joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c600
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x43c61a
mov ecx, dword [ebp - 4]
call sym.nsUninstall.exe_public:_void___thiscall_CNsSkin::FreeSkin_void_
cmp dword [ebp + 8], 0
je 0x43c62c
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call sym.nsUninstall.exe_public:_void___thiscall_CNsSkin::SetSkinName_wchar_t_const__
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp - 4]
call fcn.004094b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43c65a
xor al, al
jmp 0x43c6c3
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x43ced0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 8]
call sym.nsUninstall.exe_private:_struct_tagNsTimer____thiscall_CNsThread::AddTimer_struct_tagNsTimer__
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43cf15
jmp 0x43cf3a
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push sym.nsUninstall.exe_private:_static_unsigned_int___stdcall_CNsThread::TimerThread_void__
push 0
push 0
call fcn.00420626
add esp, 0x18
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x14], edx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43d070
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x43d09f
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8
Function at 0x43d1b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.00420626
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x43d1ee
cmp dword [ebp - 4], 0
je 0x43d1ee
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43d1f1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43d200
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44eafb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004187d0
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
call sym.nsUninstall.exe_int___cdecl_GetProgramsPath_wchar_t__
add esp, 4
push 0x45b228
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0x21c]
add eax, 0x13c
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x45b22c
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
call sym.nsUninstall.exe_private:_bool___thiscall_CNsUninstaller::DelDir_wchar_t_const__
lea ecx, [ebp - 0x218]
push ecx
call sym.nsUninstall.exe_int___cdecl_GetDesktopPath_wchar_t__
add esp, 4
lea ecx, [ebp - 0x224]
call fcn.00409460
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x21c]
add edx, 0xd8
push edx
lea eax, [ebp - 0x218]
push eax
push 0x45b230
lea ecx, [ebp - 0x224]
push ecx
call fcn.00409b00
add esp, 0x10
lea ecx, [ebp - 0x224]
call fcn.004094b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x220], 0
jmp 0x43d31b
mov edx, dword [ebp - 0x220]
add edx, 1
mov dword [ebp - 0x220], edx
mov ecx, dword [ebp - 0x21c]
add ecx, 0x314
call fcn.004106d0
cmp dword [ebp - 0x220], eax
jae 0x43d358
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0x314
call fcn.004106b0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x43d30c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00409370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret
Function at 0x43ddd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ebeb
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x46c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x45aea4
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xffffffff
jne 0x43de5c
mov eax, dword [ebp - 0x46c]
jmp 0x43df3d
mov edx, 1
test edx, edx
je 0x43df2a
mov eax, dword [ebp - 0x468]
and eax, 0x10
je 0x43defc
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x43c]
cmp eax, 0x2e
je 0x43defa
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x470]
call fcn.004093b0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x43c]
push edx
lea ecx, [ebp - 0x470]
call fcn.004092d0
push 0x45aeac
lea ecx, [ebp - 0x470]
call fcn.004092d0
lea ecx, [ebp - 0x470]
call fcn.004094b0
push eax
mov ecx, dword [ebp - 0x478]
call sym.nsUninstall.exe_private:_int___thiscall_CNsUninstaller::CountFiles_wchar_t_const__
add eax, dword [ebp - 0x46c]
mov dword [ebp - 0x46c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00409370
jmp 0x43df0b
mov eax, dword [ebp - 0x46c]
add eax, 1
mov dword [ebp - 0x46c], eax
lea ecx, [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x474]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43df25
jmp 0x43df2a
jmp 0x43de5c
mov eax, dword [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret 4
Function at 0x43e0b0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ec60
mov eax, dword fs:[0]
push eax
sub esp, 0xaa4
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xaa4], ecx
push 0x45b00c
lea ecx, [ebp - 0xaa0]
call fcn.004093b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xaa4]
cmp dword [eax + 0xcec], 0
jmp 0x43e13f
jmp 0x43e151
push 0x45b0d4
push 0x45b0d8
call fcn.0041bf4e
add esp, 8
mov dword [ebp - 0xaac], eax
cmp dword [ebp - 0xaac], 0
jne 0x43e189
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa0]
call fcn.00409370
jmp 0x43e320
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.004187d0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0xaa8]
call fcn.00409460
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xaa4]
add eax, 0x178
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x43e1fc
mov ecx, dword [ebp - 0xaa0]
push ecx
lea edx, [ebp - 0x218]
push edx
push str.__echo_off_r_ntaskkill__im_uninst.exe__f_r_ndel___s__r_n_sdel___0
lea eax, [ebp - 0xaa8]
push eax
call fcn.00409b00
add esp, 0x10
jmp 0x43e22b
mov ecx, dword [ebp - 0xaa0]
push ecx
mov edx, dword [ebp - 0xaa4]
add edx, 0x178
push edx
lea eax, [ebp - 0x218]
push eax
push str.__echo_off_r_ntaskkill__im_uninst.exe__f_r_ndel___s__r_nrd__S__Q___s__r_n_sdel___0
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.00409b00
add esp, 0x14
push 0x800
push 0
lea edx, [ebp - 0xa18]
push edx
call fcn.004187d0
add esp, 0xc
lea ecx, [ebp - 0xaa8]
call fcn.004094b0
push eax
lea ecx, [ebp - 0xa9c]
call fcn.00410ba0
mov dword [ebp - 0xab0], eax
mov ecx, dword [ebp - 0xab0]
call fcn.0040c540
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.00420a20
add esp, 8
lea ecx, [ebp - 0xa9c]
call fcn.00410b70
mov ecx, dword [ebp - 0xaac]
push ecx
lea edx, [ebp - 0xa18]
push edx
call fcn.00420950
add esp, 4
push eax
push 1
lea eax, [ebp - 0xa18]
push eax
call fcn.004208f1
add esp, 0x10
mov ecx, dword [ebp - 0xaac]
push ecx
call fcn.0041c2d8
add esp, 4
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0x45b1f8
push 0
push str.c:clear.bat
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret
Function at 0x43e9e0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push str.SeShutdownPrivilege
call sym.nsUninstall.exe_int___cdecl_SetPrivilege_wchar_t_const___int_
add esp, 8
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x43ea09
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x43ea20
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0x45d770
call sym.nsUninstall.exe_int___cdecl_SetPrivilege_wchar_t_const___int_
add esp, 8
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0
je 0x43ea49
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x43ea60
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0x45d6cc
call sym.nsUninstall.exe_int___cdecl_SetPrivilege_wchar_t_const___int_
add esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x43ea89
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x43eaa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sym.nsUninstall.exe_int___cdecl_isWin7_void_
test eax, eax
jne 0x43eab3
xor eax, eax
jmp 0x43eb0a
push 0x45d768
mov eax, dword [ebp + 8]
push eax
call fcn.0041bf37
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43ead1
xor eax, eax
jmp 0x43eb0a
push 0
push 0x15
mov ecx, dword [ebp - 8]
push ecx
call fcn.00423158
add esp, 0xc
mov byte [ebp - 1], 0x20
mov edx, dword [ebp - 8]
push edx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004208f1
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
call fcn.0041c2d8
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x43f1d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ed26
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x28]
call fcn.00413920
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 5
jne 0x43f24f
cmp dword [ebp - 0x134], 0
jne 0x43f24f
push str.Windows2000
lea ecx, [ebp - 0x28]
call fcn.00413730
jmp 0x43f2f5
cmp dword [ebp - 0x138], 5
jne 0x43f273
cmp dword [ebp - 0x134], 1
jne 0x43f273
push str.WindowsXP
lea ecx, [ebp - 0x28]
call fcn.00413730
jmp 0x43f2f5
cmp dword [ebp - 0x138], 6
jne 0x43f294
cmp dword [ebp - 0x134], 0
jne 0x43f294
push str.Windows2003
lea ecx, [ebp - 0x28]
call fcn.00413730
jmp 0x43f2f5
cmp dword [ebp - 0x138], 5
jne 0x43f2b5
cmp dword [ebp - 0x134], 2
jne 0x43f2b5
push str.windowsvista
lea ecx, [ebp - 0x28]
call fcn.00413730
jmp 0x43f2f5
cmp dword [ebp - 0x138], 6
jne 0x43f2d6
cmp dword [ebp - 0x134], 1
jne 0x43f2d6
push str.windows7
lea ecx, [ebp - 0x28]
call fcn.00413730
jmp 0x43f2f5
cmp dword [ebp - 0x138], 6
jne 0x43f2f5
cmp dword [ebp - 0x134], 2
jne 0x43f2f5
push str.windows10
lea ecx, [ebp - 0x28]
call fcn.00413730
lea ecx, [ebp - 0x164]
push ecx
call fcn.0043f380
add esp, 4
movzx edx, word [ebp - 0x164]
cmp edx, 6
je 0x43f31c
movzx eax, word [ebp - 0x164]
cmp eax, 9
jne 0x43f32b
push str._x64
lea ecx, [ebp - 0x28]
call fcn.00413710
jmp 0x43f338
push str._x86
lea ecx, [ebp - 0x28]
call fcn.00413710
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413830
mov edx, dword [ebp - 0x140]
or edx, 1
mov dword [ebp - 0x140], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00413750
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret
Function at 0x43f860
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004187d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._at.exe
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43f8c2
xor eax, eax
jmp 0x43f8df
push 0
push 0
push str._delete__yes
lea ecx, [ebp - 0x20c]
push ecx
call sym.nsUninstall.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret

Function at 0x43f8f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ed97
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004187d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x45d4f8
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43f96d
xor eax, eax
jmp 0x43fa00
lea ecx, [ebp - 0x21c]
call fcn.00409460
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x43f9a3
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s__every:m_t_w_th_f_s_su___s_
lea eax, [ebp - 0x21c]
push eax
call fcn.00409b00
add esp, 0x10
jmp 0x43f9bf
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___s_
lea eax, [ebp - 0x21c]
push eax
call fcn.00409b00
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.004094b0
push eax
lea ecx, [ebp - 0x218]
push ecx
call sym.nsUninstall.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00409370
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret
Function at 0x43fa20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44edeb
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x9c]
call fcn.00409460
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._sdesktop.ini
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00409b00
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x94]
call fcn.00410ba0
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xa8]
call fcn.0040c540
push eax
lea ecx, [ebp - 0xa0]
call fcn.00411a50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00410b70
lea ecx, [ebp - 0x98]
call fcn.00413970
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
push str._.ShellClassInfo__r_nIconFile_s_r_nIconIndex_d
lea eax, [ebp - 0x98]
push eax
call fcn.004147c0
add esp, 0x10
lea ecx, [ebp - 0x98]
call fcn.0040c540
push eax
call fcn.00420950
add esp, 4
push eax
lea ecx, [ebp - 0x98]
call fcn.00411af0
push eax
lea ecx, [ebp - 0x9c]
call fcn.004094b0
push eax
call sym.nsUninstall.exe_int___cdecl_NsWriteFile_wchar_t_const___void___unsigned_long_int_
add esp, 0xc
push 6
lea ecx, [ebp - 0x9c]
call fcn.004094b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0xac], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00411a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00411a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00409370
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret
Function at 0x441320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004187d0
add esp, 0xc
mov dword [ebp - 0x218], 0x208
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 8]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4413cc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4413b7
mov dword [ebp - 0x210], 1
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
jmp 0x4413d2
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret
Function at 0x441840
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46800c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x44186c
xor eax, eax
jmp 0x4418c9
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x441896
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4418c9
lea eax, [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416d81
mov esp, ebp
pop ebp
ret

Function at 0x4418e0
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441905
xor eax, eax
jmp 0x4419d0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 1
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x441980
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x441972
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x441970
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4419d0
jmp 0x441980
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4419d0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4419b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x4419b7
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4419d0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret