joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ff70
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
cmp ebp, dword [esi + 0x10]
ja 0x44ff93
test ebp, ebp
jne 0x44ff89
lea eax, [ebp + 1]
pop ebp
add esp, 0xc
ret
mov dword [esi + 0x14], ebp
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [esp + 8], eax
lea eax, [ebp + ebp*2]
add eax, eax
add eax, eax
push edi
push eax
test ecx, ecx
je 0x44ffb5
push edx
call ecx
add esp, 8
jmp 0x44ffbd
call fcn.005e6b8f
add esp, 4
mov edi, eax
test edi, edi
jne 0x44ffcc
lea eax, [edi + 1]
pop edi
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
add ecx, ecx
add ecx, ecx
push ecx
push edx
push edi
call fcn.005e4a20
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
add esp, 0xc
test eax, eax
je 0x45000c
push eax
test ecx, ecx
je 0x450004
push edx
call ecx
add esp, 8
jmp 0x45000c
call fcn.005e69ed
add esp, 4
push ebx
mov ebx, dword [esi + 0x10]
mov dword [esi + 0xc], edi
cmp ebx, ebp
jae 0x450058
lea ecx, [ebx + ebx*2]
lea edi, [edi + ecx*4]
lea ecx, [ecx]
push 0
push 0
push edi
push 0x450b60
push 0
push 0
mov dword [edi + 8], esi
mov dword [edi + 4], 0x44fc10
call fcn.005e5a5a
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x450050
call fcn.005eb8db
cmp dword [eax], 0
jne 0x450067
inc ebx
add edi, 0xc
cmp ebx, ebp
jb 0x450020
pop ebx
pop edi
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
xor eax, eax
pop ebp
add esp, 0xc
ret
mov dword [esi + 0x10], ebx
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0xc
ret
Function at 0x450fe0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x45100d
cmp dword [ebp - 4], 0x80010106
je 0x45100d
mov eax, dword [ebp - 4]
jmp 0x4510b9
mov eax, dword [ebp - 8]
push eax
push 0x61ab98
push 1
push 0
push 0x61ab88
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x451044
mov ecx, dword [ebp - 4]
push ecx
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.005bead0
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x4510b9
mov edx, dword [ebp - 8]
add edx, 4
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x1c]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x45107c
mov eax, dword [ebp - 4]
push eax
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.005bead0
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x4510b9
mov ecx, dword [ebp - 8]
add ecx, 8
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x1c]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4510b6
mov edx, dword [ebp - 4]
push edx
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.005bead0
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x4510b9
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4515e0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x45160a
cmp dword [ebp - 4], 0x80010106
je 0x45160a
mov eax, dword [ebp - 4]
jmp 0x45167c
mov eax, dword [ebp - 8]
push eax
push 0x61abd8
push 1
push 0
push 0x61abc8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x451641
mov ecx, dword [ebp - 4]
push ecx
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.005bead0
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x45167c
mov edx, dword [ebp - 8]
add edx, 4
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x48]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x451679
mov eax, dword [ebp - 4]
push eax
push str.get_Rules_failed:_0x_08lx_n
call fcn.005bead0
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x45167c
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x451cc0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
lea eax, [ebp - 0x520]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x520]
push ecx
call fcn.00451e90
add esp, 8
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x451d1a
push 0
push 0x14
push 0x61ac08
push str._DWORD_fname___1
call fcn.005bede0
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x520]
push edx
call fcn.005c0800
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x451d52
lea ecx, [ebp - 0x520]
push ecx
push str.failed_to_get_crc_for__s_n
call fcn.005beca0
add esp, 8
push str.2.0.8
mov edx, dword [ebp - 4]
push edx
push str._s__s.exe
lea eax, [ebp - 0x628]
push eax
call fcn.00451eb0
add esp, 0x10
push 0
lea ecx, [ebp - 0x628]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x451d9e
lea eax, [ebp - 0x628]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.unable_to_copy__s___s_n
call fcn.005beca0
add esp, 0xc
push 0x2f
push str.http:__147.50.253.4_SB_STUDIO_updater_wzupd.xml
call fcn.00451e90
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x451dcc
push 0
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.005bede0
add esp, 0x10
push 0x61aca4
mov eax, dword [ebp - 8]
add eax, 1
push eax
call fcn.005bf910
add esp, 8
mov dword [ebp - 0xc], eax
push str._p__n
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005e5161
add esp, 8
mov edx, dword [ebp - 0x414]
push edx
push str.2.0.8
mov eax, dword [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x628]
push ecx
push str.http:__147.50.253.4_SB_STUDIO_updater_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
mov edx, dword [ebp - 0xc]
push edx
call fcn.005e5161
add esp, 0x1c
push str.__p__n
mov eax, dword [ebp - 0xc]
push eax
call fcn.005e5161
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005e50e5
add esp, 4
lea edx, [ebp - 0x628]
push edx
mov eax, dword [ebp - 8]
add eax, 1
push eax
push str.XML__s_generated_nnew_exe:_s
lea ecx, [ebp - 0x410]
push ecx
call fcn.00451ee0
add esp, 0x10
push 0
push str.Updater_XML
lea edx, [ebp - 0x410]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret

Function at 0x452b20
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x452b4a
jmp 0x452b72
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x88
push edx
push 0
push 0
push str.MHz
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esp, ebp
pop ebp
ret
Function at 0x453390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x61aff4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4533c4
mov al, 1
jmp 0x453444
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 8
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 0
jne 0x453442
push 0
call fcn.005e5908
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x10]
add edx, 0x2a300
mov eax, dword [ebp - 0xc]
adc eax, 0
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x28]
jg 0x453442
jl 0x45343e
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x2c]
jae 0x453442
xor al, al
jmp 0x453444
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x453450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x10]
or eax, dword [edx + 0x14]
jne 0x45346f
jmp 0x4534a2
mov ecx, dword [ebp - 4]
call fcn.00453390
movzx ecx, al
test ecx, ecx
jne 0x453480
jmp 0x4534a2
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x4534b0
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c8], eax
mov esp, ebp
pop ebp
ret

Function at 0x4537b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c8], 0
jne 0x4537c7
jmp 0x453817
push 0x2710
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x4537fa
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c8], 0
mov esp, ebp
pop ebp
ret
Function at 0x453950
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 5
mov eax, dword [0x83b324]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x83b32c], eax
mov dword [0x6f7074], 0
push str._generate
push 0x83ab08
call fcn.00402450
add esp, 8
test eax, eax
je 0x45399f
call fcn.00451cc0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x453a7a
call fcn.00453a80
movzx ecx, al
test ecx, ecx
je 0x4539bf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x453a7a
call fcn.00453b20
call fcn.00453bf0
movzx edx, al
test edx, edx
jne 0x4539f8
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x453a7a
call fcn.004590d0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x835730
push 0x61b030
push 0x17
push 0
push 0x69d3a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x453a2c
mov dword [0x835730], 0
call fcn.00453c70
movzx eax, al
test eax, eax
je 0x453a3f
mov byte [0x83572c], 1
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x835728], eax
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x835724], eax
push 0x209
push 0x8357c8
push 0x12f
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
pop ebp
ret

Function at 0x453b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb20
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x320]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp dword [ebp - 4], 0
je 0x453b71
mov ecx, dword [ebp - 4]
mov byte [ecx - 1], 0
lea edx, [ebp - 0x110]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.005e8598
add esp, 8
test eax, eax
je 0x453bd5
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push eax
push str.Updater_current_directory___s__is_different_from_working_directory___s_
lea ecx, [ebp - 0xb20]
push ecx
call fcn.00458310
add esp, 0x10
push 0x30
push 0x61b120
lea edx, [ebp - 0xb20]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x453ca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607d5e
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004077b0
movzx eax, byte [0x83572c]
test eax, eax
je 0x453ce5
call fcn.00458830
jmp 0x453f14
mov ecx, 0x835348
call fcn.004528b0
push 5
mov ecx, dword [0x83b324]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
mov edx, dword [0x83b328]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x800000
push 0
mov eax, dword [0x83b328]
push eax
call fcn.005be240
add esp, 0xc
push 0xc00000
push 0
mov ecx, dword [0x83b328]
push ecx
call fcn.005be240
add esp, 0xc
push 0x454e20
push 0xfffffffffffffffc
mov edx, dword [0x83b328]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.005c7390
mov dword [ebp - 0x218], 0x311
mov dword [ebp - 0x220], 0x28a
push 0
push 0
push 0
push 0x61b244
call dword [sym.imp.GDI32.dll_CreateICA]
mov dword [ebp - 0x224], eax
push 8
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x230], eax
push 0xa
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x230]
sub eax, 0x311
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x22c]
sub eax, 0x28a
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x228], eax
push 0
push 0x28a
push 0x311
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
mov ecx, dword [0x83b328]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.005c0a30
add esp, 4
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x238], 0
je 0x453e37
mov ecx, dword [ebp - 0x238]
call fcn.005c6a20
mov dword [ebp - 0x23c], eax
jmp 0x453e41
mov dword [ebp - 0x23c], 0
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x234], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x234]
mov dword [0x83b38c], eax
push 0
mov ecx, dword [0x83b328]
push ecx
mov ecx, dword [0x83b38c]
call fcn.005c23c0
push 0x28a
push 0x311
call fcn.00453f30
add esp, 8
push str.Aug_16_2024_20:48:36
push str.2.0.8
push str.Launcher__s___s_
lea edx, [ebp - 0x214]
push edx
call fcn.00458340
add esp, 0x10
movzx eax, byte [0x6e2250]
test eax, eax
jne 0x453ec2
push str.____SELF_UPDATE_DISABLED___
lea ecx, [ebp - 0x214]
push ecx
call fcn.005e5690
add esp, 8
lea edx, [ebp - 0x214]
push edx
mov eax, dword [0x83b328]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.004544a0
push 5
mov ecx, dword [0x83b328]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5bdda0
call fcn.005bdb80
add esp, 4
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x83b394]
call fcn.005c0f60
mov ecx, dword [0x83b390]
call fcn.005c11a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x457500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x2169c
call fcn.00463420
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x60c], ecx
cmp dword [ebp - 0x60c], 5
ja case.default.0x457544
mov edx, dword [ebp - 0x60c]
jmp dword [edx*4 + 0x457620]
push 0x61b09b
lea eax, [ebp - 0x608]
push eax
call fcn.00451ee0
add esp, 8
push 5
push 0
push 0x61b0d7
lea ecx, [ebp - 0x608]
push ecx
push 0x61b37c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x457544
push 5
push 0
push 0x61b131
push 0x61b132
push 0x61b384
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x457544
push 5
push 0
push 0x61b133
push 0x61b137
push 0x61b38c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x457544
push 5
push 0
push 0x61b13b
push 0x61b145
push 0x61b394
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x457544
push 5
push 0
push 0x61b146
push 0x61b147
push 0x61b39c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x457544
push 5
push 0
push 0x61b152
push 0x61b153
push 0x61b3a4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret

Function at 0x457640
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607fbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6f7f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x21d84], 2
je 0x457674
jmp 0x457710
mov ecx, dword [ebp + 8]
add ecx, 0x21d6c
push ecx
lea ecx, [ebp - 0x10]
call fcn.004580a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0x21da4
call fcn.004581e0
movzx edx, al
test edx, edx
jne 0x4576d9
movzx eax, byte [0x6e21f0]
test eax, eax
je 0x4576d9
mov byte [0x6e21f0], 0
push 5
push 0
push 0x61b193
mov ecx, dword [ebp + 8]
add ecx, 0x21da4
call fcn.0040c220
push eax
push 0x61b3fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
mov ecx, dword [ebp + 8]
add ecx, 0x21d54
push ecx
push ecx
fld dword [0x61b664]
fstp dword [esp]
push ecx
fld dword [0x61b660]
fstp dword [esp]
call fcn.00457720
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004580d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x457720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
fld dword [0x61b670]
fstp dword [ebp - 4]
mov dword [ebp - 8], 0
jmp 0x457741
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
call fcn.00458200
cmp dword [ebp - 8], eax
jae 0x457908
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x14]
jae 0x457908
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00458220
add eax, 0x38
mov ecx, eax
call fcn.0040c220
push eax
push 0xff
push 0x56
push 0xb6
push 0xf3
lea ecx, [ebp - 0x2c]
call fcn.00457f50
push eax
push ecx
fld dword [ebp + 0xc]
fstp dword [esp]
fld dword [ebp + 8]
fadd dword [ebp - 4]
fstp dword [ebp - 0x3c]
fld dword [ebp - 0x3c]
push ecx
fstp dword [esp]
mov eax, dword [0x8357ac]
push eax
call fcn.005cc1c0
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00458220
mov ecx, eax
call fcn.0040c220
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [0x8357ac]
push eax
call fcn.00456460
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0xc], edx
fld dword [ebp + 8]
fstp dword [ebp - 0x28]
fld dword [ebp + 0xc]
fstp dword [ebp - 0x24]
fild dword [ebp - 0x10]
fstp dword [ebp - 0x20]
fild dword [ebp - 0xc]
fstp dword [ebp - 0x1c]
push 0xff
push 0xff
push 0xff
push 0xff
lea ecx, [ebp - 0x18]
call fcn.00457f50
mov eax, dword [0x8357bc]
push eax
mov ecx, dword [0x8357b8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00455a00
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4578ce
push 0xff
push 0
push 0xd8
push 0xff
lea ecx, [ebp - 0x38]
call fcn.00457f50
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push ecx
fld1
fstp dword [esp]
fild dword [ebp - 0x10]
push ecx
fstp dword [esp]
fild dword [ebp - 0xc]
fadd dword [ebp + 0xc]
fstp dword [ebp - 0x40]
fld dword [ebp - 0x40]
push ecx
fstp dword [esp]
push ecx
fld dword [ebp + 8]
fstp dword [esp]
call fcn.005cc2d0
add esp, 0x1c
cmp dword [0x8357c0], 0
je 0x4578ce
push 5
push 0
push 0x61b187
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00458220
add eax, 0x1c
mov ecx, eax
call fcn.0040c220
push eax
push 0x61b3f0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x14]
push ecx
push 0x61b3f8
lea edx, [ebp - 0x18]
push edx
push ecx
fld dword [ebp + 0xc]
fstp dword [esp]
push ecx
fld dword [ebp + 8]
fstp dword [esp]
mov eax, dword [0x8357ac]
push eax
call fcn.005cc1c0
add esp, 0x18
fld dword [ebp + 0xc]
fadd qword [0x61b668]
fstp dword [ebp + 0xc]
jmp 0x457738
mov esp, ebp
pop ebp
ret
Function at 0x457d60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x61b4b4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x457d96
xor al, al
jmp 0x457dd6
mov ecx, dword [ebp + 8]
push ecx
call fcn.005e45a0
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push str.LoginToken
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x457dca
xor al, al
jmp 0x457dd6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x458880
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.0045ddc0
call fcn.005be810
mov eax, 1
test eax, eax
je 0x45893b
call fcn.005be860
call fcn.005be810
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20dec]
mov dword [ebp - 0x20c], edx
cmp dword [ebp - 0x20c], 3
je 0x4588db
jmp 0x4588e3
mov ecx, dword [ebp + 8]
call fcn.004589d0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20df0], 0
je 0x4588f1
jmp 0x45893b
mov ecx, dword [ebp + 8]
add ecx, 0x215f8
call fcn.00457fb0
fmul qword [0x6c9808]
sub esp, 8
fstp qword [esp]
mov ecx, dword [ebp + 8]
add ecx, 0x20df5
push ecx
push str._s:__.1f__
lea edx, [ebp - 0x208]
push edx
call fcn.00458340
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x4588a0
mov ecx, dword [ebp + 8]
call fcn.0045dfd0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20df0]
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 1
je 0x458989
cmp dword [ebp - 0x210], 2
je 0x458998
cmp dword [ebp - 0x210], 3
je 0x458987
xor eax, eax
jne 0x458987
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x61b6cc
call fcn.005bede0
add esp, 0x10
jmp 0x4589af
push str.Update_ok_n
call fcn.005bead0
add esp, 4
jmp 0x4589af
mov edx, dword [ebp + 8]
add edx, 0x211f5
push edx
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.005bead0
add esp, 8
push str._nPress_enter_to_exit...
call fcn.005bead0
add esp, 4
call fcn.005e6734
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret