Function at 0x407310
Capabilities:
Delete file
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446951
mov eax, dword fs:[0]
push eax
mov eax, 0x114c
call fcn.0042b3c0
mov eax, dword [0x45b738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x111c], eax
mov dword [ebp - 0x1118], edi
mov dword [ebp - 0x1120], ecx
mov dword [ebp - 4], 0
call dword [0x45ca2c]
mov esi, dword [ebp + 0xc]
test esi, esi
mov ebx, eax
jne 0x407373
xor ecx, ecx
jmp 0x4073ca
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jg 0x4073c6
lea edi, [eax + eax]
mov eax, edi
call fcn.0042ed50
mov esi, esp
test esi, esi
je 0x4073bd
mov edx, dword [ebp + 0xc]
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push edx
push 0
push ebx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [ebp - 0x1118]
neg eax
sbb eax, eax
and eax, esi
mov esi, dword [ebp + 0xc]
jmp 0x4073c8
mov edi, dword [ebp - 0x1118]
mov esi, dword [ebp + 0xc]
xor eax, eax
mov ecx, eax
lea edx, [ebp - 0xd10]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4073d0
call fcn.00417cc9
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
jle 0x407b2c
test eax, eax
setne cl
test ecx, ecx
jne 0x407401
push 0x80004005
call fcn.00402f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x112c], eax
lea ecx, [ebp - 0x1140]
push ecx
push 0x44f630
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x407532
push 0x3ff
push eax
lea edx, [ebp - 0x50f]
push edx
mov dword [ebp - 0x1124], 1
mov byte [ebp - 0x510], al
call fcn.0042b0d0
add esp, 0xc
mov dword [ebp - 0x113c], 0x400
call dword [0x45ca2c]
test esi, esi
mov ebx, eax
jne 0x407475
xor eax, eax
jmp 0x4074a2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x40748a
xor eax, eax
jmp 0x4074a2
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ed50
mov ecx, dword [ebp + 0xc]
mov eax, esp
push ebx
push esi
push ecx
push eax
call fcn.0040b720
lea edx, [ebp - 0x1110]
mov cl, byte [eax]
add eax, 1
add edx, 1
test cl, cl
jne 0x4074a8
lea edx, [ebp - 0x113c]
push edx
lea eax, [ebp - 0x510]
push eax
mov eax, dword [ebp - 0x1140]
lea ecx, [ebp - 0x1124]
push ecx
push 0
lea edx, [ebp - 0xd10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x407532
lea ecx, [ebp - 0x510]
push ecx
lea ecx, [ebp - 0x1114]
call fcn.0040b800
lea edx, [ebp - 0x1114]
push edx
lea ecx, [ebp - 0x112c]
mov byte [ebp - 4], 2
call fcn.00403730
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1114]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407532
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x112c]
cmp dword [esi - 0xc], 0
jne 0x40754c
push 0
push 0
push 0x44f8a0
call fcn.004108a6
lea ecx, [ebp - 0x760]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4075d5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4075d5
push eax
push eax
lea edx, [ebp - 0x1124]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x1124]
mov ecx, dword [ebp - 0x111c]
push 0x30
push 0x44f908
push eax
call fcn.00411e07
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407caf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x407caf
call fcn.00417cc9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4075ef
push 0x80004005
call fcn.00402f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1114], eax
mov byte [ebp - 4], 3
mov esi, dword [edi + 8]
cmp dword [edi + 4], esi
jbe 0x407612
call fcn.004292a5
mov ebx, dword [edi + 4]
cmp ebx, dword [edi + 8]
jbe 0x40761f
call fcn.004292a5
push esi
push edi
push ebx
push edi
lea ecx, [ebp - 0x1134]
push ecx
mov ebx, edi
call fcn.00409bb0
mov ebx, dword [ebp - 0x111c]
mov esi, dword [ebx + 0x8c]
add ebx, 0x84
cmp dword [ebx + 4], esi
jbe 0x40764d
call fcn.004292a5
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 8]
jbe 0x40765a
call fcn.004292a5
push esi
push ebx
push edi
push ebx
lea edx, [ebp - 0x1134]
push edx
call fcn.00409bb0
mov edi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x1114]
push str._Main__nservercnt_i_n
push eax
call fcn.004031b0
add esp, 0xc
xor esi, esi
test edi, edi
jle 0x4078d7
call fcn.00417cc9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4073f7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x111c], eax
push 0
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x1120]
push esi
lea ecx, [ebp - 0x113c]
push ecx
mov ecx, edi
call fcn.00418aea
mov ebx, eax
push 1
push esi
lea edx, [ebp - 0x1124]
push edx
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.00418aea
mov byte [ebp - 4], 6
mov ecx, dword [ebx]
mov edx, dword [eax]
push ecx
lea edi, [esi + 1]
push edi
push edx
push edi
lea eax, [ebp - 0x111c]
push str.name_i_s_ndb_i_s_n
push eax
call fcn.004031b0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1124]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40772d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x113c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407753
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x111c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x1114]
call fcn.0040ad80
call fcn.00417cc9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4073f7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1134], eax
call fcn.00417cc9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4073f7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1130], eax
push 0
mov byte [ebp - 4], 7
mov ebx, dword [ebp - 0x1120]
push esi
lea ecx, [ebp - 0x1138]
push ecx
mov ecx, ebx
call fcn.00418aea
push eax
lea ecx, [ebp - 0x1134]
mov byte [ebp - 4], 8
call fcn.00403730
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1138]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push esi
lea ecx, [ebp - 0x1128]
push ecx
mov ecx, ebx
call fcn.00418aea
push eax
lea ecx, [ebp - 0x1130]
mov byte [ebp - 4], 9
call fcn.00403730
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1128]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40784d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x1118]
lea ebx, [ebp - 0x1134]
call fcn.00401fa0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1130]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407884
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1134]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4078a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x111c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4078cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, edi
cmp esi, dword [ebp + 0x10]
jl 0x40768c
cmp byte [ebp + 0x14], 0
mov esi, dword [ebp - 0x112c]
je 0x4078f5
push 0x35
push str.passwordasd_ndepictlogonno_ntasklist42_nshowDBListy_n
lea ecx, [ebp - 0x1114]
call fcn.0040ad80
push 0x100
lea ecx, [ebp - 0x110]
push 0
push ecx
call fcn.0042b0d0
mov ecx, dword [esi - 0xc]
add esp, 0xc
xor eax, eax
test ecx, ecx
jle 0x407939
test eax, eax
jl 0x4079ca
cmp eax, ecx
jg 0x4079ca
movzx ecx, word [esi + eax*2]
mov byte [ebp + eax - 0x110], cl
mov ecx, dword [esi - 0xc]
add eax, 1
cmp eax, ecx
jl 0x407914
lea edx, [ebp - 0x110]
push 0x44f9ec
push edx
call fcn.004299ed
add esp, 8
test eax, eax
mov dword [ebp - 0x1120], eax
jne 0x4079d4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1114]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40797d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40799d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4079c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x407cd5
push 0x80070057
call fcn.00402f80
mov esi, dword [ebp - 0x1114]
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax]
push ecx
call fcn.0040ca4b
mov edi, eax
lea eax, [esi - 0x10]
add esp, 4
cmp dword [eax + 0xc], 1
mov dword [ebp - 0x1118], eax
jle 0x407a18
mov edx, dword [eax + 4]
push edx
lea ecx, [ebp - 0x1114]
call fcn.004030f0
mov esi, dword [ebp - 0x1114]
lea eax, [esi - 0x10]
mov dword [ebp - 0x1118], eax
or ecx, 0xffffffff
add dword [eax + 0xc], ecx
jne 0x407a23
mov dword [eax + 0xc], ecx
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0x4e3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
mov ebx, eax
lea eax, [ebx - 1]
push eax
push edi
push 0xffffffffffffffff
push esi
push 0
push 0x4e3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x1120]
push ecx
add ebx, 0xffffffff
push ebx
push 1
push edi
call fcn.0042a0d6
add esp, 0x10
test esi, esi
jne 0x407a74
xor eax, eax
jmp 0x407a95
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407a80
sub eax, edx
sar eax, 1
js 0x4079ca
cmp eax, dword [esi - 8]
jg 0x4079ca
mov edx, dword [ebp - 0x1120]
mov dword [esi - 0xc], eax
push edx
mov word [esi + eax*2], 0
call fcn.0042a1d6
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1118]
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ad9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x112c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407aff
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x407cd5
test eax, eax
setne cl
test ecx, ecx
jne 0x407b3f
push 0x80004005
call fcn.00402f80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x1118], esi
lea ecx, [ebp - 0x1124]
push ecx
push 0x44f630
mov bl, 0xa
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x407c27
push 0x3ff
push eax
lea edx, [ebp - 0x90f]
push edx
mov dword [ebp - 0x1138], 1
mov byte [ebp - 0x910], al
call fcn.0042b0d0
add esp, 0xc
lea eax, [ebp - 0x1128]
push eax
lea ecx, [ebp - 0x910]
push ecx
mov ecx, dword [ebp - 0x1124]
lea edx, [ebp - 0x1138]
push edx
push 0
lea eax, [ebp - 0xd10]
push eax
push ecx
mov dword [ebp - 0x1128], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x407c27
lea edx, [ebp - 0x910]
push edx
lea ecx, [ebp - 0x1120]
call fcn.0040b800
lea eax, [ebp - 0x1120]
push eax
lea ecx, [ebp - 0x1118]
mov byte [ebp - 4], 0xb
call fcn.00403730
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1120]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x1118]
lea ecx, [ebp - 0x360]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x407cf9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x407cf9
push eax
push eax
lea edx, [ebp - 0x1128]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x1128]
mov ecx, dword [ebp - 0x111c]
push 0x30
push 0x44f908
push eax
call fcn.00411e07
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407caf
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407cd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x1168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428ac7
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x111c]
mov eax, dword [ecx + 0xb4]
push 0x9000
push eax
lea ecx, [ebp - 0x1154]
call fcn.0041921a
lea ecx, [ebp - 0x1154]
call fcn.00418fb4
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x407aff
mov ecx, dword [esi]
push esi
jmp 0x407af8