joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453410
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00453420

Function at 0x4536a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00453950

Function at 0x46da10
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046d88f

Function at 0x473c93
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00473953

Function at 0x47b3c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x47b3e1
cmp dword [ebp + 0xc], 0
je 0x47b3e1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x1e
jl 0x47b3e6
jmp 0x47b484
push 0x294
call fcn.004303c9
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
push 0x294
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.00456880
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x190
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x10], 0
je 0x47b458
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x64
jge 0x47b458
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
add eax, 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x47b1e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47b484
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x47ba20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xf003f
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x47ba41
mov ecx, dword [ebp - 4]
or ecx, 0x100
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push str.RegDeleteKeyExW
push 0x4c4e44
call sym.Install_silent.exe_bool___cdecl_NsGetProcAddr_wchar_t_const___char_const___void___
add esp, 0xc
movzx eax, al
test eax, eax
je 0x47ba86
cmp dword [ebp - 8], 0
je 0x47ba84
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
test eax, eax
jne 0x47ba84
mov al, 1
jmp 0x47ba9e
jmp 0x47ba9c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x47ba9c
mov al, 1
jmp 0x47ba9e
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x47bc50
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9d42
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4e3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47bc88
mov eax, 1
jmp 0x47bd01
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x47bcfc
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x10]
call fcn.00405080
mov dword [ebp - 4], 0
push str..bak
lea ecx, [ebp - 0x10]
call fcn.00409cc0
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47bcd8
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00460283
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405060
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x47bd10
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9d65
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4e3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47bdb5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x47bdb5
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.00405080
mov dword [ebp - 4], 0
push 0x4c4d74
lea ecx, [ebp - 0x10]
call fcn.00409cc0
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47bd91
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00460283
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405060
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x47bde0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push str.SeShutdownPrivilege
call sym.Install_silent.exe_int___cdecl_SetPrivilege_wchar_t_const___int_
add esp, 8
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x47be09
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x47be20
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0x4c4dd8
call sym.Install_silent.exe_int___cdecl_SetPrivilege_wchar_t_const___int_
add esp, 8
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0
je 0x47be49
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x47be60
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0x4c4d4c
call sym.Install_silent.exe_int___cdecl_SetPrivilege_wchar_t_const___int_
add esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x47be89
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x47bea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sym.Install_silent.exe_int___cdecl_isWin7_void_
test eax, eax
jne 0x47beb3
xor eax, eax
jmp 0x47bf0a
push 0x4c4dd0
mov eax, dword [ebp + 8]
push eax
call fcn.0045f83a
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47bed1
xor eax, eax
jmp 0x47bf0a
push 0
push 0x15
mov ecx, dword [ebp - 8]
push ecx
call fcn.00460268
add esp, 0xc
mov byte [ebp - 1], 0x20
mov edx, dword [ebp - 8]
push edx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.0045fdef
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045febd
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x47c320
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x288
push 0x288
call fcn.0045ce41
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x47c35b
xor eax, eax
jmp 0x47c493
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x47c396
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0045ca39
add esp, 4
mov eax, dword [ebp - 0x30]
push eax
call fcn.0045ce41
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x47c396
xor eax, eax
jmp 0x47c493
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x47c484
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x47c3bc
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0
je 0x47c484
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x1a0], 6
je 0x47c3d4
jmp 0x47c3b4
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x190], 6
je 0x47c3e2
jmp 0x47c3b4
mov edx, 1
imul eax, edx, 5
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul ecx, eax, 3
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + ecx + 0x194]
push eax
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + edx + 0x194]
push ecx
push str._02X__02X__02X__02X__02X__02X
lea edx, [ebp - 0x24]
push edx
call fcn.0040cd50
add esp, 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
call fcn.00409200
mov dword [ebp - 0x34], 1
jmp 0x47c484
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0045ca39
add esp, 4
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x47c5d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9dc6
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x28]
call fcn.004093f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 5
jne 0x47c64f
cmp dword [ebp - 0x134], 0
jne 0x47c64f
push str.Windows2000
lea ecx, [ebp - 0x28]
call fcn.00409200
jmp 0x47c6f5
cmp dword [ebp - 0x138], 5
jne 0x47c673
cmp dword [ebp - 0x134], 1
jne 0x47c673
push str.WindowsXP
lea ecx, [ebp - 0x28]
call fcn.00409200
jmp 0x47c6f5
cmp dword [ebp - 0x138], 6
jne 0x47c694
cmp dword [ebp - 0x134], 0
jne 0x47c694
push str.Windows2003
lea ecx, [ebp - 0x28]
call fcn.00409200
jmp 0x47c6f5
cmp dword [ebp - 0x138], 5
jne 0x47c6b5
cmp dword [ebp - 0x134], 2
jne 0x47c6b5
push str.windowsvista
lea ecx, [ebp - 0x28]
call fcn.00409200
jmp 0x47c6f5
cmp dword [ebp - 0x138], 6
jne 0x47c6d6
cmp dword [ebp - 0x134], 1
jne 0x47c6d6
push str.windows7
lea ecx, [ebp - 0x28]
call fcn.00409200
jmp 0x47c6f5
cmp dword [ebp - 0x138], 6
jne 0x47c6f5
cmp dword [ebp - 0x134], 2
jne 0x47c6f5
push str.windows10
lea ecx, [ebp - 0x28]
call fcn.00409200
lea ecx, [ebp - 0x164]
push ecx
call fcn.0047c780
add esp, 4
movzx edx, word [ebp - 0x164]
cmp edx, 6
je 0x47c71c
movzx eax, word [ebp - 0x164]
cmp eax, 9
jne 0x47c72b
push str._x64
lea ecx, [ebp - 0x28]
call fcn.004091e0
jmp 0x47c738
push str._x86
lea ecx, [ebp - 0x28]
call fcn.004091e0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00409300
mov edx, dword [ebp - 0x140]
or edx, 1
mov dword [ebp - 0x140], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00409220
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x47cc60
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00456880
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._at.exe
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47ccc2
xor eax, eax
jmp 0x47ccdf
push 0
push 0
push str._delete__yes
lea ecx, [ebp - 0x20c]
push ecx
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret

Function at 0x47ccf0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9e37
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00456880
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4c4b78
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47cd6d
xor eax, eax
jmp 0x47ce00
lea ecx, [ebp - 0x21c]
call fcn.00405120
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x47cda3
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s__every:m_t_w_th_f_s_su___s_
lea eax, [ebp - 0x21c]
push eax
call fcn.00405800
add esp, 0x10
jmp 0x47cdbf
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x4c4bc8
lea eax, [ebp - 0x21c]
push eax
call fcn.00405800
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x21c]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
lea ecx, [ebp - 0x218]
push ecx
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00405060
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x47ce20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9e6a
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x47ce57
cmp dword [ebp + 0xc], 0
jne 0x47ce5e
xor eax, eax
jmp 0x47cfe3
lea ecx, [ebp - 0x47c]
call fcn.00405120
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
jne 0x47cea1
mov eax, dword [ebp + 8]
push eax
push 0x4c4a64
lea ecx, [ebp - 0x47c]
push ecx
call fcn.00405800
add esp, 0xc
jmp 0x47ceb9
mov edx, dword [ebp + 8]
push edx
push str._sdesktop.ini
lea eax, [ebp - 0x47c]
push eax
call fcn.00405800
add esp, 0xc
lea ecx, [ebp - 0x47c]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
push 0x400
lea ecx, [ebp - 0x474]
push ecx
push 0x4c4aa0
push 0x4c4aa4
push 0x4c4ab8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x47c]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
push 0x64
lea edx, [ebp - 0x74]
push edx
push 0x4c4ad8
push 0x4c4adc
push 0x4c4af0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 0x475], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47cf3b
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x47cf42
mov byte [ebp - 0x475], 1
mov dword [ebp - 0x480], 1
movzx ecx, byte [ebp - 0x475]
test ecx, ecx
je 0x47cfbf
lea ecx, [ebp - 0x47c]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
mov edx, dword [ebp + 0xc]
push edx
push str.IconFile
push 0x4c4b24
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x480], eax
lea ecx, [ebp - 0x47c]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
mov eax, dword [ebp + 0x10]
push eax
push str.IconIndex
push str..ShellClassInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and eax, dword [ebp - 0x480]
mov dword [ebp - 0x480], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
and eax, dword [ebp - 0x480]
mov dword [ebp - 0x480], eax
mov edx, dword [ebp - 0x480]
mov dword [ebp - 0x484], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.00405060
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x47e7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa081
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00456880
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp + 8]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47e928
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47e91b
lea ecx, [ebp - 0x21c]
call fcn.00405120
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
push 0x4c4648
lea eax, [ebp - 0x21c]
push eax
call fcn.00405800
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x21c]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47e8fc
mov dword [ebp - 0x220], 0x208
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp + 0x10]
push edx
push 0x4c4674
lea eax, [ebp - 0x21c]
push eax
call fcn.00405800
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00409c50
test eax, eax
jne 0x47e8fc
mov dword [ebp - 0x22c], 1
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00405060
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x47edb0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x47eddc
xor eax, eax
jmp 0x47ee39
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x47ee06
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x47ee39
lea eax, [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret

Function at 0x47ee50
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47ee75
xor eax, eax
jmp 0x47ef40
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 1
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47eef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x47eee2
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47eee0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x47ef40
jmp 0x47eef0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x47ef40
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x47ef27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x47ef27
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x47ef40
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret