joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c3d
Capabilities:
Create directory
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00403fa8
push eax
lea ecx, [ebp - 4]
call fcn.00404df3
mov ecx, ebx
call fcn.00404c0b
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x405cad
mov esi, dword [ebp - 4]
xor ecx, ecx
inc ecx
mov edx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x405c89
push edx
lea ecx, [ebp - 4]
call fcn.00404ec3
mov esi, dword [ebp - 4]
push esi
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov edi, eax
call fcn.00404bbc
test edi, edi
jns 0x405ccc
jmp 0x405d36
lea ecx, [ebp - 8]
call fcn.0040c9a8
push eax
lea ecx, [ebp - 4]
call fcn.00404b09
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00403f90
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x405ce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405d2b
push 0x539448
mov edx, esi
lea ecx, [ebp - 8]
call fcn.0040574c
pop ecx
push eax
mov ecx, ebx
call fcn.00404b09
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00403f90
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x405d1a
mov edi, 0x80004005
jmp 0x405d36
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebx]
call edi
test eax, eax
jne 0x405d34
call fcn.00410c11
mov edi, eax
jmp 0x405d36
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.00403f90
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405d45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x513f24
push 0x66
or edi, 0xffffffff
mov dword [ebp - 4], ecx
push 0
mov esi, edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x405dfc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405dfc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x405dfc
xor eax, eax
push eax
push eax
push 4
push eax
push eax
mov eax, dword [ebp - 4]
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, edi
je 0x405dbd
mov esi, eax
mov eax, fcn.0040574b
jmp 0x405dbf
xor eax, eax
test eax, eax
je 0x405df1
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0xc]
mov edx, eax
push esi
call fcn.004059fe
pop ecx
test eax, eax
jne 0x405df1
push eax
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x405df1
mov edi, esi
jmp 0x405dfc
cmp esi, edi
je 0x405dfc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4069b3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push str.chromerecovery
mov esi, ecx
call fcn.00404b61
lea ecx, [ebp - 0xc]
mov byte [esi + 4], 0
call fcn.00410e6e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xc]
call fcn.00410eb3
test eax, eax
js 0x406a5b
mov edi, 0x539920
lea ecx, [ebp - 4]
push edi
call fcn.00404b61
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00410d42
mov ecx, dword [ebp - 4]
mov bl, al
add ecx, 0xfffffff0
call fcn.00403f90
test bl, bl
je 0x406a34
push edi
lea ecx, [ebp - 4]
call fcn.00404b61
push esi
push ecx
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00410def
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00403f90
push str.deferredrun
lea ecx, [ebp - 4]
call fcn.00404b61
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00410d42
mov ecx, dword [ebp - 4]
mov byte [esi + 4], al
lea ecx, [ecx - 0x10]
call fcn.00403f90
lea ecx, [ebp - 8]
call fcn.00411299
lea ecx, [ebp - 0xc]
call fcn.00411299
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x408aa2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jle 0x408bbe
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edi, 2
jle 0x408b21
sub edx, 4
js 0x408bbe
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 2]
movzx ecx, byte [ebx + 1]
shr eax, 6
and ecx, 0xf
add eax, dword [ebp + 0x10]
mov al, byte [eax + ecx*4]
mov ecx, dword [ebp + 0x10]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
sub edi, 3
jmp 0x408abd
sub edi, 1
je 0x408b81
sub edi, 1
jne 0x408bb7
sub edx, 3
js 0x408bbe
movzx eax, byte [ebx]
mov edi, dword [ebp + 0x10]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, edi
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [edi + eax*4]
mov byte [esi + 2], al
add esi, 3
cmp byte [ebp + 0x14], 0
je 0x408bb7
lea eax, [edx - 1]
test eax, eax
js 0x408bbe
mov byte [esi], 0x3d
inc esi
jmp 0x408bb7
sub edx, 2
js 0x408bbe
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [ebx]
and eax, 3
add eax, eax
mov al, byte [ecx + eax*8]
mov byte [esi + 1], al
add esi, 2
cmp byte [ebp + 0x14], 0
je 0x408bb7
lea eax, [edx - 2]
test eax, eax
js 0x408bbe
mov word [esi], 0x3d3d
add esi, 2
sub esi, dword [ebp + 8]
mov eax, esi
jmp 0x408bc0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40ac8c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x40aca7
mov al, 1
jmp 0x40acea
push 0x34
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.004e5020
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x40ace2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LOG_SYSTEM:_ERROR____::GetFileInformationByHandle_failed___d_
call fcn.004119bd
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40aca3
mov eax, dword [ebp - 0x38]
shr eax, 0xa
and al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004e302f
leave
ret

Function at 0x40acf7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareGoogleUpdateDev_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40ad25
xor al, al
jmp 0x40ad6d
push esi
push edi
push 4
pop edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push ebx
push str.IsEnabledLogToFile
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40ad69
cmp dword [ebp - 8], edi
jne 0x40ad69
cmp dword [ebp - 0xc], ebx
je 0x40ad69
mov bl, 1
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x40b0eb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040acf7
mov byte [ebx + 0x77], al
mov ecx, ebx
lea eax, [ebp - 4]
push eax
call fcn.0040bc77
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x14], edi
cmp dword [edi - 0xc], 0
je 0x40b176
push edi
push 1
push str.EnableLogging
push str.LoggingSettings
call esi
push edi
push 1
test eax, eax
push str.ShowTime
setne al
push str.LoggingSettings
mov byte [ebx + 0x74], al
call esi
push edi
push 0
test eax, eax
push str.LogToOutputDebug
setne al
push str.LoggingSettings
mov byte [ebx + 0x76], al
call esi
push edi
push 1
test eax, eax
push str.AppendToFile
setne al
push str.LoggingSettings
mov byte [ebx + 0x78], al
call esi
test eax, eax
setne al
jmp 0x40b184
mov byte [ebx + 0x74], 1
mov al, 1
mov byte [ebx + 0x76], 1
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x79], al
cmp byte [ebx + 0x75], 0
je 0x40b191
mov byte [ebx + 0x76], 1
xor eax, eax
mov byte [ebx], 1
mov dword [ebx + 4], 7
mov edi, esi
mov dword [ebp - 4], eax
mov ecx, dword [eax + 0x5520b0]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x40b1fd
mov ecx, dword [eax + 0x5520b4]
mov dword [ebp - 0x10], ecx
cmp ecx, 9
ja 0x40b1fd
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.0040bc77
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x40b1e0
push esi
push 1
push dword [ebp - 0xc]
push str.LoggingLevel
call edi
jmp 0x40b1e3
xor eax, eax
inc eax
mov edx, dword [ebp - 0x10]
test eax, eax
setne cl
mov byte [ebx + edx*8], cl
lea ecx, [esi - 0x10]
mov dword [ebx + edx*8 + 4], eax
call fcn.00403f90
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
cmp eax, 0x48
jb 0x40b1a2
call fcn.0040e6fc
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], edx
lea ecx, [ecx - 0x10]
call fcn.00403f90
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b229
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.00403fa8
push eax
lea ecx, [ebp - 4]
call fcn.00404df3
mov esi, dword [ebp - 4]
xor ecx, ecx
inc ecx
mov edx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x40b25f
push edx
lea ecx, [ebp - 4]
call fcn.00404ec3
mov esi, dword [ebp - 4]
push esi
xor eax, eax
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x40b295
mov ecx, dword [ebp + 8]
push 0x512eb8
call fcn.00404b61
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00404bbc
lea ecx, [esi - 0x10]
call fcn.00403f90
mov eax, dword [ebp + 8]
jmp 0x40b2cc
push str.GoogleUpdateLog
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40b271
push edi
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.00404e70
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
add eax, 0x10
push 0xffffffffffffffff
mov dword [esi], eax
call fcn.00404bbc
mov ecx, edi
call fcn.00403f90
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x40b37c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
cmp byte [ebx + 0x77], 0
je 0x40b445
mov eax, dword [ebx + 0xcc]
push esi
push edi
test eax, eax
jne 0x40b43b
lea eax, [ebp - 4]
push eax
call fcn.0040b2d1
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
je 0x40b3dc
lea edx, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.00412269
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.00404187
test al, al
jne 0x40b3e6
mov ecx, edi
call fcn.0040ab72
test eax, eax
jns 0x40b3e6
lea ecx, [edi - 0x10]
call fcn.00403f90
lea ecx, [esi - 0x10]
call fcn.00403f90
jmp 0x40b443
mov al, byte [ebx + 0x79]
push 0x20
mov byte [ebp - 8], al
call fcn.004e32f2
pop ecx
push dword [ebp - 8]
mov ecx, eax
push esi
call fcn.0040bd64
mov dword [ebx + 0xcc], eax
test eax, eax
jne 0x40b421
push esi
push dword [ebx + 0x54]
push str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
call fcn.004119bd
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi - 0x10]
call fcn.00403f90
lea ecx, [esi - 0x10]
call fcn.00403f90
mov eax, dword [ebx + 0xcc]
test eax, eax
je 0x40b443
push eax
mov ecx, ebx
call fcn.0040bc04
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b983
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
test esi, esi
je 0x40ba44
cmp dword [ebp + 8], 0
jne 0x40b9a8
cmp dword [ebp + 0x10], 2
jg 0x40ba44
call fcn.00403fa8
push eax
lea ecx, [ebp - 4]
call fcn.00404df3
call fcn.00403fa8
push eax
lea ecx, [ebp + 0x14]
call fcn.00404df3
xor edi, edi
lea eax, [ebx + 0x58]
inc edi
push 0
mov ecx, eax
call fcn.00412163
test al, al
jne 0x40b9ea
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea eax, [ebx + 0x58]
cmp edi, 0x14
jle 0x40b9ca
jmp 0x40ba0e
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
mov ecx, ebx
push esi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b8b0
lea ecx, [ebx + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 0x14
jle 0x40ba2e
push str.LOG_SYSTEM:_Couldnt_acquire_lock__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x53a350
call esi
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00403f90
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00403f90
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40bd64
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], fcn.0040bf12
mov dword [ebx + 4], 0x989680
mov word [ebx + 8], 0
mov byte [ebx + 0xa], al
mov byte [ebx + 0xb], 1
call fcn.00403fa8
push eax
lea ecx, [ebx + 0xc]
call fcn.00404df3
push dword [ebp + 8]
xor edi, edi
lea ecx, [ebx + 0x14]
mov dword [ebx + 0x10], edi
call fcn.00404b61
mov dword [ebx + 0x18], edi
call fcn.00403fa8
push eax
lea ecx, [ebx + 0x1c]
call fcn.00404df3
movzx eax, byte [0x558e46]
neg eax
sbb eax, eax
and eax, 0x557fc0
mov dword [ebp + 8], eax
je 0x40be37
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0040bc77
mov esi, dword [ebp + 0xc]
cmp dword [esi - 0xc], edi
je 0x40be13
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x989680
push str.MaxLogFileSize
push str.LoggingSettings
call edi
mov dword [ebx + 4], eax
xor eax, eax
push esi
inc eax
push eax
push str.LogFileWide
push str.LoggingSettings
call edi
test eax, eax
setne al
jmp 0x40be1d
xor eax, eax
mov dword [ebx + 4], 0x989680
inc eax
mov byte [ebx + 0xb], al
lea ecx, [ebx + 0x1c]
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.00404b09
lea ecx, [esi - 0x10]
call fcn.00403f90
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x40be8f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x40bf10
mov byte [esi + 8], 1
call fcn.0040bf3e
cmp dword [esi + 0x10], 0
je 0x40bf10
test al, al
je 0x40beaf
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.0040c556
test al, al
jne 0x40bed6
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.004119bd
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.0040c003
cmp dword [esi + 0x18], 0
jne 0x40befd
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.004119bd
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x40bf10
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
ret
Function at 0x40c003
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
lea edx, [ebp - 0x8c]
push esi
xor eax, eax
mov dword [ebp - 0x94], ebx
push edi
lea esi, [ebx + 0x14]
mov dword [ebp - 0x98], eax
mov ecx, dword [esi]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x9c], esi
call fcn.00411900
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebx + 4]
jbe 0x40c057
mov ecx, ebx
call fcn.0040c22d
xor eax, eax
cmp byte [ebx + 0xa], al
setne al
xor ecx, ecx
push ecx
push 0x80
lea eax, [eax*2 + 2]
push eax
push ecx
push 3
push 0x40000000
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x18], eax
cmp eax, 0xffffffff
jne 0x40c090
xor edi, edi
xor al, al
mov dword [ebx + 0x18], edi
jmp 0x40c0f8
mov edx, esi
lea ecx, [ebp - 0x8c]
call fcn.00412269
mov esi, dword [ebp - 0x8c]
lea edi, [ebp - 0x28]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
xor edi, edi
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x40c107
call fcn.00410c11
push dword [ebx + 0x14]
push dword [ebx + 0x1c]
push str.LOG_SYSTEM:___s_:_ERROR___Log_path__s_has_a_reparse_point
call fcn.004119bd
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], edi
lea ecx, [esi - 0x10]
call fcn.00403f90
mov al, byte [ebp - 0x98]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e302f
leave
ret
mov eax, dword [ebp - 0x28]
shr eax, 0xa
and al, 1
jne 0x40c0c4
mov ecx, dword [ebx + 0x18]
call fcn.0040ac8c
test al, al
jne 0x40c0c4
lea ecx, [ebp - 0xbc]
call fcn.0040a58e
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x88]
push 0x538ec8
push eax
call fcn.0040a1d6
add esp, 0x10
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0xbc]
push 0xc0010000
push eax
call fcn.0040a60b
lea ecx, [ebp - 0x88]
mov bl, al
call fcn.0040a2bf
test bl, bl
je 0x40c184
push ecx
lea eax, [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call fcn.0040ab39
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40c1bd
mov eax, dword [ebp - 0x94]
cmp byte [eax + 0xb], 0
je 0x40c1bd
xor ecx, ecx
push ecx
mov dword [ebp - 0x94], ecx
lea ecx, [ebp - 0x94]
push ecx
push 2
push 0x514358
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 0x98], 1
call fcn.0040a5d4
jmp 0x40c0ea
Function at 0x40c1d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x40c204
xor al, al
jmp 0x40c228
cmp byte [esi + 0xb], bl
je 0x40c21f
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x514358
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c298
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x74], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c3c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x6c]
push 7
pop esi
push eax
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x40c3c0
cmp dword [ebp - 0x78], esi
jne 0x40c3c0
push dword [ebp - 0x6c]
call fcn.004e3322
push dword [ebp - 0x6c]
mov esi, eax
push ebx
push esi
call fcn.004e5020
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x70]
call edi
test eax, eax
jne 0x40c3b1
mov edi, dword [ebp - 0x6c]
shr edi, 1
mov dword [ebp - 0x7c], edi
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x40c3b1
cmp word [esi + edi*2 - 4], bx
jne 0x40c3b1
cmp word [esi + edi*2 - 2], bx
jne 0x40c3b1
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x74]
add eax, 0x14
mov edx, 0x53a6fc
push eax
call fcn.0040c5f9
test edi, edi
mov edi, dword [ebp - 0x74]
pop ecx
je 0x40c3a0
lea eax, [esi + ebx*2]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40c3a3
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add ebx, eax
cmp ebx, dword [ebp - 0x7c]
jb 0x40c37f
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [edi - 0x10]
setne bl
call fcn.00403f90
test esi, esi
je 0x40c3bc
push esi
call fcn.004e32ed
pop ecx
mov al, bl
jmp 0x40c3c2
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e302f
leave
ret
Function at 0x40c556
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x40c563
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40c59c
cmp eax, 0x80
je 0x40c59c
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.004119bd
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x40c55f
mov al, 1
pop esi
ret

Function at 0x40cbca
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x40cc00
lea esi, [edi + 4]
test esi, esi
je 0x40cc00
call fcn.0040a397
test al, al
je 0x40cc00
mov ecx, edi
call fcn.0040a397
test al, al
je 0x40cc00
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x40cc02
xor al, al
pop edi
pop esi
pop ebx
ret
Function at 0x40efcc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x551008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x124]
push 0x118
push ebx
mov dword [ebp - 0x12c], ebx
push eax
mov dword [ebp - 0x128], 0x11c
call fcn.004e5020
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je case.0x40f12e.2
mov edi, dword [ebp - 0x124]
xor esi, esi
inc esi
cmp edi, 6
je 0x40f0bf
cmp edi, 0xa
je 0x40f0bf
cmp edi, 5
jne case.0x40f12e.2
cmp dword [ebp - 0x120], 2
jne 0x40f0a9
cmp byte [ebp - 0xe], 1
jne 0x40f06f
lea ecx, [ebp - 0x130]
call fcn.0040eed9
push 0x53ab68
mov ecx, eax
mov dword [ebp - 0x12c], esi
call fcn.004078fc
test eax, eax
jne 0x40f06f
mov bl, 1
inc eax
jmp 0x40f075
mov eax, dword [ebp - 0x12c]
test al, 1
je 0x40f087
mov ecx, dword [ebp - 0x130]
lea ecx, [ecx - 0x10]
call fcn.00403f90
test bl, bl
jne case.0x40f12e.1
test dword [ebp - 0x10], 0x8000
je case.0x40f12e.7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e302f
leave
ret
cmp dword [ebp - 0x120], esi
jne case.0x40f12e.2
test dword [ebp - 0x10], 0x200
jne case.0x40f12e.2
xor eax, eax
inc eax
jmp 0x40f09a
mov eax, dword [ebp - 0x120]
mov ecx, str.kernel32.dll
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], eax
call fcn.0040e09b
mov esi, eax
test esi, esi
je case.0x40f12e.2
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f105
lea ecx, [ebp - 0x12c]
push ecx
push ebx
push ebx
push dword [ebp - 0x130]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je case.0x40f12e.2
mov eax, dword [ebp - 0x12c]
cmp eax, 0x1b
ja 0x40f13d
je case.0x40f12e.4
dec eax
cmp eax, 0x18
ja case.0x40f12e.2
movzx eax, byte [eax + 0x40f1a0]
jmp dword [eax*4 + 0x40f190]
push 2
pop eax
jmp 0x40f09a
cmp eax, 0x54
ja 0x40f15d
je case.0x40f12e.4
sub eax, 0x30
je case.0x40f12e.1
sub eax, 0x16
je case.0x40f12e.4
dec eax
sub eax, 1
je case.0x40f12e.4
jmp case.0x40f12e.2
cmp eax, 0x79
jb case.0x40f12e.2
cmp eax, 0x7a
jbe 0x40f18b
cmp eax, 0x7c
jbe case.0x40f12e.2
cmp eax, 0x7e
jbe case.0x40f12e.4
add eax, 0xffffff7f
cmp eax, 1
ja case.0x40f12e.2
push 3
jmp 0x40f137
push 4
jmp 0x40f137