joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d6d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45d6e7
add esp, 0xfffffff0
call fcn.00403684
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041dd1c
mov eax, dword [0x47693c]
cmp word [eax + 2], 0
jne 0x45d70f
mov eax, dword [0x47693c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ee50
mov eax, dword [0x476a5c]
cmp word [eax + 2], 0
jne 0x45d729
mov eax, dword [0x476a5c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f048
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4155d0]
call fcn.00403330
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4155d0]
call fcn.00403330
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x420310]
call fcn.00427c98
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45d8b0
mov eax, dword [0x4767e8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00428068
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45f5f8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4767e8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ca24
test eax, eax
je 0x45d81e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b00
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ca4c
test eax, eax
je 0x45d832
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004043a4
mov eax, dword [0x4765f8]
cmp byte [eax], 0
jne 0x45d866
mov eax, ebx
call fcn.0045d9d8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045f7d4
mov eax, ebx
call fcn.00460198
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d8a6
call fcn.004036dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dc58
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x477bec]
cmp dword [eax + 0x30], 0
je 0x45dd02
cmp dword [ebx + 0x94], 0
jne 0x45dcfc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45dbe8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45dcfc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45dcc2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45dcfc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417a70
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45dcd1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45e864
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45e899
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404224
jmp 0x45e8a6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404188
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45f9b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45f9f1
mov eax, esi
call fcn.00445fd4
test al, al
je 0x45f9f1
mov eax, dword [ebx + 0x84]
call fcn.00445cd0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45f9f1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445cd0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x469bf4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414b58]
call fcn.00404acc
xor eax, eax
push ebp
push 0x469d38
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4764c4], 0
jne 0x469c47
mov ecx, dword [0x47661c]
mov dl, 1
mov eax, dword [0x407400]
call fcn.0040bc10
call fcn.00403aec
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d58
mov eax, ebx
call fcn.0040499c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x469d48
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405a50
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004049ac
test eax, eax
jle 0x469cdf
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x469cd8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004043bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004043a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408258
test eax, eax
jne 0x469cd8
mov ebx, 0x15
jmp 0x469ce4
mov ebx, 0x10
jmp 0x469ce4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4764c4]
call fcn.00469b4c
mov eax, dword [ebp - 8]
call fcn.00469b4c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405a68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469d3f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404158
lea eax, [ebp - 0x10]
mov edx, dword [0x414b58]
call fcn.00404b9c
ret
Function at 0x403110
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4f7458]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x224], ecx
cmp dword [ebp + 8], 0
jne 0x403136
xor eax, eax
jmp 0x403253
mov dword [ebp - 0x220], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x200
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0048ac80
add esp, 0xc
push 0x1388
push str..pipeEST_IPC_MEDIASEC2011
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x403190
push 0x4c87dc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x403253
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push str..pipeEST_IPC_MEDIASEC2011
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4031e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c87bc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x403253
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048ba20
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x403243
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c8794
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048abfc
mov esp, ebp
pop ebp
ret 4

Function at 0x403270
Capabilities:
Delete file
Delete registry key
Move file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.004030c0
test eax, eax
je 0x4032bd
push str.ProcessCtrl64.sys
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
push 4
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 4]
call fcn.00402470
jmp 0x4032f3
push str.ProcessCtrl.sys
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 8]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
push 4
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 8]
call fcn.00402470
push str.SYSTEMCurrentControlSet_servicesProcessCtrl
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str._Update_:_ProcessCtrlUnstall_is_done.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret
Function at 0x403320
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], str.ProcessCtrl
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x24c]
call fcn.004030c0
test eax, eax
je 0x403396
push str.ProcessCtrl64.sys
mov eax, dword [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x234]
call fcn.00402470
jmp 0x4033d0
push str.ProcessCtrl.sys
mov ecx, dword [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov ecx, dword [eax]
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x238]
call fcn.00402470
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jne 0x4033f5
xor eax, eax
jmp 0x40347a
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x230]
push edx
push 1
push 2
push 1
push 0xf01ff
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40344b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403442
jmp 0x403460
mov dword [ebp - 0x14], 0
jmp 0x403460
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
jne 0x4033f5
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4040d0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bec48
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4f7458]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
push str.estdel
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40417e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push str.UpdateDrivers_Rename_file_failed:__s______s___d_
mov edx, dword [ebp - 0x4c]
push edx
call fcn.004028d0
add esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x14]
jmp 0x40427f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4041fa
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.UpdateDrivers_Copy_file_failed:__s______s___d_
mov edx, dword [ebp - 0x4c]
push edx
call fcn.004028d0
add esp, 0x14
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x18]
jmp 0x40427f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
push 4
push 0
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x404249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x10]
push edx
push str.UpdateDrivers_RebootDel__Delete_file_failed:__s___d_
mov eax, dword [ebp - 0x4c]
push eax
call fcn.004028d0
add esp, 0x10
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x1c]
jmp 0x40427f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.UpdateDrivers_Copy_file_succeed:__s______s
mov edx, dword [ebp - 0x4c]
push edx
call fcn.004028d0
add esp, 0x10
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x406b20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bedf0
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4f7458]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4f89c8
call fcn.0042b8e0
mov dword [ebp - 4], 0
push 0x4c9abc
lea ecx, [ebp - 0x10]
call fcn.0040f050
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406b98
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x406bce
mov edx, dword [ebp - 0x10]
push edx
push str.CopyToUpdateDriectory_Is_Empty_Directory__s.
mov eax, dword [ebp - 0x88]
push eax
call fcn.004028d0
add esp, 0xc
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x14]
jmp 0x406c73
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x88]
mov eax, dword [edx]
sub eax, 0x10
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.00411c60
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
add edx, 0x10
mov eax, dword [ebp - 0x64]
mov dword [eax], edx
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 4], 1
push ecx
mov edx, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x10
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.00411c60
add esp, 4
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
add edx, 0x10
mov eax, dword [ebp - 0x80]
mov dword [eax], edx
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x88]
call fcn.00407af0
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4079e0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4f7458]
xor eax, ebp
mov dword [ebp - 0x104], eax
mov dword [ebp - 4], 0
push 0x4c9f2c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0048c6a4
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x407a1f
xor eax, eax
jmp 0x407adc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x40
lea eax, [ebp - 0x148]
push eax
call fcn.0048c5aa
add esp, 0x10
movzx ecx, word [ebp - 0x148]
cmp ecx, 0x5a4d
je 0x407a58
mov edx, dword [ebp - 4]
push edx
call fcn.0048b766
add esp, 4
xor eax, eax
jmp 0x407adc
push 0
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048c268
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call fcn.0048c5aa
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048b766
add esp, 4
cmp dword [ebp - 0x100], 0x4550
je 0x407aa3
xor eax, eax
jmp 0x407adc
movzx edx, word [ebp - 0xfc]
cmp edx, 0x14c
jne 0x407ab6
xor eax, eax
jmp 0x407adc
movzx eax, word [ebp - 0xfc]
cmp eax, 0x200
je 0x407ad3
movzx ecx, word [ebp - 0xfc]
cmp ecx, 0x8664
jne 0x407ada
mov eax, 1
jmp 0x407adc
xor eax, eax
mov ecx, dword [ebp - 0x104]
xor ecx, ebp
call fcn.0048abfc
mov esp, ebp
pop ebp
ret
Function at 0x4096f0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf180
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f7458]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push str.CUpdatePatchApp::ClearnOld38Files__________________enter
mov eax, dword [ebp - 0x34]
push eax
call fcn.004028d0
add esp, 8
push str.CDGRegedit64.exe
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004028d0
add esp, 8
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40979c
push str.DeleteFile__________________4
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004028d0
add esp, 8
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40979c
push 4
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.CDGRegedit320.exe
mov edx, dword [ebp - 0x34]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0040f970
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.004028d0
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40980c
push str.DeleteFile__________________5.
mov edx, dword [ebp - 0x34]
push edx
call fcn.004028d0
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40980c
push 4
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.CUpdatePatchApp::ClearnOld38Files__________________end
mov eax, dword [ebp - 0x34]
push eax
call fcn.004028d0
add esp, 8
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40a260
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x4f7458]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], 0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
mov dword [ecx], 0x22c
mov edx, dword [0x4cab50]
mov dword [ebp - 0x24c], edx
mov eax, dword [0x4cab54]
mov dword [ebp - 0x248], eax
mov ecx, dword [0x4cab58]
mov dword [ebp - 0x244], ecx
mov dl, byte [0x4cab5c]
mov byte [ebp - 0x240], dl
mov dword [ebp - 0x258], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffff
jne 0x40a2ed
xor eax, eax
jmp 0x40a47b
mov eax, dword [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x40a468
mov dword [ebp - 0x268], 3
mov edx, dword [ebp - 0x25c]
add edx, 0x24
mov dword [ebp - 0x264], edx
jne 0x40a33d
mov dword [ebp - 0x27c], 0
jmp 0x40a413
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x3fffffff
jle 0x40a36e
mov dword [ebp - 0x280], 0
jmp 0x40a407
mov eax, dword [ebp - 0x260]
shl eax, 1
call fcn.0048bb30
mov dword [ebp - 0x274], esp
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x280], ecx
cmp dword [ebp - 0x274], 0
je 0x40a39f
cmp dword [ebp - 0x264], 0
jne 0x40a3ab
mov dword [ebp - 0x280], 0
jmp 0x40a407
mov edx, dword [ebp - 0x274]
mov byte [edx], 0
push 0
push 0
mov eax, dword [ebp - 0x260]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x274]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x264]
push edx
push 0
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x40a3fb
mov dword [ebp - 0x280], 0
jmp 0x40a407
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x280], ecx
mov edx, dword [ebp - 0x280]
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.004ae15e
add esp, 8
test eax, eax
jne 0x40a44a
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx + 8]
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x25c]
push ecx
mov edx, dword [ebp - 0x250]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x254], eax
jmp 0x40a306
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
lea esp, [ebp - 0x280]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048abfc
mov esp, ebp
pop ebp
ret