joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439fe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
xor eax, eax
jne 0x439fe9
cmp dword [ebp + 0xc], 0
je 0x439ffc
mov dword [ebp - 0x10], 1
jmp 0x43a003
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x43a016
mov eax, 0xd
jmp 0x43a073
xor edx, edx
jne 0x439fed
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c6518
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*2]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx*2]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 1
jne 0x43a027
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x43a080
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x43a089
cmp dword [ebp + 0xc], 0
je 0x43a09c
mov dword [ebp - 4], 1
jmp 0x43a0a3
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x43a0b6
mov eax, 0xd
jmp 0x43a0e5
xor edx, edx
jne 0x43a08d
mov eax, dword [ebp + 0xc]
push eax
call fcn.004c6518
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43b140
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x210], 0x104
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0x5308cc
push 0x5308e4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43b1b3
jmp 0x43b1f6
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43b1c6
jmp 0x43b1f6
push 0x530908
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
jne 0x43b159
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x43c010
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.004a8eb0
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x214]
push eax
call fcn.004c6518
add esp, 4
test eax, eax
jne 0x43c070
push 0
push 0
push 0x465
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [ebp - 0x214]
push edx
call fcn.004c6518
add esp, 4
cmp eax, 2
jb 0x43c111
mov eax, 2
shl eax, 0
movzx ecx, word [ebp + eax - 0x214]
cmp ecx, 0x3a
jne 0x43c111
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov eax, 2
imul ecx, eax, 0
mov edx, 2
imul eax, edx, 0
mov cx, word [ebp + ecx - 0x214]
mov word [ebp + eax - 0xc], cx
mov edx, 2
shl edx, 0
mov eax, 0x3a
mov word [ebp + edx - 0xc], ax
mov ecx, 2
shl ecx, 1
mov edx, 0x5c
mov word [ebp + ecx - 0xc], dx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
je 0x43c111
push 0
push 0
push 0x465
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x43f9d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x17c], 1
push 4
push 0
push 0
push str.http:__iquicksee.luxiaoche.com_cms_agreement.html
push 0x5310e4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43fa10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 4
push 0
push 0
push str.http:__iquicksee.luxiaoche.com_cms_privacy_policy.html
push 0x531160
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43fb50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520fe7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x570374]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
call fcn.00435020
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0
push 0
push str.click_feedgroup
call fcn.00437550
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.004180d0
push 1
push 0
push 0
push str.http:__iquicksee.luxiaoche.com_joinclub
push 0x53118c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4413d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00440670
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x40]
call edx
cmp dword [ebp - 0xc], 1
jne 0x44156d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x44156d
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004313b0
mov ecx, dword [ebp - 4]
call fcn.00440d80
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xf4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x441465
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x84]
call edx
test eax, eax
je 0x44156d
mov dword [ebp - 0xc], 2
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x441485
mov dword [ebp - 0x14], 1
jmp 0x44148c
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x4414c5
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
jne 0x4414c5
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 0
push 1
push 0
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00431060
jmp 0x4414eb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
je 0x4414eb
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0
jne 0x4414eb
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
je 0x441507
mov dword [ebp - 0x18], 1
jmp 0x44150e
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x441547
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
jne 0x441547
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
push 1
push 1
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00431060
jmp 0x44156d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
je 0x44156d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x5c], 0
jne 0x44156d
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x447720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52179b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x828], ebx
cmp word [0x575f00], 0
jne 0x44785a
push 0x20219
push str.SOFTWAREQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.00422c30
mov edi, dword [ebp - 0x824]
test eax, eax
jne 0x44784f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push 0x537910
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44784f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x4477ec
cmp eax, 2
jne 0x44784f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x447809
test al, 1
jne 0x44784f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x447812
jmp 0x44784f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x575f00
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x447842
movzx eax, word [esi + ecx]
test ax, ax
je 0x447842
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x447824
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x44785a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x575f00
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x4478ab
mov ecx, 0x575f00
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x44789e
movzx eax, word [esi + ecx]
test ax, ax
je 0x44789e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x447880
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.004062d0
mov ecx, eax
test ecx, ecx
je 0x44791a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push 0x575f00
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.00405c90
test al, al
jne 0x4478fc
mov ecx, 0x575f00
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4478e0
sub ecx, edx
sar ecx, 1
push ecx
push 0x575f00
mov ecx, ebx
call fcn.00406e80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405c40
int3
Function at 0x449f80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0047c9d0
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x44a072
test edi, edi
je 0x44a072
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x44a072
cmp eax, 0x3fff
ja 0x44a072
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44a072
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x52f7ac
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44a072
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push 0
push edi
call fcn.004a8eb0
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x52f894
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x44a2a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x44a37b
test ecx, ecx
je 0x44a37b
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x44a37b
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x44a37b
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x44a366
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
call fcn.004ca57a
add esp, 0xc
test eax, eax
je 0x44a38e
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x44a310
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x4c0]
call fcn.0044b090
xor ecx, ecx
test edi, edi
je 0x44a3ac
cmp edi, 0x7fffffff
jbe 0x44a3b1
mov ecx, 0x80070057
test ecx, ecx
js 0x44a3e7
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x44a3cf
cmp word [eax], 0
je 0x44a3cf
add eax, 2
sub esi, 1
jne 0x44a3c1
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x44a3e9
xor esi, esi
test ecx, ecx
js 0x44a43a
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x44a42d
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7fffffff
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x44a42d
movzx eax, word [edi + ecx]
test ax, ax
je 0x44a42d
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x44a414
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x44a450
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44a4c8
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret

Function at 0x44a580
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0047c9d0
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x44a6ba
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jl 0x44a6ba
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x44a6ba
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004a8eb0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x44a68f
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004a8eb0
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.004aa092
add esp, 0x14
test eax, eax
je 0x44a654
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x44a654
mov ecx, 1
jmp 0x44a656
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
lea eax, [ebp - 0x804]
cmovne eax, edx
push eax
push edi
push ebx
call fcn.0044b090
mov edi, dword [ebp - 0x1008]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x44a66f
push edi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.0044a2a0
add esp, 0xc
mov edi, eax
jmp 0x44a675
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x44ad30
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x55f398
push 0x4ac7e0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a14
call fcn.0047c9d0
mov eax, dword [0x570374]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
test esi, esi
je 0x44af04
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ad86
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x44af04
mov dword [ebp - 4], 0
call fcn.0044a450
mov dword [ebp - 4], 0xfffffffe
jmp 0x44adcc
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.004a8eb0
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.004a8eb0
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x44af04
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.004c6dd2
lea eax, [ebp - 0x224]
push eax
call fcn.004c792c
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x44af04
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
call fcn.0044a580
add esp, 0xc
test eax, eax
je 0x44aef7
lea eax, [ebp - 0xa24]
push eax
call fcn.004c792c
add esp, 4
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44aeb8
test dx, dx
je 0x44aeb4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44aeb8
add eax, 4
add ecx, 4
test dx, dx
jne 0x44ae92
xor eax, eax
jmp 0x44aebd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44aef7
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x44aee3
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa24]
push eax
push str.Kill_process:__s
call fcn.0044de20
add esp, 8
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x44ae54
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 4
Function at 0x44af30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x55f3d8
push 0x4ac7e0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x570374]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x44b062
cmp word [esi], 0
je 0x44b062
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.004a8eb0
push esi
push 0x539390
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.00406f40
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.004a8eb0
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x53939c
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x44b029
cmp dword [ebp + 0x18], 0
je 0x44b029
push dword [ebp + 0x20]
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x44b03e
test esi, esi
je 0x44b04e
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x44b04e
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x44b06b
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x44b100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x44b11c
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x44ba90
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x44bb64
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a8eb0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
push 0x104
push eax
call fcn.0044bce0
test eax, eax
jne 0x44bb2f
push 1
push 0x2a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], 0
jne 0x44bb16
push str.C:Program_Files
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c6307
add esp, 0xc
push 0x539578
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c6307
add esp, 0xc
mov eax, dword [edi]
lea ecx, [ebp - 0x20c]
push ecx
push edi
call dword [eax + 0x2c]
test eax, eax
je 0x44bb51
push 0x32
call fcn.0045d6d0
add esp, 4
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push esi
call fcn.004c63dc
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44bce0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44bd91
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Setup_Path
push str.SOFTWAREQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44bd91
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44bd91
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.004c63dc
add esp, 0xc
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 8