joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c120
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x46c139
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46c145
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x46c140
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46c180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x46c195
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46c1a0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x46c570
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
jge 0x46c586
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x100
cmp ebx, eax
push esi
cmovg ebx, eax
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
nop word [eax + eax]
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jl 0x46c5a0
xor cl, cl
mov word [edi + 0x100], 0
xor dl, dl
xor eax, eax
mov dword [ebp - 8], eax
nop dword [eax]
mov ebx, dword [ebp - 8]
movzx esi, dl
mov dl, byte [eax + edi]
mov eax, dword [ebp + 8]
mov byte [0x570c68], dl
movzx eax, byte [esi + eax]
add al, dl
add cl, al
mov byte [ebp - 1], cl
movzx ecx, cl
add ecx, edi
movzx eax, byte [ecx]
mov byte [ebx + edi], al
lea eax, [esi + 1]
mov byte [ecx], dl
mov cl, byte [ebp - 1]
cdq
idiv dword [ebp + 0xc]
mov eax, ebx
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x100
jl 0x46c5c0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c610
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x46c697
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
jl 0x46c697
mov eax, dword [ebp + 0x10]
push ebx
push edi
xor edi, edi
mov bh, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
test ecx, ecx
jle 0x46c680
push esi
nop word [eax + eax]
inc bh
movzx esi, bh
mov bl, byte [esi + eax]
add dl, bl
mov byte [0x570c68], bl
mov byte [ebp - 1], dl
movzx edx, dl
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
mov byte [edx + eax], bl
movzx edx, byte [esi + eax]
movzx ecx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [ebp + 8]
movzx ecx, byte [ecx + eax]
xor byte [edi + edx], cl
inc edi
mov dl, byte [ebp - 1]
cmp edi, dword [ebp + 0xc]
jl 0x46c640
pop esi
mov byte [eax + 0x100], bh
pop edi
mov byte [eax + 0x101], dl
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46d750
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00420a10
add esp, 4
test eax, eax
jne 0x46d7e0
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileExW]
push esi
xor esi, esi
nop
push esi
push str..old
push edi
lea eax, [ebp - 0x808]
push str._s_s_d
push eax
call fcn.004054c0
add esp, 0x14
lea eax, [ebp - 0x808]
inc esi
push 5
push 0
push eax
call ebx
lea eax, [ebp - 0x808]
push eax
call fcn.00414f30
add esp, 4
test eax, eax
je 0x46d7c1
cmp esi, 0x64
jl 0x46d780
push 1
lea eax, [ebp - 0x808]
push eax
push edi
call ebx
test eax, eax
je 0x46d7de
push 5
push 0
lea eax, [ebp - 0x808]
push eax
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x46e380
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 3
push 0
push 3
push 0
push str..CnCrypt
mov esi, 1
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [0x559328], eax
cmp eax, 0xffffffff
jne 0x46e3d9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x46e3cc
push esi
push dword [ebp + 8]
call fcn.00417830
push str.NODRIVER
call fcn.00417300
add esp, 0xc
mov dword [0x571508], esi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push eax
call fcn.0046d7f0
mov edi, dword [ebp + 8]
push edi
call fcn.00472280
add esp, 8
test eax, eax
jne 0x46e3f6
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x5714e0], 0
mov ecx, dword [0x571518]
mov eax, dword [0x55ba7c]
jne 0x46e416
xor edx, edx
test ecx, ecx
cmovne eax, edx
mov dword [0x55ba7c], eax
cmp dword [0x5714f0], 0
je 0x46e42b
test ecx, ecx
jne 0x46e42b
mov dword [0x55ba7c], esi
jmp 0x46e42f
test eax, eax
je 0x46e471
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [0x559328]
call fcn.004a1920
add esp, 8
test eax, eax
jne 0x46e459
push edi
xor esi, esi
call fcn.00417c00
add esp, 4
jmp 0x46e4bc
cmp dword [ebp - 4], 0
jle 0x46e471
push edi
push str.DISMOUNT_ALL_FIRST
xor esi, esi
call fcn.00419a00
add esp, 8
jmp 0x46e4bc
call fcn.00421a00
test eax, eax
je 0x46e485
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x571504], 0
jne 0x46e4b3
push dword [0x559328]
call fcn.004a1890
add esp, 4
cmp eax, 1
jle 0x46e4b3
push edi
push str.CLOSE_CNCRYPT_FIRST
call fcn.00419a00
add esp, 8
xor esi, esi
jmp 0x46e4bc
cmp dword [0x55ba7c], 0
je 0x46e4d2
push dword [0x559328]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x559328], 0xffffffff
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46f590
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x571518], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
je 0x46f716
lea eax, [ebp - 0x810]
mov dword [ebp - 0x80c], 0
push eax
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x810], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCnCrypt
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x46f6fb
mov eax, 0xc
call fcn.004e1f60
mov eax, esp
push 3
push 5
push 0x518f70
push eax
call fcn.00405530
lea edx, [ebp - 0x808]
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x46f622
lea ecx, [ebp - 0x808]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46f640
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x808]
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0x80c]
call esi
mov eax, 0x30
call fcn.004e1f60
mov eax, esp
push 3
push 0x18
push str.http:__www.cncrypt.com_
push eax
call fcn.00405530
lea edx, [ebp - 0x808]
sub edx, eax
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x46f6a0
lea ecx, [ebp - 0x808]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46f6c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x808]
push eax
push 1
push 0
push str.URLInfoAbout
push dword [ebp - 0x80c]
call esi
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea esp, [ebp - 0x818]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x46f72a
push esi
push edi
call fcn.0046fd00
add esp, 8
test eax, eax
je 0x46f738
push esi
push edi
call fcn.0046f7d0
add esp, 8
test eax, eax
jne 0x46f751
push edi
call fcn.00417c00
push 0
push str.REG_INSTALL_FAILED
call fcn.00419a00
add esp, 0xc
xor eax, eax
jmp 0x46f700
push 0xb
call fcn.0041c0d0
add esp, 4
test eax, eax
je 0x46f6fb
lea ecx, [ebp - 0x808]
sub ecx, esi
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x46f770
lea eax, [ebp - 0x808]
push eax
call fcn.0041eee0
push str.INSTALLING_COM
push edi
call fcn.00472170
lea eax, [ebp - 0x808]
push eax
call fcn.0046b5c0
add esp, 0x10
test eax, eax
jne 0x46f6fb
push eax
push str.COM_REG_FAILED
call fcn.00419a00
add esp, 8
xor eax, eax
jmp 0x46f700
Function at 0x46fb90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
jne 0x46fc8d
push 0xb
call fcn.0041c0d0
add esp, 4
test eax, eax
je 0x46fbe9
push str.REMOVING_COM
push esi
call fcn.00472170
push edi
call fcn.0046c2e0
add esp, 0xc
test eax, eax
jne 0x46fbe9
push str.COM_DEREG_FAILED
push esi
call fcn.00472170
add esp, 8
push str.REMOVING_REG
push esi
call fcn.00472170
lea eax, [ebp - 0x84]
push eax
call fcn.004c0c30
lea eax, [ebp - 0x84]
push 0x51a1d0
push eax
call fcn.004c0bc0
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x14
push str.SoftwareCnCrypt
push SysReAllocString
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCnCrypt
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeShellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeShellopen
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeShell
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeDefaultIcon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolume
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClasses.ccx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x46fce7
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCnCrypt
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeShellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeShellopen
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeShell
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolumeDefaultIcon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClassesCnCryptVolume
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareCnCrypt
push SysReAllocString
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x470150
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
push 0x401
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x100c]
push eax
push str._sCnCrypt_Uninstall.bat
lea eax, [ebp - 0x808]
push 0x401
push eax
call fcn.00405500
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x808]
push 0x519b1c
push eax
call fcn.004ed562
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4701cb
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
push edi
push 0x519c28
push edi
push 0x519c28
push edi
push str.:loop_ndel___s_s__nif_exist___s_s__goto_loop_nrmdir___s__ndel___s_
push esi
call fcn.00405ab0
lea eax, [ebp - 0x808]
push eax
push esi
call fcn.00415a00
push esi
call fcn.004ed5ef
push 0x44
lea eax, [ebp - 0x1060]
push 0
push eax
call fcn.004e46b0
add esp, 0x38
mov dword [ebp - 0x1060], 0x44
xor eax, eax
mov dword [ebp - 0x1034], 1
mov word [ebp - 0x1030], ax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1060]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x470269
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x47027f
push dword [ebp - 0x101c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x1018]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x4712f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510486
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov esi, dword [ebp + 0xc]
push ecx
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push esi
push dword [ebp - 0x44]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
call fcn.0041bf70
test eax, eax
je 0x47142b
push esi
lea ecx, [ebp - 0x28]
call fcn.00403e70
push 6
push 0
push str.__x86_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0042b320
cmp eax, 0xffffffff
je 0x471413
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042b8f0
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x4713b9
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x47139c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x14], 7
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00404990
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4713d2
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004052a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00414f30
add esp, 4
test eax, eax
je 0x471413
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edi, 8
mov edx, esi
cmovae ecx, ebx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x471400
jmp 0x471419
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp edi, 8
jb 0x47142b
lea eax, [edi + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.004052a0
add esi, 0xfffffffe
nop
mov ax, word [esi + 2]
lea esi, [esi + 2]
test ax, ax
jne 0x471430
mov eax, dword [0x519954]
mov dword [esi], eax
mov eax, dword [0x519958]
mov dword [esi + 4], eax
mov eax, dword [0x51995c]
mov dword [esi + 8], eax
mov eax, dword [0x519960]
mov dword [esi + 0xc], eax
mov eax, dword [0x519964]
mov dword [esi + 0x10], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x471490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
mov ecx, 0x516968
mov edx, esi
push edi
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4714a1
mov ax, word [ebp + 8]
cmp ax, 0x41
jne 0x4714ea
mov ecx, dword [ebp + 0xc]
mov edx, esi
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4714c2
push 0x516968
push esi
call fcn.004e85f7
add esp, 8
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
ret
cmp ax, 0x44
jne 0x471570
push 0x400
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x471505
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
je 0x471533
lea edi, [esi - 2]
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x471520
mov eax, dword [0x518b40]
mov dword [edi], eax
lea ecx, [esi - 2]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x471536
mov eax, dword [str.Drivers_]
mov dword [ecx], eax
mov eax, dword [0x524174]
mov dword [ecx + 4], eax
mov eax, dword [0x524178]
mov dword [ecx + 8], eax
mov eax, dword [0x52417c]
mov dword [ecx + 0xc], eax
mov ax, word [0x524180]
mov word [ecx + 0x10], ax
jmp 0x4714d2
cmp ax, 0x57
jne 0x4715bd
push 0x400
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x471587
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
je 0x4714d2
lea edi, [esi - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4715a5
mov eax, dword [0x518b40]
mov dword [edi], eax
jmp 0x4714d2
cmp ax, 0x49
jne 0x4714d2
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4715d0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0x572f60
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x471688
mov eax, 0x572f60
add eax, 0xfffffffe
nop dword [eax]
mov cx, word [eax + 2]
lea eax, [eax + 2]
test cx, cx
jne 0x471600
mov ecx, dword [0x519954]
mov dword [eax], ecx
mov ecx, dword [0x519958]
mov dword [eax + 4], ecx
mov ecx, dword [0x51995c]
push esi
mov dword [eax + 8], ecx
mov ecx, dword [0x519960]
push edi
mov dword [eax + 0xc], ecx
mov ecx, dword [0x519964]
push 0
push 0x572f60
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov edx, dword [ebp + 8]
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x471650
mov edi, 0x572f60
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x471665
mov ecx, edx
mov eax, 0x572f60
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
ret
xor eax, eax
mov word [0x572f60], ax
mov eax, 0x572f60
pop ebp
ret
Function at 0x4716a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x516968
mov edx, esi
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4716c0
lea eax, [ebp - 0x80c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCnCrypt
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471780
lea eax, [ebp - 0x810]
mov dword [ebp - 0x810], 0x802
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push str.UninstallString
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x471774
lea eax, [ebp - 0x808]
push 0x2f
push eax
call fcn.004e3c44
add esp, 8
test eax, eax
je 0x471774
lea ecx, [ebp - 0x808]
mov eax, ecx
sub esi, eax
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x471750
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret

Function at 0x4717a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x516968
mov edx, esi
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4717c0
lea eax, [ebp - 0x80c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCnCrypt
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471860
lea eax, [ebp - 0x810]
mov dword [ebp - 0x810], 0x802
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push str.DisplayVersion
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x471854
lea ecx, [ebp - 0x808]
mov eax, ecx
sub esi, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x471830
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x471910
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xb
xor esi, esi
call fcn.0041c0d0
add esp, 4
test eax, eax
jne 0x4719a6
push 1
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x471a3c
push ebx
push 4
push str.srservice
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x471990
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x47198b
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x47197e
cmp eax, 2
jne 0x47198b
push edi
call ebx
push dword [ebp - 0x24]
call ebx
mov esi, 1
push dword [ebp - 0x24]
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
call fcn.0041bf70
test eax, eax
lea eax, [ebp - 0x24]
push eax
je 0x4719cc
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSPPClients
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x471a00
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSPPClients
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x471a04
lea eax, [ebp - 0x24]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSPPClients
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x471a3c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x28], esi
mov eax, 1
push dword [ebp - 0x24]
cmovne esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret