joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4432cd
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x604]
sub esp, 0x684
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp + 0x600], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x4a7dd0
push edi
lea ecx, [ebp - 0x34]
call fcn.004018ba
mov ecx, dword [ebx + 0x44]
lea eax, [ebp - 0x34]
push eax
call fcn.0041c2ed
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp + 0x3f8], ax
lea eax, [ebp + 0x3fa]
push eax
call fcn.0046d720
push 0x208
lea eax, [ebp + 0x3f8]
push 0
push eax
call fcn.0046d720
mov eax, 0x104
add esp, 0x18
cmp dword [ebp - 0x20], eax
jae 0x443346
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x30]
jae 0x443352
lea ecx, [ebp - 0x30]
inc eax
push eax
push ecx
lea eax, [ebp + 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp + 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [ebp + 0x3f8]
push eax
lea ecx, [ebp - 0x34]
call fcn.004019f8
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x44338a
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cbw
add ax, 0x41
movzx eax, ax
mov dword [ebp - 0x70], eax
xor eax, eax
push esi
push eax
mov word [ebp + 0x1f0], ax
lea eax, [ebp + 0x1f2]
push eax
call fcn.0046d720
movzx eax, word [ebp - 0x70]
push eax
lea eax, [ebp + 0x1f0]
push str._c:_
push eax
call fcn.0046df55
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
add esp, 0x18
lea eax, [ebp + 0x1f0]
push eax
mov ecx, ebx
call fcn.004420be
test eax, eax
je 0x443408
push 0
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x70], eax
push edi
lea ecx, [ebp - 0x50]
call fcn.004018ba
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x70]
mov ecx, ebx
push dword [ebp - 0x74]
call fcn.0044309c
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
call fcn.0040402d
mov ecx, eax
call fcn.004040cd
push edi
lea ecx, [ebp - 0x6c]
call fcn.004018ba
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x78]
cdq
push edx
push eax
mov ecx, ebx
call fcn.0044309c
xor eax, eax
push esi
mov word [ebp - 0x18], ax
xor esi, esi
lea eax, [ebp - 0x16]
push esi
push eax
call fcn.0046d720
mov eax, dword [ebp - 0x4c]
add esp, 0xc
cmp dword [ebp - 0x38], 8
jae 0x443472
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x18]
push 0x4a1cb4
push eax
call fcn.0046df55
sub esp, 0x10
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.004018ba
mov ecx, dword [ebx + 0x48]
call fcn.00419c93
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.00401a1c
push esi
push 1
lea ecx, [ebp - 0x50]
call fcn.00401a1c
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.00401a1c
mov ecx, dword [ebp + 0x600]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0046d79a
add ebp, 0x604
leave
ret 0x10
Function at 0x443768
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x443787
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.00443736
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret
Function at 0x4440b1
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4440cc
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret
Function at 0x4451d8
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4451f7
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.0044508f
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret
Function at 0x446843
Capabilities:
Create thread
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, str.u.155.com
xor ebx, ebx
push edi
mov dword [esi + 0x30], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
jne 0x446866
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x44686d
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push ebx
push ebx
push esi
push 0x44677d
push ebx
push ebx
mov dword [esi + 0x64], eax
call fcn.0046e4f5
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x448125
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x448141
xor eax, eax
jmp 0x448168
push ebx
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x447eb9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0x448165
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x449dbb
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x449dda
push eax
mov eax, dword [esi + 4]
push dword [eax + 4]
lea ecx, [esi - 0x20]
call fcn.00449be0
push 0
push dword [esi - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret

Function at 0x449f02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449f6b
cmp dword [ebp + 0x10], 1
je 0x449f43
cmp dword [ebp + 0x10], 2
je 0x449f43
push 0xd
pop eax
jmp 0x449f6b
mov eax, dword [ebp - 4]
test edi, edi
je 0x449f65
test eax, eax
je 0x449f60
test al, 1
jne 0x449f3e
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x449f65
jmp 0x449f3e
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x44a938
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x10004]
mov eax, 0x10004
call fcn.00470530
push 0xffffffffffffffff
push 0x4979c4
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp + 0x10000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x1000c]
mov ebx, dword [ebp + 0x10010]
and dword [ebp - 4], 0
push 0
push 0x10000
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.00451759
mov dword [ebp - 0x14], 0x65ef0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
call fcn.00451962
cmp dword [esi + 0x18], 8
jb 0x44a9b9
mov edi, dword [esi + 4]
jmp 0x44a9bc
lea edi, [esi + 4]
test edi, edi
je 0x44a9cf
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x44a9d3
xor eax, eax
jmp 0x44a9ec
lea esi, [eax + eax]
mov eax, esi
call fcn.0046fd40
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00449e5a
push eax
lea ecx, [ebp - 0x40]
call fcn.004023e0
push eax
lea ecx, [ebp - 0x24]
call fcn.00452e1a
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004027b4
cmp dword [ebx + 0x18], 8
jb 0x44aa15
mov edi, dword [ebx + 4]
jmp 0x44aa18
lea edi, [ebx + 4]
test edi, edi
je 0x44aa2b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x44aa2f
xor eax, eax
jmp 0x44aa48
lea esi, [eax + eax]
mov eax, esi
call fcn.0046fd40
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00449e5a
push 0x4a2514
push eax
call fcn.004718c7
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x44aa87
push esi
lea ecx, [ebp - 0x24]
call fcn.004517a4
push eax
push 1
lea eax, [ebp]
push eax
call fcn.00471781
push esi
call fcn.004715a3
add esp, 0x14
mov al, 1
jmp 0x44aa89
xor al, al
lea esp, [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10000]
xor ecx, ebp
call fcn.0046d79a
add ebp, 0x10004
leave
ret
Function at 0x44b016
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1d4]
sub esp, 0x254
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp + 0x1d0], eax
push ebx
push esi
mov esi, dword [ebp + 0x1dc]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x36]
push ebx
push eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.0046d720
add esp, 0xc
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x64], 0x208
mov byte [ebp - 0x55], bl
call fcn.00447d3e
test eax, eax
jne 0x44b131
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x38]
push eax
push str.CommonFilesDir
lea ecx, [ebp - 0x60]
call fcn.00449f02
test eax, eax
jne 0x44b131
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6ae
pop ecx
test eax, eax
jbe 0x44b131
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x54]
call fcn.004018ba
push 0x20
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0044adcb
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x54]
call fcn.00401965
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a1c
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x44b0f2
lea eax, [ebp - 0x50]
push eax
call fcn.0046645b
pop ecx
test al, al
je 0x44b119
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x44b109
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6f6
pop ecx
pop ecx
mov byte [ebp - 0x55], 1
lea ecx, [ebp - 0x60]
call fcn.00447d23
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00401a1c
cmp byte [ebp - 0x55], bl
jne 0x44b173
push 0x104
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4a2600
test eax, eax
je 0x44b158
call fcn.0046d6ae
pop ecx
xor ecx, ecx
mov word [ebp + eax*2 - 0x38], cx
jmp 0x44b163
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6f6
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push str.Program_FilesCommon_Files
push eax
call fcn.0046d6c8
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6ae
pop ecx
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x3a]
je 0x44b1a2
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6ae
pop ecx
push 0x2f
pop ecx
cmp cx, word [ebp + eax*2 - 0x3a]
je 0x44b1a2
push str.Thunder_NetworkTP_
jmp 0x44b1a7
push 0x4a2574
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6c8
cmp dword [0x4bc7f8], 8
mov eax, dword [0x4bc7e4]
pop ecx
pop ecx
jae 0x44b1c5
mov eax, 0x4bc7e4
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046d6c8
lea eax, [ebp - 0x38]
push 0x4a7ca8
push eax
call fcn.0046d6c8
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.004018ba
lea ecx, [ebp - 0x60]
call fcn.00447d23
mov ecx, dword [ebp + 0x1d0]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d79a
add ebp, 0x1d4
leave
ret
Function at 0x44cb9a
Capabilities:
Compare security identifiers

Disassembly:
mov ecx, dword [esp + 4]
push ebx
lea ebx, [ecx + 4]
push esi
push edi
test ebx, ebx
je 0x44cbd7
mov edi, dword [esp + 0x14]
lea esi, [edi + 4]
test esi, esi
je 0x44cbd7
call fcn.0044cb32
test al, al
je 0x44cbd7
mov ecx, edi
call fcn.0044cb32
test al, al
je 0x44cbd7
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x44cbd9
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x44dd92
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp + 0x1fc], eax
push esi
push edi
mov edi, dword [ebp + 0x208]
xor eax, eax
push 0x206
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
push esi
push eax
call fcn.0046d720
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0xc]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44de81
push edi
push 0x4a2944
lea ecx, [ebp - 0x80]
call fcn.004018ba
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004271fc
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a1c
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0046d720
lea eax, [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.open
jae 0x44de60
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401a1c
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.0046d79a
add ebp, 0x200
leave
ret
Function at 0x44de98
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x200]
sub esp, 0x280
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp + 0x1fc], eax
push esi
push edi
mov edi, dword [ebp + 0x208]
xor eax, eax
push 0x206
mov word [ebp - 0xc], ax
xor esi, esi
lea eax, [ebp - 0xa]
push esi
push eax
call fcn.0046d720
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0xc]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44df87
push edi
push str._i_net_monitor.dll
lea ecx, [ebp - 0x80]
call fcn.004018ba
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004271fc
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00401a1c
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0046d720
lea eax, [ebp - 0xc]
add esp, 0xc
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.open
jae 0x44df66
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401a1c
mov ecx, dword [ebp + 0x1fc]
pop edi
xor ecx, ebp
pop esi
call fcn.0046d79a
add ebp, 0x200
leave
ret

Function at 0x44e363
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, str.stat.dat
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040f2de
push esi
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.0040f2de
mov ecx, dword [ebp - 0x1c]
add esp, 0x18
cmp dword [ebp - 8], 8
pop edi
pop esi
jae 0x44e3a7
lea ecx, [ebp - 0x1c]
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x44e3b3
lea eax, [ebp - 0x38]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a1c
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401a1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d79a
leave
ret 8
Function at 0x44e548
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xe4
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.0044c84b
mov ecx, eax
call fcn.0045313a
mov ebx, str.cid_store.dat
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0040f2de
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp dword [ebp + 0x70], 8
jae 0x44e592
lea eax, [ebp + 0x5c]
push eax
call fcn.00466935
xor edi, edi
pop ecx
push edi
test al, al
je 0x44e5a8
xor esi, esi
inc esi
jmp 0x44e6ee
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x54], 7
call fcn.00401ca3
lea eax, [ebp + 0x3c]
push eax
call fcn.00453b90
xor esi, esi
inc esi
pop ecx
test al, al
je 0x44e676
lea eax, [ebp + 0x3c]
push eax
call fcn.0045381a
lea ecx, [ebp - 0x6c]
mov dword [esp], 0x4a2a04
call fcn.004018ba
push eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004271fc
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp + 0x3c]
call fcn.00401965
push edi
push esi
lea ecx, [ebp - 0x50]
call fcn.00401a1c
push edi
push esi
lea ecx, [ebp - 0x6c]
call fcn.00401a1c
push ebx
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0040f2de
mov ecx, dword [ebp + 0x5c]
add esp, 0xc
cmp dword [ebp + 0x70], 8
jae 0x44e632
lea ecx, [ebp + 0x5c]
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x44e63e
lea eax, [ebp + 0x24]
push ecx
push eax
call fcn.00466a9f
pop ecx
pop ecx
test eax, eax
je 0x44e66c
cmp dword [ebp + 0x70], 8
mov ecx, dword [ebp + 0x5c]
jae 0x44e657
lea ecx, [ebp + 0x5c]
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x44e663
lea eax, [ebp + 0x24]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push esi
lea ecx, [ebp + 0x20]
call fcn.00401a1c
push edi
lea ecx, [ebp + 4]
mov dword [ebp + 0x1c], 7
call fcn.00401ca3
lea eax, [ebp + 4]
push eax
call fcn.00453a9d
pop ecx
test al, al
je 0x44e6d9
lea eax, [ebp + 4]
push eax
call fcn.0045381a
push ebx
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040f2de
mov ecx, dword [ebp + 0x5c]
add esp, 0x10
cmp dword [ebp + 0x70], 8
jae 0x44e6ba
lea ecx, [ebp + 0x5c]
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x44e6c6
lea eax, [ebp - 0x30]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push esi
lea ecx, [ebp - 0x34]
call fcn.00401a1c
push edi
push esi
lea ecx, [ebp + 4]
call fcn.00401a1c
push edi
push esi
lea ecx, [ebp + 0x3c]
call fcn.00401a1c
push edi
push esi
lea ecx, [ebp + 0x58]
call fcn.00401a1c
push edi
push esi
lea ecx, [ebp - 0x18]
call fcn.00401a1c
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d79a
add ebp, 0x78
leave
ret
Function at 0x44eeb9
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
mov dword [ebp - 0x48], eax
call fcn.0045381a
push esi
call fcn.0045381a
xor ebx, ebx
pop ecx
pop ecx
cmp dword [esi + 0x14], ebx
je 0x44eeff
cmp dword [esi + 0x18], 8
jb 0x44eef5
mov eax, dword [esi + 4]
jmp 0x44eef8
lea eax, [esi + 4]
push eax
call fcn.0046649e
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0040d9a4
push str.bootstrap.dat
lea ecx, [ebp - 0x20]
call fcn.004018ba
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040da6b
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a1c
push str.dhtnodes.dat
lea ecx, [ebp - 0x20]
call fcn.004018ba
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040da6b
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a1c
push str.nodes.dat
lea ecx, [ebp - 0x20]
call fcn.004018ba
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040da6b
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a1c
push str.server.met
lea ecx, [ebp - 0x20]
call fcn.004018ba
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040da6b
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a1c
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x44]
call fcn.0040ebaf
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.0040ebaf
jmp 0x44f021
lea ecx, [ebp - 0x44]
call fcn.0040e287
push eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x20]
push eax
call fcn.004271fc
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0040e287
push eax
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.004271fc
mov ecx, dword [ebp - 0x38]
add esp, 0xc
cmp dword [ebp - 0x24], 8
jae 0x44eff0
lea ecx, [ebp - 0x38]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44effc
lea eax, [ebp - 0x1c]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push edi
lea ecx, [ebp - 0x3c]
call fcn.00401a1c
push ebx
push edi
lea ecx, [ebp - 0x20]
call fcn.00401a1c
lea ecx, [ebp - 0x44]
call fcn.00403d84
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x44]
call fcn.00403db3
test al, al
je 0x44efb6
lea ecx, [ebp - 0x60]
call fcn.0040df35
push dword [ebp - 0x60]
call fcn.0046d271
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d79a
leave
ret 8
Function at 0x4531c6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0x3c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [ebp - 0x24], 7
call fcn.00401ca3
lea eax, [ebp - 0x3c]
push eax
call fcn.00434a22
mov ecx, eax
call fcn.004329ae
push str.dl_uac_tool.dll
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f2de
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x453229
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x45327f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetSingleProcessUseDir
push ebx
call edi
push str.GetProfileDir
push ebx
mov dword [esi], eax
call edi
push str.GetComponentsDir
push ebx
mov dword [esi + 4], eax
call edi
push str.GetSingleProcessUseDir
push ebx
mov dword [esi + 8], eax
call edi
push str.SetMultiProcessUseDir
push ebx
mov dword [esi + 0xc], eax
call edi
push str.GetMultiProcessUseDir
push ebx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a1c
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401a1c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d79a
leave
ret

Function at 0x4534c9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4b7f60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4bcacc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 8
xor ecx, ecx
pop ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
cmp dword [0x4bcae0], ebx
jae 0x4534ff
mov eax, 0x4bcacc
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push eax
push closesocket
lea ecx, [ebp - 0x28]
call fcn.004533d5
test eax, eax
jne 0x4535c7
push str.AppName
lea ecx, [ebp - 0x20]
call fcn.004018ba
cmp dword [edi + 0x18], ebx
jb 0x453535
mov edi, dword [edi + 4]
jmp 0x453538
add edi, 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x453543
lea eax, [ebp - 0x1c]
push 1
push edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0045342f
push str.AppPath
lea ecx, [ebp - 0x20]
call fcn.004019f8
cmp dword [esi + 0x18], ebx
jb 0x453566
mov esi, dword [esi + 4]
jmp 0x453569
add esi, 4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x453574
lea eax, [ebp - 0x1c]
push 1
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0045342f
push 0x4a2f18
lea ecx, [ebp - 0x20]
call fcn.004019f8
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x453598
lea eax, [ebp - 0x1c]
push 4
lea ecx, [ebp - 0x2c]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x28]
call fcn.00447d23
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401a1c
lea ecx, [ebp - 0x28]
call fcn.00447d23
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0046d79a
leave
ret