
cmp dword [ebp - 0x38], 8
jae 0x44a5e1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x18]
push 0x4ac6cc
push eax
call fcn.00476d05
sub esp, 0x10
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00401903
mov ecx, dword [ebx + 0x48]
call fcn.0041f7f8
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.00401a65
push esi
push 1
lea ecx, [ebp - 0x50]
call fcn.00401a65
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.00401a65
mov ecx, dword [ebp + 0x600]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0047654a
add ebp, 0x604
leave
ret 0x10
Function at 0x44a9e6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x44aa05
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.0044a9b4
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x44aaea
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0xd5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
push edi
push edi
push 0xf0
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x44abc6
push ebx
push 0x50
call fcn.00476574
pop ecx
cmp eax, edi
je 0x44ab3f
mov ecx, eax
call fcn.0044e353
mov ebx, eax
jmp 0x44ab41
xor ebx, ebx
push edi
push dword [esi + 4]
mov ecx, ebx
call fcn.004389d3
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
call edi
mov eax, dword [esi + 0x24]
push 0
push 0x4ac710
push 2
push 3
mov dword [eax + 0x7c], 1
push dword [esi + 0x24]
lea ecx, [ebp - 0x78]
call fcn.00448f43
push 0
push dword [ebx + 4]
lea ecx, [ebp - 0x78]
call fcn.0043896f
mov ebx, dword [ebp - 0xc]
push 1
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x24]
and dword [eax + 0x7c], 0
cmp ebx, 2
je 0x44abab
cmp ebx, 8
jne 0x44abbd
push 0
push 1
push 0xf1
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x78]
call fcn.00448879
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0047654a
leave
ret 0x10
Function at 0x44b3fc
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b417
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x44d4ee
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x44d50d
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.0044d398
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x44ec23
Capabilities:
Create thread
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, str.u.155.com
xor ebx, ebx
push edi
mov dword [esi + 0x30], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
jne 0x44ec46
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x44ec4d
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push ebx
push ebx
push esi
push 0x44eb5d
push ebx
push ebx
mov dword [esi + 0x64], eax
call fcn.00477755
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x450490
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x4504ac
xor eax, eax
jmp 0x4504d3
push ebx
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x450224
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0x4504d0
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x4528c0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4528df
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.0045288e
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x452927
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00439605
xor edi, edi
cmp dword [eax + 0x148], edi
jne 0x4529fd
mov ecx, esi
call fcn.004520be
test eax, eax
je 0x4529ec
push ebx
push 0x50
call fcn.00476574
pop ecx
cmp eax, edi
je 0x452975
mov ecx, eax
call fcn.0044e353
mov ebx, eax
jmp 0x452977
xor ebx, ebx
push edi
push dword [esi + 4]
mov ecx, ebx
call fcn.004389d3
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
call edi
mov eax, dword [esi + 0x24]
push 0
push 0x4ac788
push 5
push 3
mov dword [eax + 0x7c], 1
push dword [esi + 0x24]
lea ecx, [ebp - 0x78]
call fcn.00448f43
push 0
push dword [ebx + 4]
lea ecx, [ebp - 0x78]
call fcn.0043896f
mov ebx, dword [ebp - 0xc]
push 1
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x24]
and dword [eax + 0x7c], 0
cmp ebx, 7
pop ebx
lea ecx, [ebp - 0x78]
jne 0x4529e7
call fcn.00448879
jmp 0x452a0f
call fcn.00448879
push 0x2d7
call fcn.004442e3
mov ecx, eax
call fcn.00444e8c
mov ecx, dword [esi + 0x24]
push 1
call fcn.00446e80
mov ecx, dword [esi + 0x24]
call fcn.004470ad
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0047654a
leave
ret 0x10

Function at 0x452caa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452d13
cmp dword [ebp + 0x10], 1
je 0x452ceb
cmp dword [ebp + 0x10], 2
je 0x452ceb
push 0xd
pop eax
jmp 0x452d13
mov eax, dword [ebp - 4]
test edi, edi
je 0x452d0d
test eax, eax
je 0x452d08
test al, 1
jne 0x452ce6
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x452d0d
jmp 0x452ce6
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x45371c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x10004]
mov eax, 0x10004
call fcn.00479650
push 0xffffffffffffffff
push 0x4a0b74
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp + 0x10000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x1000c]
mov ebx, dword [ebp + 0x10010]
and dword [ebp - 4], 0
push 0
push 0x10000
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.0045a50d
mov dword [ebp - 0x14], 0x65ef0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
call fcn.0045a716
cmp dword [esi + 0x18], 8
jb 0x45379d
mov edi, dword [esi + 4]
jmp 0x4537a0
lea edi, [esi + 4]
test edi, edi
je 0x4537b3
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4537b7
xor eax, eax
jmp 0x4537d0
lea esi, [eax + eax]
mov eax, esi
call fcn.00478fa0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00452c02
push eax
lea ecx, [ebp - 0x40]
call fcn.00402429
push eax
lea ecx, [ebp - 0x24]
call fcn.0045bbce
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004027fd
cmp dword [ebx + 0x18], 8
jb 0x4537f9
mov edi, dword [ebx + 4]
jmp 0x4537fc
lea edi, [ebx + 4]
test edi, edi
je 0x45380f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x453813
xor eax, eax
jmp 0x45382c
lea esi, [eax + eax]
mov eax, esi
call fcn.00478fa0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00452c02
push 0x4ad038
push eax
call fcn.0047a957
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x45386b
push esi
lea ecx, [ebp - 0x24]
call fcn.0045a558
push eax
push 1
lea eax, [ebp]
push eax
call fcn.0047a811
push esi
call fcn.0047a633
add esp, 0x14
mov al, 1
jmp 0x45386d
xor al, al
lea esp, [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10000]
xor ecx, ebp
call fcn.0047654a
add ebp, 0x10004
leave
ret
Function at 0x453dfa
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1d4]
sub esp, 0x254
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp + 0x1d0], eax
push ebx
push esi
mov esi, dword [ebp + 0x1dc]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x36]
push ebx
push eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.004764d0
add esp, 0xc
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x64], 0x208
mov byte [ebp - 0x55], bl
call fcn.004500b5
test eax, eax
jne 0x453f15
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x38]
push eax
push str.CommonFilesDir
lea ecx, [ebp - 0x60]
call fcn.00452caa
test eax, eax
jne 0x453f15
lea eax, [ebp - 0x38]
push eax
call fcn.00476464
pop ecx
test eax, eax
jbe 0x453f15
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x54]
call fcn.00401903
push 0x20
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00453baf
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x54]
call fcn.004019ae
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a65
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x453ed6
lea eax, [ebp - 0x50]
push eax
call fcn.0046f20b
pop ecx
test al, al
je 0x453efd
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x453eed
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004764ac
pop ecx
pop ecx
mov byte [ebp - 0x55], 1
lea ecx, [ebp - 0x60]
call fcn.0045009a
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00401a65
cmp byte [ebp - 0x55], bl
jne 0x453f57
push 0x104
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4ad124
test eax, eax
je 0x453f3c
call fcn.00476464
pop ecx
xor ecx, ecx
mov word [ebp + eax*2 - 0x38], cx
jmp 0x453f47
lea eax, [ebp - 0x38]
push eax
call fcn.004764ac
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push str.Program_FilesCommon_Files
push eax
call fcn.0047647e
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push eax
call fcn.00476464
pop ecx
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x3a]
je 0x453f86
lea eax, [ebp - 0x38]
push eax
call fcn.00476464
pop ecx
push 0x2f
pop ecx
cmp cx, word [ebp + eax*2 - 0x3a]
je 0x453f86
push str.Thunder_NetworkTP_
jmp 0x453f8b
push 0x4ad098
lea eax, [ebp - 0x38]
push eax
call fcn.0047647e
cmp dword [0x4c7b24], 8
mov eax, dword [0x4c7b10]
pop ecx
pop ecx
jae 0x453fa9
mov eax, 0x4c7b10
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0047647e
lea eax, [ebp - 0x38]
push 0x4b27d0
push eax
call fcn.0047647e
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.00401903
lea ecx, [ebp - 0x60]
call fcn.0045009a
mov ecx, dword [ebp + 0x1d0]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047654a
add ebp, 0x1d4
leave
ret
Function at 0x455963
Capabilities:
Compare security identifiers

Disassembly:
mov ecx, dword [esp + 4]
push ebx
lea ebx, [ecx + 4]
push esi
push edi
test ebx, ebx
je 0x4559a0
mov edi, dword [esp + 0x14]
lea esi, [edi + 4]
test esi, esi
je 0x4559a0
call fcn.004558fb
test al, al
je 0x4559a0
mov ecx, edi
call fcn.004558fb
test al, al
je 0x4559a0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x4559a2
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x456b76
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp + 0x1fc], eax
push esi
push edi
mov edi, dword [ebp + 0x208]
xor eax, eax
push 0x206
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
push esi
push eax
call fcn.004764d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0xc]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x456c65
push edi
push 0x4ad46c
lea ecx, [ebp - 0x80]
call fcn.00401903
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042ba05
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a65
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.004764d0
lea eax, [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.open
jae 0x456c44
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401a65
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.0047654a
add ebp, 0x200
leave
ret
Function at 0x456c7c
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp + 0x1fc], eax
push esi
push edi
mov edi, dword [ebp + 0x208]
xor eax, eax
push 0x206
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
push esi
push eax
call fcn.004764d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0xc]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x456d6b
push edi
push str._i_net_monitor.dll
lea ecx, [ebp - 0x80]
call fcn.00401903
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042ba05
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a65
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.004764d0
lea eax, [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.open
jae 0x456d4a
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401a65
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.0047654a
add ebp, 0x200
leave
ret

Function at 0x457147
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4c2f90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x4ad4d4
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00413270
push esi
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00413270
mov ecx, dword [ebp - 0x1c]
add esp, 0x18
cmp dword [ebp - 8], 8
pop edi
pop esi
jae 0x45718b
lea ecx, [ebp - 0x1c]
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x457197
lea eax, [ebp - 0x38]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a65
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401a65
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047654a
leave
ret 8