joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470592
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 0x10], eax
cmp dword [eax], ebx
je 0x4705c5
push ebx
push ebx
push ebx
push ebx
lea esi, [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
call fcn.004125fe
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x4707e5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], ebx
je 0x470619
call fcn.00470655
mov ebx, dword [edi + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0045d8bd
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor ebx, ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x470643
mov edi, dword [ebp - 4]
cmp esi, ebx
je 0x47063f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x470650
cmp esi, ebx
je 0x47064e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x470bac
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0049d850
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push edi
push edi
push eax
mov dword [ebp - 0x28], 0x64
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x470bf1
mov ecx, ebx
call fcn.00409513
jmp 0x470bfe
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, ebx
call fcn.00460d84
mov eax, ebx
pop edi
leave
ret

Function at 0x470fe1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea esi, [edi + 4]
push dword [esi]
call fcn.00470ae2
pop ecx
push esi
call fcn.00410e66
mov eax, dword [edi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi]
call ebx
lea ecx, [ebp - 4]
call fcn.00409513
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.00405ac1
push 0x40a
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 4]
push eax
call ebx
lea eax, [edi + 0x40]
push eax
mov eax, dword [esi]
call fcn.00473449
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push edi
push 0x4710af
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 4]
mov dword [edi + 0x30], eax
call fcn.004058e3
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4711ed
Capabilities:
Get session user name
List groups for user account

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
mov dword [ebp - 0x78], ebx
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00405d54
push str.SYSTEM
lea eax, [ebp - 0x70]
push eax
call fcn.0045ca6f
test eax, eax
jne 0x471254
lea ecx, [ebp - 0x70]
call fcn.004058e3
mov al, 1
jmp 0x4712ad
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], ebx
push ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x80], ebx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x4712a2
mov esi, dword [ebp - 0x7c]
xor edi, edi
cmp dword [ebp - 0x74], ebx
jbe 0x4712a2
cmp esi, ebx
je 0x471295
mov ecx, dword [esi]
call fcn.0044e900
test eax, eax
je 0x4712a0
add esi, 4
inc edi
cmp edi, dword [ebp - 0x74]
jb 0x471286
jmp 0x4712a2
mov bl, 1
lea ecx, [ebp - 0x70]
call fcn.004058e3
mov al, bl
pop edi
mov ecx, dword [ebp + 0x198]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049cdcb
add ebp, 0x19c
leave
ret

Function at 0x4714d2
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0x1c
push SysReAllocStringLen
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x4714f3
xor al, al
jmp 0x471510
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4714ef
cmp dword [ebp - 0x18], 4
je 0x47150e
cmp dword [ebp - 0x18], 2
jne 0x4714ef
mov al, 1
leave
ret 4
Function at 0x4722d7
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x304]
sub esp, 0x384
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp + 0x300], eax
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0xc], 1
jne 0x4723a2
push 0x4e23dc
push str.SAGEWINDOWCLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x47232a
xor eax, eax
jmp 0x472405
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xf8]
push eax
push 0x104
push edi
push str.mstask.exe
push edi
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x47236c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x472405
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push 0x210
push edi
push edi
push edi
push edi
lea eax, [ebp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x472361
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
jmp 0x472323
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x472361
push ebx
push 0x14
push str.Schedule
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
cmp ebx, edi
je 0x4723f7
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4723f4
cmp dword [ebp - 0x38], 4
je 0x4723ff
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4723ff
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x472404
push ebx
call esi
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x300]
pop edi
xor ecx, ebp
pop esi
call fcn.0049cdcb
add ebp, 0x304
leave
ret
Function at 0x4729d3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
test edi, edi
je 0x4729e7
add edi, 0xffffffc0
jmp 0x4729e9
xor edi, edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [edi + 4]
mov dword [ebp - 0xc], 1
call ebx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp + 0xc]
call fcn.0041ee20
test eax, eax
je 0x472a36
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.004094c6
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jge 0x472a67
and dword [ebp - 0xc], 0
push 0xffffffffffffffff
add edi, 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
test edi, edi
je 0x472a56
lea eax, [edi - 0x40]
jmp 0x472a58
xor eax, eax
push dword [ebp + 8]
push dword [eax + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x47312a
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
call fcn.00460990
test eax, eax
je 0x4731c7
lea eax, [esp + 8]
push eax
xor esi, esi
push 0x28
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x473177
cmp dword [esp + 8], esi
je 0x473173
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4731de
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x473163
cmp dword [esp + 8], esi
je 0x4731cc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4731cc
call fcn.004731e3
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4731e3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
call esi
test eax, eax
je 0x473322
push 0
push 2
call eax
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
jne 0x473239
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x473322
push str._WindowsFolder_explorer.exe
lea eax, [ebp - 0x23c]
push eax
call fcn.00405d54
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
call fcn.00465edd
pop ecx
lea ecx, [ebp - 0x23c]
call fcn.004058e3
push str.Process32FirstW
push ebx
call esi
push str.Process32NextW
push ebx
mov edi, eax
call esi
push 0x228
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.0049d850
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
mov dword [ebp - 0x238], 0x22c
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x473302
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0045ca6f
test eax, eax
jne 0x4732ef
push dword [ebp - 0x230]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x4732ef
push esi
call edi
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
call dword [ebp - 0x23c]
test eax, eax
jne 0x4732b7
lea ecx, [ebp - 0x240]
call fcn.004058e3
cmp dword [ebp - 0x248], 0
je 0x473322
push dword [ebp - 0x248]
call edi
test ebx, ebx
je 0x47332d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049cdcb
leave
ret
Function at 0x475308
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x7c]
mov eax, dword [eax + 0xc]
push edi
mov edi, dword [eax + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0xc], ebx
jle 0x475350
mov eax, dword [esi + 0x7c]
push ebx
call fcn.00469464
cmp eax, 5
je 0x47533c
cmp eax, 2
jne 0x475340
inc dword [esp + 0xc]
inc ebx
cmp ebx, edi
jl 0x475329
cmp dword [esp + 0xc], 0
jg 0x4753e3
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f7
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3eb
push dword [esi + 4]
call edi
push 0
push eax
mov dword [esp + 0x14], eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
xor edi, edi
push edi
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
sub esi, 0xffffff80
push dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call ebx
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call ebx
mov eax, dword [esp + 0x2c]
push 0x222
push edi
mov dword [esp + 0x24], eax
push esi
lea eax, [esp + 0x1c]
call fcn.00410d7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477890
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea ecx, [ebp - 0x14]
call fcn.00409513
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x80]
mov ecx, dword [eax + 0xc]
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
add ecx, 4
call fcn.0045ca95
add eax, 0x24
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041f0fb
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x4779db
push dword [edi + 0x84]
lea eax, [ebp - 4]
push eax
call fcn.0041f0fb
lea eax, [ebp - 4]
call fcn.0044f180
mov eax, dword [esi + 0x14]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00438d54
lea eax, [ebp - 4]
call fcn.0044f180
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00470c22
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00438d54
lea ecx, [ebp - 0x10]
call fcn.004058e3
xor bl, bl
mov esi, edi
call fcn.00477a89
push 0x8a
lea esi, [ebp - 0xc]
call fcn.0046ec7a
pop ecx
push dword [ebp - 0xc]
push 2
push dword [edi + 0xf4]
push dword [ebp + 0xc]
call fcn.0042a934
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.0046f302
mov bl, al
pop ecx
pop ecx
test bl, bl
jne 0x4779c7
cmp byte [0x506010], al
je 0x477993
push str.MD5_of_downloaded_file_is_invalid.
lea eax, [ebp - 0x10]
push eax
call fcn.00466612
push eax
call fcn.00466622
push eax
mov eax, 0x505fe0
call fcn.00465a03
lea ecx, [ebp - 0x10]
call fcn.004058e3
lea esi, [ebp - 4]
call fcn.0040d3d2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
call fcn.00438b7f
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
push ecx
mov ecx, eax
call fcn.0042df91
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004058e3
lea ecx, [ebp - 0xc]
call fcn.004058e3
lea ecx, [ebp - 4]
call fcn.004058e3
test bl, bl
je 0x477a04
push dword [edi + 0xf4]
push dword [ebp + 0xc]
call fcn.0042b191
mov ecx, dword [edi + 0x80]
mov ecx, dword [ecx + 0xc]
add ecx, 4
call fcn.0045ca95
mov byte [eax + 0x68], 1
mov byte [ebp + 0xf], 1
jmp 0x477a5d
inc dword [edi + 0x188]
lea ecx, [ebp - 4]
call fcn.00409513
push 0x8b
lea esi, [ebp - 0x10]
call fcn.0046ec7a
pop ecx
lea edi, [ebp - 4]
call fcn.00438b14
mov ecx, esi
call fcn.004058e3
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push 2
push dword [eax + 0xf4]
push dword [ebp + 0xc]
call fcn.0042a934
mov eax, dword [ebp + 0x10]
mov ecx, edi
mov dword [eax + 0xc], 1
mov byte [ebp + 0xf], 0
call fcn.004058e3
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x477a6f
mov bl, 1
mov esi, edi
call fcn.00477a89
lea ecx, [ebp - 8]
call fcn.004058e3
lea ecx, [ebp - 0x14]
call fcn.004058e3
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4790f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebx + 0x74]
push edi
call fcn.0046ad04
mov eax, dword [ebx + 0x74]
xor esi, esi
push esi
push 0x3025
call fcn.0046ad9d
mov eax, dword [ebx + 0x74]
push esi
push 0x3023
call fcn.0046ad9d
mov eax, dword [ebx + 0x74]
push esi
push 0x3024
call fcn.0046ad9d
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x401
push dword [ebx + 4]
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x7f04
push ebx
call fcn.00479493
push ebx
call fcn.0047920d
mov dword [ebx + 0x88], esi
push 0
lea esi, [ebx + 0x80]
push dword [esi]
call fcn.00469e4e
test eax, eax
jne 0x4791d7
mov esi, dword [esi]
add esi, 0x3c
lea eax, [ebx + 0x7c]
mov byte [esi + 0x19], 0
mov byte [esi + 0x18], 0
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esi + 0x1c], eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push esi
push 0x472e0d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xae
lea esi, [ebp - 4]
call fcn.0046ec7a
pop ecx
mov edi, eax
call fcn.0047981f
mov ecx, esi
mov dword [ebx + 0x94], eax
call fcn.004058e3
push 0
push 0x3e8
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x479207
mov eax, dword [ebx + 0x74]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov byte [eax + 0x85], 1
push dword [ebx + 4]
call esi
push 2
push eax
call edi
push dword [ebx + 4]
mov edi, eax
call esi
push edi
push 2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0x479f09
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
push ebx
push edi
mov edi, ecx
jne 0x479f47
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00405d31
lea ecx, [ebp - 0x214]
call fcn.00409513
mov eax, edi
lea edi, [ebp - 0x214]
call fcn.00438b14
lea eax, [ebp - 0x218]
push eax
xor ecx, ecx
push esi
inc ecx
call fcn.0042df35
mov edi, 0x4d9c10
push edi
push eax
call fcn.0042e0ac
test eax, eax
lea ecx, [ebp - 0x218]
setne bl
call fcn.004058e3
test bl, bl
je 0x479f96
push edi
push esi
call fcn.00438cdb
push str.AI_WSP_
push esi
call fcn.00438cdb
mov eax, dword [ebp - 0x214]
push dword [eax - 0xc]
push eax
mov eax, esi
call fcn.00438d54
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x214]
call fcn.004058e3
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049cdcb
leave
ret
Function at 0x47a44a
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xd4
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47a477
mov ecx, edi
call fcn.00409513
jmp 0x47a4eb
mov esi, dword [esi]
push 0x4e2b24
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.004a14de
add esp, 0xc
test eax, eax
jne 0x47a46e
lea ecx, [ebp - 0x58]
call fcn.00409513
jmp 0x47a4bb
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
push 0x64
push eax
call fcn.004a1565
add esp, 0xc
test eax, eax
je 0x47a4c8
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00438cdb
push dword [ebp - 0x5c]
call fcn.004a1531
pop ecx
test eax, eax
je 0x47a499
push ebx
push dword [ebp - 0x5c]
call fcn.004a169d
pop ecx
lea ebx, [ebp - 0x58]
call fcn.004532d0
mov eax, ebx
push eax
push edi
call fcn.0041f0fb
mov ecx, ebx
call fcn.004058e3
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.0049cdcb
add ebp, 0x78
leave
ret

Function at 0x47a4fd
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 4]
mov edi, eax
call fcn.00409513
mov ecx, dword [ebp + 0xc]
lea esi, [ebp - 4]
call fcn.00479f09
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], 0
jne 0x47a533
mov ecx, dword [ebp + 8]
call fcn.00409513
jmp 0x47a5b5
call fcn.0047a338
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0041f0fb
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
jne 0x47a555
mov ecx, dword [ebp + 8]
call fcn.00409513
jmp 0x47a5ad
push str.__o_enumsolutions
lea eax, [ebp - 8]
push eax
call fcn.00438cdb
lea eax, [ebp - 4]
call fcn.00438b14
push 0x4d9c10
push edi
call fcn.00438cdb
push str.Solutions.list
push edi
call fcn.00438cdb
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a595
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [edi]
push dword [ebp - 8]
call fcn.00457297
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0041f0fb
lea ecx, [ebp - 8]
call fcn.004058e3
lea ecx, [ebp - 4]
call fcn.004058e3
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47a5c7
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push str.SOFTWAREMicrosoftShared_ToolsWeb_Server_Extensions_
lea eax, [ebp - 8]
push eax
call fcn.00405d54
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.00438d54
lea eax, [ebp - 0x10]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp - 8]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47a618
mov ecx, dword [ebp + 8]
call fcn.00409513
jmp 0x47a6c5
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, str.Location
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
call edi
lea ecx, [ebp - 4]
mov dword [ebp + 0xc], eax
call fcn.00409513
cmp dword [ebp + 0xc], 0xea
jne 0x47a67d
push dword [ebp - 0xc]
lea esi, [ebp - 4]
call fcn.00405c39
lea eax, [ebp - 0xc]
push eax
call fcn.0040d3d2
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push dword [ebp - 0x10]
call edi
mov dword [ebp + 0xc], eax
or eax, 0xffffffff
call fcn.004094c6
xor esi, esi
pop edi
pop ebx
cmp dword [ebp + 0xc], esi
jne 0x47a6b5
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], esi
je 0x47a6b5
push str.BINSTSADM.EXE
lea eax, [ebp - 4]
push eax
call fcn.00438cdb
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a6b5
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0041f0fb
jmp 0x47a6bd
mov ecx, dword [ebp + 8]
call fcn.00409513
lea ecx, [ebp - 4]
call fcn.004058e3
lea ecx, [ebp - 8]
call fcn.004058e3
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x47a846
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47a85c
xor al, al
jmp 0x47a8c9
push ebx
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [edi], ebx
test ebx, ebx
je 0x47a891
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
test eax, eax
jne 0x47a895
xor al, al
jmp 0x47a8c7
mov ecx, dword [ebp + 8]
push esi
push dword [ecx]
push eax
call fcn.0049f130
mov ecx, dword [ebp - 4]
add esp, 0xc
xor eax, eax
push ebx
mov word [esi + ecx], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [edi]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
pop esi
pop ebx
leave
ret 4