Function at 0x40c9ac
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x294]
mov edi, 0x105
mov dword [ebp - 0x5f0], ebx
push edi
push ebx
push eax
mov dword [ebp - 0x5e8], ebx
call fcn.00427a90
add esp, 0xc
lea eax, [ebp - 0x294]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x294]
push 0x5c
push eax
call fcn.00427bf0
pop ecx
pop ecx
test eax, eax
je 0x40ca12
mov byte [eax + 1], bl
jmp 0x40ca2a
mov ax, word [0x44e764]
mov word [ebp - 0x294], ax
mov al, byte [0x44e766]
mov byte [ebp - 0x292], al
mov ebx, dword [ebp + 8]
cmp ebx, 2
jl 0x40ca6c
cmp ebx, 4
jle 0x40ca53
cmp ebx, 0x69
jne 0x40ca6c
push 0x10
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsKServer.Exe
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov edi, 0x105
jmp 0x40ca83
call fcn.004027f3
lea edx, [ebp - 0x84]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ca60
jmp 0x40ca83
call fcn.004027f3
lea edx, [ebp - 0x84]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ca79
lea eax, [ebp - 0x5ec]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov esi, eax
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.00427a90
add esp, 0xc
mov dword [ebp - 0x5e8], edi
lea eax, [ebx - 1]
test esi, esi
jne 0x40cbe8
sub eax, 1
je 0x40cb48
sub eax, 1
je 0x40cb2d
sub eax, 1
je 0x40cb12
sub eax, 0x65
je 0x40caf7
xor ecx, ecx
mov al, byte [ecx + str.ErrorLogFile]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40cade
mov eax, str.KasError.log
jmp 0x40cb61
xor ecx, ecx
mov al, byte [ecx + str.KServerLogFile]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40caf9
mov eax, str.KServer.log
jmp 0x40cb61
xor ecx, ecx
mov al, byte [ecx + str.ConfigChangeLogFile]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40cb14
mov eax, str.KasAgent.log
jmp 0x40cb61
xor ecx, ecx
mov al, byte [ecx + str.FirewallLogFile]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40cb2f
mov eax, str.KasFirewall.log
jmp 0x40cb61
xor ecx, ecx
mov al, byte [ecx + str.NetStatsLogFile]
mov byte [ebp + ecx - 0x84], al
inc ecx
test al, al
jne 0x40cb4a
mov eax, str.KasStats.log
push eax
lea eax, [ebp - 0x294]
push eax
push 0x44c94c
lea eax, [ebp - 0x4a4]
push edi
push eax
call fcn.00408d55
add esp, 0x14
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x5f0]
push eax
push 0
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x5ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x5ec]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40cbd1
lea ecx, [ebp - 0x18c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cbc3
sub ecx, edx
cmp ecx, 1
jae 0x40cc3f
xor ecx, ecx
mov al, byte [ebp + ecx - 0x4a4]
mov byte [ebp + ecx - 0x18c], al
inc ecx
test al, al
jne 0x40cbd3
jmp 0x40cc3f
sub eax, 1
je 0x40cc1e
sub eax, 1
je 0x40cc17
sub eax, 1
je 0x40cc10
sub eax, 0x65
lea eax, [ebp - 0x294]
je 0x40cc09
push str.KasError.log
jmp 0x40cc29
push str.KServer.log
jmp 0x40cc29
push str.KasAgent.log
jmp 0x40cc23
push str.KasFirewall.log
jmp 0x40cc23
push str.KasStats.log
lea eax, [ebp - 0x294]
push eax
push 0x44c94c
lea eax, [ebp - 0x18c]
push edi
push eax
call fcn.00408d55
add esp, 0x14
lea eax, [ebp - 0x18c]
push 0x44e7b0
push eax
call fcn.0042d736
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40cca5
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40cd93
test al, 3
je 0x40cd93
push 0x80
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x18c]
push 0x44e7b0
push eax
call fcn.0042d736
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40cd93
push 2
push 0
push esi
call fcn.0042e36d
push esi
call fcn.0042e966
add esp, 0x10
cmp eax, 0x4c4b40
jle 0x40cdaa
cmp ebx, 0x69
jne 0x40cdaa
lea eax, [ebp - 0x18c]
push eax
push 0x44e7b4
lea eax, [ebp - 0x39c]
push 0x106
push eax
call fcn.00408d55
add esp, 0x10
lea eax, [ebp - 0x5e4]
push eax
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40cd60
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x39c]
push eax
call edi
test eax, eax
jne 0x40cd60
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ce09
test al, 1
je 0x40ce09
push 0x80
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x39c]
push eax
call edi
test eax, eax
je 0x40ce09
push esi
call fcn.0042d5ea
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x18c]
push eax
call fcn.00433885
lea eax, [ebp - 0x18c]
push 0x44e7b0
push eax
call fcn.0042d736
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x40cd97
xor eax, eax
jmp 0x40ce0b
push 2
push 0
push esi
call fcn.0042e36d
push esi
call fcn.0042e966
add esp, 0x10
test eax, eax
jne 0x40ce09
dec ebx
sub ebx, 1
je 0x40cdf6
sub ebx, 1
je 0x40cdea
sub ebx, 1
je 0x40cdde
sub ebx, 0x65
je 0x40cdcf
push str.v1.0
push str._s_Timestamp____________System_Status_or_Error_n
jmp 0x40ce00
push str.Timestamp_______________Description_n
push esi
call fcn.0040c39d
pop ecx
pop ecx
jmp 0x40ce09
push str.v1.0
push str._s_Timestamp____________Configuration_Change_n
jmp 0x40ce00
push str.v1.0
push str._s_Timestamp______Attacks__Src_IP___Src_Port__Dest_IP____Dest_Port___Protocol_Distinguished_Name_n
jmp 0x40ce00
push str.v1.0
push str._s_Timestamp________Receive_____Sent_____Application_n
push esi
call fcn.0040c39d
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret