joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4388f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53699d
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040e3b0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x230], esi
mov dword [ebp - 4], 1
call fcn.00431ba0
mov ecx, eax
call fcn.00425c40
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040e3b0
add eax, 0x10
add esp, 4
mov dword [edi], eax
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x220], 1
jne 0x438a5e
lea ecx, [ebp - 0x219]
call fcn.00437710
test eax, eax
je 0x438a5e
cmp dword [esi - 0xc], 0
jl 0x438a5e
push eax
push esi
call fcn.004c1153
add esp, 8
test eax, eax
je 0x438a5e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x438a5e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x104
lea ecx, [ebp - 0x219]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.VendorID
call fcn.00437f90
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x438a5e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438a40
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040dbe0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x438a7a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 4
Function at 0x43a480
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536cc7
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x1c], 0
je 0x43a6b7
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0049ff30
call fcn.0040cb90
mov ecx, eax
test ecx, ecx
je 0x43a6d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x428]
call fcn.0040e280
test al, al
jne 0x43a542
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a520
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.0040dbe0
mov dword [ebp - 4], 1
call fcn.0040cb90
mov ecx, eax
test ecx, ecx
je 0x43a6db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push str.miniby3
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.0040e280
test al, al
jne 0x43a590
push 7
push str.miniby3
lea ecx, [ebp - 0x424]
call fcn.0040dbe0
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.0047c850
add esp, 0xc
mov edx, dword [ebp - 0x424]
or esi, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a5d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x428]
mov eax, esi
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a5f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
mov dword [ebp - 0x438], 1
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x104
lea ecx, [ebp - 0x429]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x438]
push eax
push 0x54d334
call fcn.004368a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43a695
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a695
push str.config.set
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x430]
push str.mini_external
push str.general
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x430]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x43a6b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040c3e0
push 0x80004005
call fcn.0040c3e0
int3
Function at 0x43bd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x59a1b8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x43be32
movzx ecx, word [esi + eax]
test cx, cx
je 0x43be32
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x43be14
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret

Function at 0x43c500
Capabilities:
Check if file exists
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
call fcn.00431d20
mov ecx, eax
call fcn.0043afc0
test eax, eax
je 0x43c5fe
call fcn.00431d20
mov ecx, eax
call fcn.00439280
test eax, eax
je 0x43c5fe
push 0
push 0
push esi
push 0x43c420
push 0
push 0
call fcn.004df790
push 0x208
mov dword [esi + 8], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c0d00
add esp, 0x24
mov dword [ebp - 0x218], 1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
lea ecx, [ebp - 0x20d]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x54d334
call fcn.0043b980
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43c5fe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43c5fe
push str.config.set
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push 0x54d310
push str.games
push str.install_config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x440750
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5378b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5917ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x74]
push 0
push 0x592c3c
push 0x592c20
mov eax, dword [edx]
push 0
push 0x3ea
push edx
call dword [eax + 0xf0]
push eax
call fcn.004c2d10
add esp, 0x14
mov ecx, dword [eax]
push 0
push 0x592c60
push 0x592c20
push 0
push 0x3ed
push eax
call dword [ecx + 0xf0]
push eax
call fcn.004c2d10
mov edx, dword [esi + 0x74]
add esp, 0x14
mov ebx, eax
mov ecx, dword [edx]
push 0
push 0x592c84
push 0x592c20
push 0
push 0x3e9
push edx
call dword [ecx + 0xf0]
push eax
call fcn.004c2d10
add esp, 0x14
mov ecx, ebx
mov edi, eax
call fcn.00499430
sub esp, 0x28
mov dword [ebp - 0x10], esp
test eax, eax
je 0x44081d
mov ecx, esp
mov dword [ecx + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 0
push str.install_tick_agreement
jmp 0x440836
mov eax, esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 1
push str.install_untick_agreement
call fcn.00420f40
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041a530
mov ecx, ebx
call fcn.00499430
push dword [0x59544c]
neg eax
sbb eax, eax
and eax, 0xffffffe8
add eax, 0x113
push eax
call fcn.0043ebd0
mov ecx, eax
call fcn.004950f0
push eax
mov ecx, edi
call fcn.00498cf0
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x74]
cmp byte [esi + 0x18c], 0
jne 0x4408a8
push 1
push 0
push 0
push str.http:__www.shanhutech.cn_index_user_agreement
push 0x54d310
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esi + 0x18c], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x441b20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537a88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5917ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi + 0xa8]
call fcn.0042ce60
mov ecx, 0x599554
call fcn.00411e20
push str.quit
call fcn.0043d8f0
add esp, 4
lea ecx, [esi + 0x8c]
call fcn.0043ce60
test eax, eax
jne 0x441bb6
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax + 0x24], 0
push 1
push 0
push str.install_r_fail
mov dword [ebp - 4], 0
call fcn.00420f40
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041a530
mov eax, dword [esi + 0x9c]
lea ecx, [esi + 0x9c]
call dword [eax + 0xc]
push str.quit_finish
call fcn.0043d8f0
add esp, 4
xor esi, esi
call fcn.00431ba0
mov ecx, eax
call fcn.004276b0
test eax, eax
mov ecx, 1
cmovne esi, ecx
call fcn.0044b0f0
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.0044b0f0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push str.Post_quit_msg.
call fcn.0043d8f0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4480d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x448148
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x4489e0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x578ae0
push 0x4c2ed0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a14
call fcn.0049bd20
mov eax, dword [0x5917ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
test esi, esi
je 0x448bb4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448a36
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x448bb4
mov dword [ebp - 4], 0
call fcn.004480d0
mov dword [ebp - 4], 0xfffffffe
jmp 0x448a7c
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.004c0d00
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.004c0d00
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x448bb4
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.004dcef6
lea eax, [ebp - 0x224]
push eax
call fcn.004dd840
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x448bb4
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
call fcn.00448200
add esp, 0xc
test eax, eax
je 0x448ba7
lea eax, [ebp - 0xa24]
push eax
call fcn.004dd840
add esp, 4
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x448b68
test dx, dx
je 0x448b64
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x448b68
add eax, 4
add ecx, 4
test dx, dx
jne 0x448b42
xor eax, eax
jmp 0x448b6d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x448ba7
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x448b93
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa24]
push eax
push str.Kill_process:__s
call fcn.0044c910
add esp, 8
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x448b04
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 4
Function at 0x448be0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x578b20
push 0x4c2ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x5917ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x448d54
cmp word [esi], 0
je 0x448d54
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448c40
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x448d54
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x448d54
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.004c0d00
push esi
push str.__s_
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.0040f720
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.004c0d00
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x54d310
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
cmp dword [ebp + 0x14], 0
je 0x448cf3
push esi
call fcn.004725c0
add esp, 4
test eax, eax
je 0x448d54
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x448d1b
cmp dword [ebp + 0x18], 0
je 0x448d1b
push dword [ebp + 0x20]
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x448d30
test esi, esi
je 0x448d40
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x448d40
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x448d5d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x448d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x448d9c
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x44a630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x59a5f8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], str.__Df6
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x44a762
movzx ecx, word [esi + eax]
test cx, cx
je 0x44a762
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44a744
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret
Function at 0x44ae60
Capabilities:
Get common file path
Get disk information
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5386fa
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], 0
test ebx, ebx
je 0x44b06b
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x220]
mov ecx, edi
push 0x104
push eax
call fcn.0044b120
test eax, eax
jne 0x44af8b
push 1
push 0x26
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [edi + 0x250]
mov dword [ebp - 4], 0
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x44af0f
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x44af25
call fcn.0040edf0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x44b089
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x250]
push dword [eax - 0xc]
push eax
push 1
lea eax, [ebp - 0x14]
push 0x54c948
push eax
call fcn.0044ac70
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x220]
push esi
push 0x104
push eax
call fcn.004dc446
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44af8b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
lea ecx, [ebp - 0x220]
push ecx
push edi
call dword [eax + 0x34]
test eax, eax
je 0x44b058
lea eax, [ebp - 0x234]
push 0x78
push eax
call fcn.0045c780
add esp, 8
mov eax, dword [ebp - 0x230]
mov esi, dword [ebp - 0x234]
mov dword [ebp - 4], 1
mov dword [ebp - 0x224], eax
cmp esi, eax
je 0x44b025
nop
mov eax, dword [0x554880]
movzx ebx, word [esi]
mov dword [ebp - 0x18], eax
mov eax, dword [0x554884]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x18], bx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x44b00e
mov eax, dword [edi]
lea ecx, [ebp - 0x220]
push ecx
push edi
mov word [ebp - 0x220], bx
call dword [eax + 0x34]
test eax, eax
je 0x44b019
add esi, 2
cmp esi, dword [ebp - 0x224]
jne 0x44afd0
mov esi, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x228]
test esi, esi
je 0x44b058
mov ecx, dword [ebp - 0x22c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x44b04e
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44b093
push ecx
push esi
call fcn.0049b8c9
add esp, 8
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.004dc51b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.0040c3e0
call fcn.004dbf83
int3
Function at 0x44b120
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44b1d8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
mov dword [ebp - 0x218], 1
lea ecx, [ebp - 0x20d]
mov dword [ebp - 0x214], 0x104
call fcn.0044a390
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0x54d334
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44b1d8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44b1d8
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.004dc51b
add esp, 0xc
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 8