joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453ee0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x98
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push 0x90
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.005e4b70
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edx
push eax
push ecx
push str._d._d._d
add esi, 0x1a8
push esi
call fcn.00453c40
mov ecx, dword [esp + 0xac]
add esp, 0x14
pop esi
xor ecx, esp
call fcn.005e425b
add esp, 0x98
ret
sub esp, 0x40
push ebx
push esi
push edi
mov esi, ecx
call fcn.004539b0
mov ecx, esi
call fcn.00453a30
mov ecx, esi
call fcn.00453ba0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0
shrd ecx, edx, 0xa
push 0
push 0
push str.DISPLAY
shr edx, 0xa
mov dword [esi + 0x8c], ecx
call dword [sym.imp.GDI32.dll_CreateICA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [esi + 0x90], eax
call ebx
push edi
mov dword [esi + 0x94], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, esi
call fcn.00453d50
pop edi
mov ecx, esi
pop esi
pop ebx
add esp, 0x40
jmp 0x453c60

Function at 0x453f70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareNHZ_StudioNHZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x453f98
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x45400a
push esi
call fcn.005e4bea
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x45400a
jl 0x454003
cmp eax, esi
jae 0x45400a
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret

Function at 0x454020
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c8]
test eax, eax
je 0x454066
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45404f
mov eax, dword [esi + 0x1c8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c8], 0
pop esi
ret

Function at 0x4542d0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
je 0x454300
call fcn.00453f70
test al, al
je 0x454300
push 0
push 0
push esi
push 0x454070
push 0
push 0
call fcn.005e4d3c
add esp, 0x18
mov dword [esi + 0x1c8], eax
pop esi
ret
Function at 0x455100
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNHZ_StudioNHZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x45512d
xor al, al
pop ecx
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x455132
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.LoginToken
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x455129
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret

Function at 0x455380
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb14
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0xb10], eax
push 0x104
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp]
test eax, eax
je 0x4553d3
mov byte [eax - 1], 0
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
call fcn.005e7b49
add esp, 8
test eax, eax
je 0x455435
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.004552c0
add esp, 0x10
push 0x30
push str.Warning
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xb10]
xor ecx, esp
mov al, 1
call fcn.005e425b
add esp, 0xb14
ret

Function at 0x4554d0
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
mov eax, dword [0x6fa938]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x6fa000
mov dword [0x6fa940], eax
mov dword [0x6f0118], 0
call fcn.005e4e90
add esp, 8
test eax, eax
je 0x455518
call fcn.00453130
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.004543c0
test al, al
jne 0x455508
call fcn.00455380
call fcn.00455450
test al, al
jne 0x455553
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00458a30
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x6f4828
push 0x617d28
push 0x17
push 0
push 0x699508
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x455587
mov dword [0x6f4828], 0
push str._cmdLine
push 0x6fa000
call fcn.005e4e90
add esp, 8
test eax, eax
je 0x4555a4
mov byte [0x6f4824], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x6f4820], eax
call esi
push 0x209
push 0x6f48c0
push 0x12f
push 0
mov dword [0x6f481c], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret
Function at 0x4555e0
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x6058ae
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push edi
mov eax, dword [0x6f1330]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
cmp byte [0x6f4824], 0
je 0x45562d
call fcn.00458400
jmp 0x4557d8
mov ecx, 0x6f4440
call fcn.00453ee0
mov eax, dword [0x6fa938]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x6fa93c]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x6fa93c]
push 0x800000
push 0
push edx
call fcn.005ba460
mov eax, dword [0x6fa93c]
push 0xc00000
push 0
push eax
call fcn.005ba460
mov ecx, dword [0x6fa93c]
add esp, 0x18
push 0x454e70
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.005c50f0
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov ebx, eax
call edi
mov esi, eax
lea eax, [ebx - 0x311]
cdq
sub eax, edx
mov ecx, eax
push 0
lea eax, [esi - 0x28a]
cdq
push 0x28a
sub eax, edx
mov edx, dword [0x6fa93c]
push 0x311
sar eax, 1
push eax
sar ecx, 1
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.005bcc90
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x220], 0
test eax, eax
je 0x455720
mov ecx, eax
call fcn.005c2440
jmp 0x455722
xor eax, eax
mov ecx, dword [0x6fa93c]
push 0
push ecx
mov ecx, eax
mov dword [esp + 0x228], 0xffffffff
mov dword [0x6fa9bc], eax
call fcn.005bde00
mov ecx, 0x28a
mov edx, 0x311
call fcn.00454450
push str.Oct_30_2024_17:11:26
push str.1.0.1
lea edx, [esp + 0x1c]
push str.TEAMNHZ__s___s_
push edx
call fcn.004552e0
add esp, 0x10
cmp byte [0x6db2f0], 0
jne 0x455794
lea edi, [esp + 0x14]
dec edi
jmp 0x455780
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x455780
mov ecx, 7
mov esi, str.____SELF_UPDATE_DISABLED___
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x6fa93c]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00454850
mov edx, dword [0x6fa93c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x6fa9c4]
call fcn.005c4d20
mov ecx, dword [0x6fa9c0]
call fcn.005c4f60
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.005e425b
add esp, 0x214
ret
Function at 0x456270
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x60591b
mov eax, dword fs:[0]
push eax
sub esp, 0xc14
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0xc10], eax
push esi
push edi
mov eax, dword [0x6f1330]
xor eax, esp
push eax
lea eax, [esp + 0xc20]
mov dword fs:[0], eax
push str.Starting_game_n
mov edi, ecx
call fcn.005bacf0
inc dword [0x6fa9f8]
add esp, 4
push 6
push 0
mov dword [esp + 0xc30], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.NHZ.exe
call fcn.005bca70
add esp, 0xc
test al, al
jne 0x4562fd
push str.failed1_n
call fcn.005bacf0
add esp, 4
jmp 0x456314
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push eax
push str._08x__d_n
call fcn.005bacf0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0x2169c]
call fcn.0045f900
lea esi, [esp + 0x1c]
call fcn.00455100
test al, al
je 0x456357
push 0xffffffffffffffff
call fcn.005c8a60
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.005c8a60
add esp, 4
push eax
mov edx, esi
push str._08X_08X
push edx
call fcn.00453110
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
push 0x6fa000
lea ecx, [esp + 0x424]
push str._WOUpdatedOk__s__WOLogin___s_
push ecx
call fcn.004552c0
add esp, 0x10
cmp dword [edi + 0x21d74], 0
jbe 0x4563ce
lea eax, [esp + 0x41c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x456390
sub eax, edx
cmp dword [edi + 0x21d78], 0x10
lea edx, [esp + eax + 0x41c]
mov dword [esp + 0x10], edx
jb 0x4563b5
mov edi, dword [edi + 0x21d64]
jmp 0x4563bb
add edi, 0x21d64
push edi
lea eax, [esp + 0x14]
push str.__survey___s_
push eax
call fcn.0045f260
add esp, 0xc
cmp dword [0x6f69c4], 0
jl 0x456416
jg 0x4563e2
cmp dword [0x6f69c0], 0
jbe 0x456416
lea eax, [esp + 0x41c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4563f0
sub eax, edx
lea edx, [esp + 0x10]
lea ecx, [esp + eax + 0x41c]
push str.__steam
push edx
mov dword [esp + 0x18], ecx
call fcn.0045f260
add esp, 8
push 5
push 0
lea eax, [esp + 0x424]
push eax
push str.NHZ.exe
push 0x618050
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x456447
push eax
push str.failed:__d_n
call fcn.005bacf0
add esp, 8
cmp dword [0x6fa9f8], 0
je 0x456456
dec dword [0x6fa9f8]
mov ecx, dword [esp + 0xc20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc10]
xor ecx, esp
call fcn.005e425b
add esp, 0xc20
ret
Function at 0x458450
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x234
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.0045e8c0
call fcn.005baa30
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.005baa80
call fcn.005baa30
push 0x64
call edi
cmp dword [esi + 0x20dec], 3
jne 0x4584a9
mov dword [esi + 0x20dec], 5
cmp dword [esi + 0x20df0], 0
jne 0x458530
mov eax, dword [esi + 0x215f8]
mov ecx, dword [esi + 0x215fc]
mov dword [esp + 0x30], eax
or eax, ecx
mov dword [esp + 0x34], ecx
jne 0x4584ce
fldz
jmp 0x4584f7
fild qword [esi + 0x21600]
fild qword [esp + 0x30]
fdivp st(1)
fstp dword [esp + 0x2c]
fld1
fcom dword [esp + 0x2c]
fnstsw ax
test ah, 5
jp 0x4584f1
fstp dword [esp + 0x2c]
jmp 0x4584f3
fstp st(0)
fld dword [esp + 0x2c]
fstp dword [esp + 0x2c]
sub esp, 8
fld dword [esp + 0x34]
lea eax, [esi + 0x20df5]
fmul qword [0x6182e8]
lea ecx, [esp + 0x40]
fstp qword [esp]
push eax
push str._s:__.1f__
push ecx
call fcn.004552e0
add esp, 0x14
lea edx, [esp + 0x38]
push edx
call ebx
jmp 0x458488
mov ecx, esi
call fcn.00459860
mov eax, dword [esi + 0x20df0]
sub eax, 1
je 0x45857a
sub eax, 1
je 0x458564
sub eax, 1
je 0x458587
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x618224
call fcn.005bb000
add esp, 0x10
jmp 0x458587
add esi, 0x211f5
push esi
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.005bacf0
add esp, 8
jmp 0x458587
push str.Update_ok_n
call fcn.005bacf0
add esp, 4
push str._nPress_enter_to_exit...
call fcn.005bacf0
add esp, 4
call fcn.005e5b05
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005e425b
mov esp, ebp
pop ebp
ret
Function at 0x458a30
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x608], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push str..new.exe
push ecx
call fcn.005e4e90
add esp, 8
test eax, eax
jne 0x458aa9
lea edx, [esp]
push edx
lea eax, [esp + 0x108]
push str._s.new.exe
push eax
call fcn.004530f0
add esp, 0xc
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.005e425b
add esp, 0x60c
ret
push str..exe_updated__moving_back_n
mov byte [0x6f6970], 1
call fcn.005bacf0
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax]
mov byte [esp + eax + 0x104], cl
inc eax
test cl, cl
jne 0x458ad0
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x458ae5
sub eax, edx
cmp eax, 8
ja 0x458b09
push 0
push 0x31
push str..SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.005bb000
add esp, 0x10
lea eax, [esp]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x458b10
push ebx
push ebp
push esi
sub eax, edx
push edi
lea edx, [esp + 0x10]
push edx
push str.exeMain:__s_n
mov byte [esp + eax + 0x10], cl
call fcn.005bacf0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call ebx
test eax, eax
jne 0x458beb
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push ecx
call ebp
test eax, eax
jne 0x458beb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x458b47
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x220]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push ecx
call fcn.00453110
add esp, 0x10
push 0x30
push str.Updater
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x618154
push 0x618050
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x458bed
mov al, 1
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e425b
add esp, 0x60c
ret
Function at 0x458c10
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
mov edi, dword [esp + 0x218]
push 0x104
lea eax, [esp + 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.005bacf0
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x10]
push str._s.new.exe
push edx
call fcn.004530f0
lea eax, [esp + 0x18]
push 0x617ef0
push eax
call fcn.005e549e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x458c8d
lea ecx, [esp + 8]
push ecx
push str.cant_open__s_for_writing_n
call fcn.005baec0
add esp, 8
mov edx, dword [esp + 0x21c]
push esi
push 1
push edx
push edi
call fcn.005e5c6c
push esi
call fcn.005e4765
mov eax, dword [0x6f482c]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
push ecx
push str.executing__s_n
call fcn.005bacf0
add esp, 8
push 5
push 0
push 0x6fa000
lea edx, [esp + 0x14]
push edx
push 0x618050
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop edi
pop esi
jge 0x458cfa
push eax
lea eax, [esp + 4]
push eax
push str.failed_to_launch__s___d
call fcn.005baec0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.005e425b
add esp, 0x20c
ret
Function at 0x459030
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x605a78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x6f1330]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
call fcn.0045fbe0
lea eax, [esp + 0x10]
push eax
push 0x6186b4
push 0xc8
mov dword [esp + 0x38], 0
call fcn.00459310
add esp, 0xc
test al, al
jne 0x459099
push 0x10
push str.Warning
push str.No_Power_by_TEAMNHZ.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x459144
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push str.Power_by_TEAMNHZ.dll
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.005bca70
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.0045fda0
push eax
lea ecx, [esp + 0x14]
call fcn.0045fdd0
push eax
call fcn.005bc720
add esp, 8
cmp dword [esp + 8], eax
je 0x459144
push 0x80
push str.Power_by_TEAMNHZ.dll
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x617ef0
push str.Power_by_TEAMNHZ.dll
call fcn.005e549e
mov esi, eax
add esp, 8
test esi, esi
jne 0x45911f
push 0x10
push str.Warning
push str.Can_not_update_Power_by_TEAMNHZ.dll
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x459144
push esi
lea ecx, [esp + 0x14]
call fcn.0045fda0
push eax
push 1
lea ecx, [esp + 0x1c]
call fcn.0045fdd0
push eax
call fcn.005e5c6c
push esi
call fcn.005e4765
add esp, 0x14
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0045fc90
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x459310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, ebx
call fcn.0045fd70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x45933a
pop esi
xor al, al
pop ebx
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x459357
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
mov ecx, ebx
call fcn.0045ff30
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x459860
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.CUpdater::Stop___n
mov esi, ecx
call fcn.005bacf0
add esp, 4
cmp byte [esi + 0x20df4], 0
jne 0x459883
mov eax, dword [esi + 0x21670]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x782f08
call edi
lea eax, [esi + 0x20dd4]
push eax
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esi + 0x21668]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x4598c8
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21668]
push ecx
call ebp
mov dword [esi + 0x21668], ebx
mov eax, dword [esi + 0x21d7c]
cmp eax, ebx
je 0x4598e5
push ebx
push eax
call edi
mov edx, dword [esi + 0x21d7c]
push edx
call ebp
mov dword [esi + 0x21d7c], ebx
mov eax, dword [esi + 0x21694]
cmp eax, ebx
je 0x459902
push ebx
push eax
call edi
mov eax, dword [esi + 0x21694]
push eax
call ebp
mov dword [esi + 0x21694], ebx
add esi, 0x21678
mov ebx, 6
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x459926
push 0
push eax
call edi
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x459910
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
call esi
push 0x782f08
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x459b50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x60c
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x608], eax
lea eax, [esp + 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.NHZ.exe
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push 0x618be8
push edx
call fcn.004530f0
push 0x6dbaf8
lea eax, [esp + 0x21c]
push str.Allow_network_traffic_for__s
push eax
call fcn.00453110
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x20]
push 0x6dbaf8
push edx
call fcn.00452ef0
mov ecx, dword [esp + 0x630]
add esp, 0x28
xor ecx, esp
call fcn.005e425b
add esp, 0x60c
ret
Function at 0x45a6b0
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x420]
push edi
lea eax, [esp + 0x18]
mov edi, ecx
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.005bca70
add esp, 0xc
test al, al
je 0x45a6fe
mov edx, dword [esp + 0x14]
cmp edx, dword [esi + 0x10e]
je 0x45a7e7
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x617ef0
push esi
call fcn.005e549e
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x45a73f
push esi
lea eax, [esp + 0x24]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.00453110
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push edi
call fcn.0045a350
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0045fda0
push eax
mov ecx, ebx
call fcn.0045fdd0
push eax
push esi
lea ecx, [edi + 0x4e0]
call fcn.005c9370
mov ecx, dword [esi + 0x106]
cmp ecx, dword [esp + 0x10]
je 0x45a78a
push 0
push 0x19b
push str..Updater.cpp
push str.fe__size__out_size
call fcn.005bb000
add esp, 0x10
lea ebx, [edi + 0x20dd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ebp
push 1
push edx
push eax
call fcn.005e5c6c
push ebp
call fcn.005e4765
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.NHZ.exe
push esi
call fcn.005e7b49
add esp, 8
test eax, eax
jne 0x45a7d9
mov ecx, edi
mov byte [edi + 0x21690], 1
call fcn.00459b50
mov ecx, dword [esp + 0x14]
push ecx
call fcn.005bccb0
add esp, 4
pop ebp
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005e425b
add esp, 0x414
ret 8