joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452260
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], ecx
mov ecx, dword [ebp + 8]
call fcn.00414880
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00427170
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4522cd
xor al, al
jmp 0x45233f
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.00419680
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4522f8
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x45233f
push 0x22c
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.00427170
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4522cd
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 4

Function at 0x452450
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00427170
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x414]
push ecx
call fcn.00427170
add esp, 0xc
push 0
push 0x14
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x483200
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x452530
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.msyh.ttf
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4524fb
mov eax, 1
jmp 0x452532
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.msyh.ttc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x452532
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 4
Function at 0x453100
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460559
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x3c], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x44], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x54]
call fcn.0041b420
mov dword [ebp - 4], 0
push 0x4709ac
lea ecx, [ebp - 0x34]
call fcn.00405020
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x34]
call fcn.00409670
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
call fcn.00405110
push eax
mov ecx, dword [ebp - 0x40]
call sym.Install_silent.exe_public:_int___thiscall_CNsImage::GetEncoderClsid_wchar_t_const___struct__GUID__
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x54]
call fcn.0041b250
cmp dword [ebp - 0x28], 0
je 0x453222
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp - 0x2c], 0
je 0x453232
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x30], 0
je 0x453242
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov byte [ebp - 0x21], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00404fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0041b540
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 8
Function at 0x454840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_public:_bool___thiscall_CNsImage::isStop_int_
movzx edx, al
test edx, edx
jne 0x454865
jmp 0x4548d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_public:_int___thiscall_CNsImage::GetMovieIndex_int_
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45487c
jmp 0x4548d0
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.0041b680
mov dword [eax + 0x3c], 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.0041b680
mov dword [ebp - 0x10], eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push sym.Install_silent.exe_private:_static_unsigned_int___stdcall_CNsImage::MovieThread_void__
push 0
push 0
call fcn.004308aa
add esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4548d0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x455800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x455827
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp + 0xc]
push edx
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x45584e
mov eax, dword [ebp - 0xc]
jmp 0x45593e
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x455870
mov eax, dword [ebp - 0xc]
jmp 0x45593e
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x455895
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
jmp 0x45593e
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4558c2
jmp 0x455931
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.004272d0
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x455927
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0041b0f0
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x456210
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4609d6
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], ecx
push 0x470a34
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042f9b9
add esp, 8
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x268]
call fcn.00405020
mov dword [ebp - 4], 0
push 0x470a38
lea ecx, [ebp - 0x268]
call fcn.00409670
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 0x268]
call fcn.00405110
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
jne 0x4562ca
mov byte [ebp - 0x261], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00404fe0
mov al, byte [ebp - 0x261]
jmp 0x456383
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x10
je 0x4562e1
jmp 0x4562e3
jmp 0x456339
lea ecx, [ebp - 0x26c]
call fcn.004050d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x470a40
lea eax, [ebp - 0x26c]
push eax
call fcn.00405820
add esp, 0x10
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x274]
push edx
mov ecx, dword [ebp - 0x27c]
call sym.Install_silent.exe_private:_void___thiscall_CNsSkin::WriteSkin_struct__iobuf___class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x26c]
call fcn.00404fe0
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4562ca
mov edx, dword [ebp - 0x274]
push edx
call fcn.0043001a
add esp, 4
mov byte [ebp - 0x262], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00404fe0
mov al, byte [ebp - 0x262]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 8
Function at 0x4563a0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460a0e
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 0xc]
call fcn.00405110
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffff
jne 0x4563fd
jmp 0x456538
push 0
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x64]
call fcn.004050d0
mov dword [ebp - 4], 0
push 0x5c
mov ecx, dword [ebp + 0xc]
call fcn.00409270
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
push 0x2e
mov ecx, dword [ebp + 0xc]
call fcn.004092c0
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x54], 0
jle 0x456486
mov edx, dword [ebp - 0x68]
cmp edx, dword [ebp - 0x54]
jle 0x456486
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
lea edx, [ebp - 0x74]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00409d70
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x64]
call fcn.00404f80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.00404fe0
mov edx, dword [ebp - 0x5c]
push edx
call fcn.004220a8
add esp, 4
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x7c], 0
push 0
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.00427170
add esp, 0xc
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x64]
call fcn.00405110
push eax
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
push 1
push 0x40
lea ecx, [ebp - 0x50]
push ecx
call fcn.0042ff4c
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.0042ff4c
add esp, 0x10
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x80]
push eax
call fcn.00421ea8
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00404fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 8
Function at 0x456560
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x45657a
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_public:_void___thiscall_CNsSkin::FreeSkin_void_
cmp dword [ebp + 8], 0
je 0x45658c
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_public:_void___thiscall_CNsSkin::SetSkinName_wchar_t_const__
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp - 4]
call fcn.00405110
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4565ba
xor al, al
jmp 0x456623
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x458710
Capabilities:
Get http response content encoding

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460b9a
mov eax, dword fs:[0]
push eax
sub esp, 0x614
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x620], ecx
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00427170
add esp, 0xc
mov dword [ebp - 0x618], 0x200
push 0
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x1d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x458826
push 0x200
lea ecx, [ebp - 0x610]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x210]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x614]
call fcn.00405020
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x614]
call fcn.004091d0
push str.gzip
lea ecx, [ebp - 0x614]
call fcn.004194e0
test eax, eax
je 0x4587f0
push 0x470b0c
lea ecx, [ebp - 0x614]
call fcn.004194e0
test eax, eax
jne 0x458814
mov dword [ebp - 0x61c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00404fe0
mov eax, dword [ebp - 0x61c]
jmp 0x458828
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00404fe0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 4

Function at 0x458850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x1ac
push 0
mov eax, dword [ebp - 0x214]
push eax
call fcn.00427170
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call sym.Install_silent.exe_void___cdecl_GetCurPath_wchar_t__
add esp, 4
push 0x470ae4
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x470af8
lea eax, [ebp - 0x20c]
push eax
call fcn.0042f9b9
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4588e0
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 0x1ac
mov edx, dword [ebp - 0x214]
push edx
call fcn.0042fbe3
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret
Function at 0x45a500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
mov eax, dword [ebp - 0x210]
add eax, 0x10
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.update.cfg
mov edx, dword [ebp - 0x210]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x471158
mov eax, dword [ebp - 0x210]
add eax, 0x10
push eax
call fcn.0042f9b9
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x45a56d
jmp 0x45a5e1
mov dword [ebp - 0x214], 0
jmp 0x45a588
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp - 0x210]
add ecx, 0x26c
call fcn.00415100
cmp dword [ebp - 0x214], eax
jae 0x45a5d2
mov edx, dword [ebp - 0x218]
push edx
push 1
push 0x410
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x26c
call fcn.0041c170
push eax
call fcn.0042ff4c
add esp, 0x10
jmp 0x45a579
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0043001a
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret

Function at 0x45a870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0x3f4
call fcn.00421e78
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0x3f4
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00427170
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x3e8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x3ec], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x3f0], eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push sym.Install_silent.exe_private:_static_unsigned_int___stdcall_CNsUpdate::UpdateThread_void__
push 0
push 0
call fcn.004308aa
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45a900
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45b0d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x28]
cmp ecx, 9
je 0x45b0f5
movzx edx, word [ebp - 0x28]
cmp edx, 6
jne 0x45b0fe
mov eax, 1
jmp 0x45b100
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x45b110
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x47e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x448], ecx
mov eax, dword [ebp + 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xffffffff
jne 0x45b163
xor al, al
jmp 0x45b26e
push 0x428
push 0
lea ecx, [ebp - 0x438]
push ecx
call fcn.00427170
add esp, 0xc
mov dword [ebp - 0x438], 0x428
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x45b1af
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x45b26e
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x444]
call fcn.00405020
mov dword [ebp - 4], 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x444]
call fcn.004194e0
test eax, eax
je 0x45b1f1
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x444]
call fcn.004194e0
test eax, eax
jne 0x45b22a
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x424]
mov dword [edx], eax
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x439], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.00404fe0
mov al, byte [ebp - 0x439]
jmp 0x45b26e
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x45b1c5
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x43a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
call fcn.00404fe0
mov al, byte [ebp - 0x43a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004216bd
mov esp, ebp
pop ebp
ret 0xc