joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4429da
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x4b4710
call fcn.00461a91
push 4
pop eax
mov dword [ebp - 0x34], eax
xor edi, edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
lea eax, [ebp - 0x34]
push eax
push str.InstallException
push 0x4d21f4
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x442a29
cmp dword [ebp - 0x2c], 0xff
jne 0x442a29
mov byte [0x64], 0x64
call fcn.00442ab2
test al, al
jne 0x442aac
call fcn.00442ab2
test al, al
jne 0x442a4b
mov ecx, 0x4f72fc
call fcn.00403c8e
mov eax, dword [eax]
mov esi, dword [eax]
jmp 0x442a4d
mov esi, edi
lea ecx, [ebp - 0x28]
call fcn.004428b9
mov ebx, eax
mov dword [ebp - 4], edi
call fcn.00442ab2
test al, al
jne 0x442a72
mov ecx, 0x4f72fc
call fcn.00403c8e
mov eax, dword [eax]
mov edi, dword [eax + 0x1c]
push edi
mov edx, ebx
mov ecx, esi
call fcn.004428f6
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00405118
cmp esi, 2
jl 0x442aac
cmp esi, 3
jle 0x442aa2
lea eax, [esi - 7]
cmp eax, 1
ja 0x442aac
mov ecx, 0x4d28f0
jmp 0x442aa7
mov ecx, str.http:__ie.sogou.com
call fcn.0044955d
call fcn.00461a3b
ret

Function at 0x44310b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [0x4f5198]
push edi
test ecx, ecx
je 0x443136
mov eax, dword [esi + 4]
xor ebx, ebx
test eax, eax
jne 0x443131
mov dword [esi + 4], ecx
mov eax, ecx
mov byte [esi + 8], bl
mov edi, dword [ebp + 0x10]
jmp 0x443191
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x10]
push 3
push 1
push 0x80000000
call fcn.00404e0f
push eax
mov ecx, edi
call fcn.00407348
test al, al
je 0x4431ec
push ecx
push dword [edi]
mov ecx, esi
call fcn.0044e7c3
test al, al
je 0x4431ec
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.004088e7
test al, al
je 0x44318b
lea eax, [ebp - 8]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
jne 0x443199
mov eax, ebx
jmp 0x4431a5
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4431ec
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax + 0x98], ebx
je 0x4431bf
mov ebx, dword [ecx + eax + 0x9c]
sub eax, ebx
push 0x1738
lea ecx, [eax - 0x1738]
add ecx, edi
push ecx
push 0x4f51a0
call fcn.00462840
add esp, 0xc
cmp dword [0x4f51a0], 0x19860403
jne 0x4431ec
mov al, 1
jmp 0x4431ee
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x443d27
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x4b4955
call fcn.00461a91
mov esi, ecx
mov bl, byte [ebp + 8]
test bl, bl
jne 0x443d99
push edx
lea eax, [ebp - 0x28]
push str.SoftWare_
push eax
call fcn.00407674
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
add esp, 0xc
push 4
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x4d2a0c
call fcn.00404e0f
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
movzx ebx, bl
inc eax
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x2c], 0
cmovne ebx, eax
call fcn.00405118
test bl, bl
je 0x443dc1
push 0xb0
call fcn.004612cd
pop ecx
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0044395c
or dword [ebp - 4], 0xffffffff
push esi
mov dword [0x4f68d8], eax
call fcn.00443a0d
call fcn.00461a3b
ret

Function at 0x4444bb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x4444e4
xor eax, eax
jmp 0x4445af
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x444510
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x444510
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x4445af
cmp dword [esi + 0x4c], 0
je 0x4445ac
mov ecx, esi
call fcn.00444b6d
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x44453d
push dword [esi + 0x4c]
push ebx
call fcn.00472558
pop ecx
pop ecx
cmp ax, di
je 0x4445ac
movzx edi, bx
jmp 0x4445ac
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4445ac
cmp eax, 1
jle 0x44457a
cmp eax, 3
jne 0x4445ac
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x44452c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x44459d
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.004734fe
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x4445ac
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x34], eax
mov ax, bx
jne 0x4445af
mov ax, di
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461014
leave
ret 4
Function at 0x444bf7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x444c7d
cmp byte [esi + 0x3e], 0
je 0x444c7d
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x444c4f
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x444c53
sub eax, 1
je 0x444c57
dec eax
sub eax, 1
je 0x444c7d
xor al, al
jmp 0x444c7f
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x444c74
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004734fe
add esp, 0x10
cmp edi, eax
jne 0x444c4f
cmp byte [esi + 0x3e], 0
sete al
jmp 0x444c7f
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00461014
leave
ret
Function at 0x446231
Capabilities:
Enumerate processes

Disassembly:
push 0x2a0
mov eax, 0x4b4c25
call fcn.00461a91
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 0x2a4], ecx
push 0
push 2
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4463cf
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x29c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4463c0
mov ecx, dword [ebp - 0x2a4]
xor edi, edi
call fcn.00405868
test eax, eax
jle 0x4463b2
and dword [ebp - 0x2a0], edi
mov ecx, dword [ebp - 0x2a4]
call fcn.00403c8e
mov ecx, dword [eax]
add ecx, dword [ebp - 0x2a0]
call fcn.00404e0f
push eax
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x44637e
mov eax, dword [ebp - 0x2a8]
test eax, eax
je 0x4463b0
push eax
lea ecx, [ebp - 0x58]
call fcn.00404d2c
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041310c
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00405118
push dword [ebp - 0x294]
mov ecx, 0x410
call fcn.0044b587
mov dword [ebp - 0x2ac], eax
test eax, eax
je 0x446372
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.00446713
mov ecx, dword [ebp - 0x2ac]
mov byte [ebp - 4], 3
call fcn.0044b48f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041310c
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00405cfe
lea ecx, [ebp - 0x70]
call fcn.00405118
push 0
lea ecx, [ebp - 0x40]
call fcn.00404e0f
push eax
lea ecx, [ebp - 0x28]
call fcn.00416ec5
lea ecx, [ebp - 0x28]
cmp eax, 0xffffffff
je 0x44639b
call fcn.00405118
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00405118
mov ecx, dword [ebp - 0x2a4]
inc edi
add dword [ebp - 0x2a0], 0x18
call fcn.00405868
cmp edi, eax
jl 0x44629b
jmp 0x4463b2
mov bl, 1
call fcn.00405118
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00405118
jmp 0x4463b2
mov bl, 1
lea eax, [ebp - 0x29c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x446280
mov ecx, esi
call fcn.0044b48f
mov al, bl
call fcn.00461a3b
ret
Function at 0x446837
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
imul eax, edx, 0x3e8
mov esi, ecx
or ecx, 0xffffffff
xor ebx, ebx
test edx, edx
cmove eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x446871
cmp dword [ebp + 8], 0
mov bl, 1
je 0x446879
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x446879
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x44687f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp byte [0x4f71d0], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x4468cc
call fcn.004151ff
cmp eax, 5
jg 0x4468cc
push str.RunProcessAsAdmin_InXP_
xor esi, esi
push esi
call fcn.00443e68
pop ecx
pop ecx
push dword [ebp + 0x14]
push esi
push edi
push ebx
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
xor ebx, ebx
cmp esi, 0x20
setg bl
jmp 0x446914
mov eax, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0x20], eax
xor eax, eax
push 7
mov dword [ebp - 0x28], edi
lea edi, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [ebp - 4]
lea ebx, [eax - 1]
neg ebx
sbb ebx, ebx
inc ebx
test ebx, ebx
je 0x446945
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x446928
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [edi], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x44693e
mov edx, dword [edx]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00446837
pop ecx
pop ecx
mov ecx, esi
call fcn.0044b48f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x4472d0
Capabilities:
Check mutex on windows

Disassembly:
push 0x620
mov eax, 0x4b4cd7
call fcn.00461a91
mov edi, ecx
xor ebx, ebx
inc ebx
test dl, dl
je 0x44733e
lea ecx, [ebp - 0x21c]
call fcn.0040a6f3
push 0x20
lea eax, [ebp - 0x21c]
xor esi, esi
push edi
push eax
mov dword [ebp - 4], esi
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414a8b
pop ecx
pop ecx
lea ecx, [ebp - 0x21c]
call fcn.00414c36
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
mov esi, eax
mov dword [ebp - 0x62c], esi
call fcn.0040a6d0
jmp 0x447395
lea ecx, [ebp - 0x628]
call fcn.0040a6f3
push edi
lea eax, [ebp - 0x628]
mov dword [ebp - 4], ebx
push str.Global_
push eax
call fcn.0040a68b
pop ecx
pop ecx
push eax
call fcn.0040a68b
pop ecx
pop ecx
lea ecx, [ebp - 0x628]
call fcn.0040a840
push eax
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x628]
mov esi, eax
mov dword [ebp - 0x62c], esi
call fcn.0040a6d0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4473b3
call edi
cmp eax, 0xb7
jne 0x4473b3
mov ecx, esi
call fcn.0044b48f
mov eax, ebx
jmp 0x4473cd
call edi
cmp eax, 5
je 0x4473af
lea eax, [ebp - 0x62c]
mov ecx, 0x4f7308
push eax
call fcn.0044694c
xor eax, eax
call fcn.00461a3b
ret

Function at 0x447408
Capabilities:
Read file via mapping

Disassembly:
push esi
push str.LocalSEInstallerPreUpdatePID
push 4
xor esi, esi
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x447447
push 4
push esi
push esi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x447447
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop esi
ret

Function at 0x447449
Capabilities:
Read file via mapping
Terminate process

Disassembly:
push esi
push edi
push str.LocalSEInstallerPreUpdatePID
xor esi, esi
mov edi, 0xf001f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
je 0x4474a9
push 4
push esi
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x4474a9
cmp dword [esi], 0
je 0x4474a9
push dword [esi]
xor ecx, ecx
inc ecx
call fcn.0044b587
mov edi, eax
test edi, edi
je 0x4474a2
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call fcn.0044b48f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
ret
Function at 0x4474d2
Capabilities:
Move file

Disassembly:
push 0x42c
mov eax, 0x4b4d12
call fcn.00461a91
mov esi, ecx
call fcn.00404e0f
mov ecx, eax
call fcn.0044b561
test eax, eax
jne 0x4474fa
mov al, 1
jmp 0x44762a
mov ecx, esi
call fcn.00404e0f
mov ecx, eax
call fcn.0044b46f
test eax, eax
jne 0x4474f3
mov ecx, esi
call fcn.00404e0f
mov edi, eax
push 0x5c
push edi
call fcn.0040dbbf
pop ecx
pop ecx
test eax, eax
je 0x447528
add eax, 2
jmp 0x44752a
mov eax, edi
push 0x4d2c1c
push eax
call fcn.004642d8
pop ecx
pop ecx
test eax, eax
je 0x44756c
mov ecx, eax
call fcn.004474ac
test al, al
je 0x44756c
mov ecx, esi
call fcn.00404e0f
mov ecx, eax
call fcn.0044b46f
test eax, eax
jne 0x4474f3
push 4
mov ecx, esi
call fcn.00404e0f
xor edx, edx
mov ecx, eax
call fcn.0044b4fa
jmp 0x4474f3
lea ecx, [ebp - 0x438]
call fcn.0040a6f3
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404dc9
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov byte [ebp - 4], bl
call fcn.00449472
lea eax, [ebp - 0x28]
push eax
push 0x4cf7d8
lea eax, [ebp - 0x438]
push esi
push eax
call fcn.00405abb
pop ecx
pop ecx
push eax
call fcn.0040a68b
pop ecx
pop ecx
push eax
call fcn.00405abb
pop ecx
pop ecx
mov ecx, esi
call fcn.00404e0f
mov ecx, eax
call fcn.0044b531
lea ecx, [ebp - 0x438]
call fcn.0040a840
push eax
mov ecx, esi
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x447613
lea ecx, [ebp - 0x438]
call fcn.0040a840
mov ecx, eax
call fcn.0044b46f
test eax, eax
jne 0x447615
push 4
lea ecx, [ebp - 0x438]
call fcn.0040a840
xor edx, edx
mov ecx, eax
call fcn.0044b4fa
jmp 0x447615
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.00405118
lea ecx, [ebp - 0x438]
call fcn.0040a6d0
mov al, bl
call fcn.00461a3b
ret

Function at 0x447780
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00404e0f
xor dl, dl
mov ecx, eax
call fcn.00415c2f
mov ecx, edi
test al, al
jne 0x4477b9
call fcn.00404e0f
push eax
push str.File__s_is_not_exist
push 2
call fcn.00443e68
add esp, 0xc
xor al, al
jmp 0x447815
mov edx, esi
call fcn.004480a2
test al, al
jne 0x447813
mov ecx, esi
call fcn.004474d2
mov ecx, esi
call fcn.0044763f
test al, al
je 0x4477b5
push 0
mov ecx, esi
call fcn.00404e0f
push eax
mov ecx, edi
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x447813
mov ecx, esi
call fcn.00404e0f
push eax
mov ecx, edi
call fcn.00404e0f
push eax
push 0x4d2c90
push 2
call fcn.00443e68
add esp, 0x10
jmp 0x4477b5
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447c49
Capabilities:
Delete directory

Disassembly:
push 0x2c4
mov eax, 0x4b4e16
call fcn.00461a91
mov esi, edx
mov dword [ebp - 0x2c8], esi
mov ebx, ecx
mov dword [ebp - 0x2d0], ebx
push 0x250
lea eax, [ebp - 0x2c0]
push 0
push eax
call fcn.00464590
add esp, 0xc
lea ecx, [ebp - 0x58]
push ebx
call fcn.00405d78
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0x4cf7b0
call fcn.00403f40
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x58]
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x2c4], edi
cmp edi, 0xffffffff
je 0x447e2f
mov ecx, esi
call fcn.00405868
xor bl, bl
mov dword [ebp - 0x2cc], eax
xor esi, esi
test eax, eax
je 0x447d13
xor edi, edi
mov ecx, dword [ebp - 0x2c8]
call fcn.00403c8e
mov ecx, dword [eax]
add ecx, edi
call fcn.00404e0f
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
je 0x447d0b
inc esi
add edi, 0x18
cmp esi, dword [ebp - 0x2cc]
jb 0x447cd6
jmp 0x447d0d
mov bl, 1
mov edi, dword [ebp - 0x2c4]
test bl, bl
jne 0x447e14
push 0x4cf78c
push dword [ebp - 0x2d0]
lea eax, [ebp - 0x70]
push eax
call fcn.00403d38
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 1
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403de8
add esp, 0x18
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.00405118
test byte [ebp - 0x2c0], 0x10
je 0x447e00
lea eax, [ebp - 0x294]
push 0x4cf7dc
push eax
call fcn.004736f3
pop ecx
pop ecx
test eax, eax
je 0x447e00
lea eax, [ebp - 0x294]
push 0x4cf7d8
push eax
call fcn.004736f3
pop ecx
pop ecx
test eax, eax
je 0x447e00
lea ecx, [ebp - 0x40]
call fcn.00404e0f
push eax
lea ecx, [ebp - 0x28]
call fcn.00404d2c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0044798e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00405118
lea ecx, [ebp - 0x40]
call fcn.00404e0f
push eax
lea ecx, [ebp - 0x28]
call fcn.00404d2c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x447df6
push 4
lea ecx, [ebp - 0x28]
call fcn.00404e0f
xor edx, edx
mov ecx, eax
call fcn.0044b4fa
lea ecx, [ebp - 0x28]
call fcn.00405118
jmp 0x447e08
lea ecx, [ebp - 0x40]
call fcn.004474d2
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00405118
lea edx, [ebp - 0x2c0]
mov ecx, edi
call fcn.0044b4af
mov esi, dword [ebp - 0x2c8]
test eax, eax
jne 0x447cbf
mov ecx, edi
call fcn.0044b4d4
lea ecx, [ebp - 0x58]
call fcn.00405118
call fcn.00461a3b
ret
Function at 0x447e44
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov edx, 0x100
lea eax, [ebp - 0x20c]
push edx
push eax
push edx
lea eax, [ebp - 0x40c]
xor esi, esi
push eax
push edx
lea eax, [ebp - 0x60c]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
call fcn.00404e0f
push eax
call fcn.0046a164
add esp, 0x24
test eax, eax
jne 0x447ec6
push esi
push esi
lea eax, [ebp - 0x610]
mov dword [ebp - 0x614], esi
push eax
lea eax, [ebp - 0x614]
mov dword [ebp - 0x610], esi
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x447ec6
mov esi, dword [ebp - 0x610]
imul esi, dword [ebp - 0x614]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00461014
leave
ret

Function at 0x447ed5
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
lea eax, [ebp - 0xc]
push esi
push esi
push esi
push esi
push esi
push esi
push 3
push eax
call fcn.00404e0f
push eax
call fcn.0046a164
add esp, 0x24
test eax, eax
jne 0x447f33
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x447f33
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.004ae5d0
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [0x4d4c50]
jmp 0x447f36
xorps xmm0, xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00461014
leave
ret

Function at 0x447f43
Capabilities:
Get disk information

Disassembly:
push 0x1c
mov eax, 0x4b1207
call fcn.00461a91
mov esi, ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404d2c
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00405bc9
test al, al
jne 0x447fa1
lea ecx, [ebp - 0x28]
call fcn.00403bbd
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
je 0x447f86
push ecx
lea ecx, [ebp - 0x28]
call fcn.004061e5
lea ecx, [ebp - 0x28]
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x447f9f
cmp eax, 2
jne 0x447fa1
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00405118
mov al, bl
call fcn.00461a3b
ret

Function at 0x44838e
Capabilities:
Create directory

Disassembly:
push esi
xor dl, dl
mov esi, ecx
call fcn.004482f5
mov ecx, esi
call fcn.00404e0f
mov ecx, eax
pop esi
jmp fcn.00416555
Function at 0x4487b3
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x23c
mov eax, 0x4b4f95
call fcn.00461a91
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.00464590
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.SESelfCleaning.exe
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0040b2d7
add esp, 0xc
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x23c]
mov esi, dword [0x4f7440]
call fcn.00404e0f
push ebx
push 0x80
push 2
push ebx
push 2
mov edx, 0x40000000
mov ecx, eax
call fcn.0044b3e9
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
je 0x4488f7
push 0x4d3028
movzx eax, si
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], ebx
push ecx
mov ecx, dword [ebp - 0x248]
mov edx, edi
push eax
call fcn.0044b432
mov ecx, dword [ebp - 0x248]
call fcn.0044b48f
lea ecx, [ebp - 0x23c]
call fcn.00404e0f
mov ecx, eax
call fcn.0044b561
test eax, eax
je 0x4488f7
push ebx
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 1
push eax
push ebx
push 0x4cc960
lea ecx, [ebp - 0x23c]
call fcn.00404e0f
xor edx, edx
mov ecx, eax
call fcn.0044687f
lea ecx, [ebp - 0x23c]
call fcn.004474d2
push dword [ebp - 0x240]
push str.Called_Bypass_EXE__Ret__d
push ebx
call fcn.00443e68
add esp, 0x1c
cmp dword [ebp - 0x240], ebx
sete bl
jmp 0x448912
lea ecx, [ebp - 0x23c]
call fcn.00404e0f
push eax
push str.Release_force_exe_failed__s
push 2
call fcn.00443e68
add esp, 0xc
lea ecx, [ebp - 0x23c]
call fcn.00405118
mov al, bl
call fcn.00461a3b
ret
Function at 0x4490c7
Capabilities:
Delete registry key

Disassembly:
push 0x40
mov eax, 0x4b5101
call fcn.00461a91
mov edi, edx
mov dword [ebp - 0x4c], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
mov ebx, dword [ebp + 0xc]
push edi
call fcn.00404d2c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0x4cf78c
call fcn.00403f40
push esi
lea ecx, [ebp - 0x40]
call fcn.00403f40
push edi
lea ecx, [ebp - 0x28]
call fcn.00404d2c
push 0x4cf78c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00403f40
push ebx
lea ecx, [ebp - 0x28]
call fcn.00403f56
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
and dword [ebp - 0x48], 0
xor bl, bl
push eax
push ecx
push ecx
lea ecx, [ebp - 0x40]
call fcn.00404e0f
mov esi, dword [ebp - 0x4c]
mov edx, eax
mov ecx, esi
call fcn.0044b38a
add esp, 0xc
test eax, eax
jne 0x4491e0
lea ecx, [ebp - 0x28]
call fcn.00404e0f
mov edx, eax
mov ecx, esi
call fcn.00419478
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404e0f
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4491c8
xor esi, esi
push esi
push dword [ebp - 0x48]
push esi
push dword [ebp - 0x44]
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
test eax, eax
sete bl
test eax, eax
jne 0x4491c8
mov ecx, dword [0x4f68dc]
test ecx, ecx
je 0x4491ba
cmp dword [ecx + 0x84], esi
je 0x4491ba
mov eax, dword [ecx]
push 0x4cf2f0
push dword [ebp - 0x44]
push ecx
call dword [eax + 0x84]
jmp 0x4491c8
push 0x4cf2f0
push dword [ebp - 0x44]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x4491d4
call fcn.0044b3c8
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x4491e0
call fcn.0044b3c8
lea ecx, [ebp - 0x28]
call fcn.00405118
lea ecx, [ebp - 0x40]
call fcn.00405118
mov al, bl
call fcn.00461a3b
ret