joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4163a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x416401
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SaveKey:_could_not_get_backup_priv_name:__x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x416441
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SaveKey:_could_not_open_process_token:__x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 1
push eax
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ecx
push eax
push 0
push dword [ebp - 0x28]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4164aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SaveKey:_couldnt_acquire_privileges:__x
push 1
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov esi, eax
test esi, esi
je 0x4164d0
push esi
push str.SaveKey:_regsavekey_failed:__x
push 1
call fcn.00446b80
add esp, 0xc
push 0
push 0
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x416c20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push 0x20a
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00411960
add esp, 0xc
test esi, esi
je 0x416d0f
push esi
call fcn.0041e620
add esp, 4
test eax, eax
jns 0x416c95
push 0x49fe10
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x416ceb
mov eax, dword [ebp - 0x214]
lfence
test eax, eax
je 0x416cc9
push eax
push ebx
push esi
push 0x49f010
push 0x49fe48
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x1c
jmp 0x416d2d
push ebx
push esi
push 0x49f010
push 0x49fe60
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x18
jmp 0x416d2d
push esi
push 0x49f010
push 0x49fe74
lea eax, [ebp - 0x210]
push 0x105
push eax
lfence
call fcn.00419510
add esp, 0x14
jmp 0x416d2d
push 0x49f010
push 0x49fe80
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x49fe88
push 0x20
call fcn.00446b80
add esp, 0xc
test edi, edi
je 0x416dff
lea eax, [ebp - 0x214]
push eax
push 0x10002
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x416d82
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49feb0
push 4
jmp 0x416e62
push edi
push dword [ebp - 0x214]
call fcn.0045cfd0
add esp, 8
test eax, eax
je 0x416dee
cmp eax, 2
je 0x416dc9
push eax
push 0x49fef8
push 4
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x210]
push eax
push 0x49ff38
push 0x20
call fcn.00446b80
add esp, 0x10
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x416e6a
push edi
lea eax, [ebp - 0x210]
push eax
push 0x49ff80
push 2
jmp 0x416dd8
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x416e54
cmp eax, 2
je 0x416e44
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0x49ffb0
push 4
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 0x49fff0
push 0x20
jmp 0x416e62
lea eax, [ebp - 0x210]
push eax
push 0x4a0034
push 2
call fcn.00446b80
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x416e80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push esi
push edi
push eax
push 9
xor edi, edi
mov dword [ebp - 0x60], ebx
push edi
push 0x49f010
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x416edb
push eax
push str.VNLGetNextVNetInRegistry:_Failed_to_open_database:__d
push 4
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push str.vmnet_u
push 0x14
push eax
call fcn.00457af0
add esp, 0x10
lea eax, [ebp - 0x5c]
push eax
push 1
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416f41
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x14
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.00457c40
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x32
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, eax
mov dword [ebp - 0x58], 1
test ebx, ebx
jne 0x416fc9
lea eax, [ebp - 0x4c]
push eax
call fcn.0041e620
mov ecx, eax
add esp, 4
test ecx, ecx
js 0x416f9d
mov eax, dword [ebp + 8]
cmp ecx, eax
jbe 0x416f9d
test esi, esi
je 0x416f91
cmp ecx, edi
jae 0x416f9d
inc eax
mov esi, 1
mov edi, ecx
cmp ecx, eax
je 0x416ffd
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x32
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x58]
mov ebx, eax
test ebx, ebx
je 0x416f70
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0x103
je 0x417008
push ebx
push str.VNLGetNextVNetInRegistry:_unexpected_search_failure__d_n
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41700c
test esi, esi
je 0x41701f
push edi
push str.vmnet_u
push 0x14
push dword [ebp - 0x60]
call fcn.00457af0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x417ae0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 0
push 0x4a0118
call fcn.00447210
mov esi, dword [ebp + 8]
push esi
push 0x4a0134
push 0x80
call fcn.00446b80
add esp, 0x1c
test esi, esi
je 0x417c66
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push 0
movups xmmword [ebp - 0x18], xmm0
call fcn.00416e80
add esp, 8
test eax, eax
je 0x417c66
push 0
push 0
push 0
push 0x4a0060
call fcn.00447210
lea eax, [ebp - 0x18]
push eax
push 0x4a0080
push 0x80
call fcn.00446b80
lea eax, [ebp - 0x18]
push eax
call fcn.0041e5e0
add esp, 0x20
test eax, eax
je 0x417c33
push 0
push 0x4a00d4
lea eax, [ebp - 0x18]
push 0x4a00e0
push eax
call fcn.00416c20
push 0
push 0x4a00e4
lea eax, [ebp - 0x18]
push 0x4a00e0
push eax
call fcn.00416c20
push 0
push 0x4a00f0
lea eax, [ebp - 0x18]
push 0x4a00e0
push eax
call fcn.00416c20
push 0
push 0x4a00f8
lea eax, [ebp - 0x18]
push 0x4a00e0
push eax
call fcn.00416c20
add esp, 0x40
lea eax, [ebp - 0x18]
push 0
push 0
push 0x4a00e0
push eax
call fcn.00416c20
push 0
push 0x4a0100
lea eax, [ebp - 0x18]
push 0x4a0110
push eax
call fcn.00416c20
push 0
push 0
lea eax, [ebp - 0x18]
push 0x4a0110
push eax
call fcn.00416c20
push 0
push 0
lea eax, [ebp - 0x18]
push 0x49f980
push eax
call fcn.00416c20
add esp, 0x40
lea eax, [ebp - 0x18]
push 0
push 0
push 0
push eax
call fcn.00416c20
add esp, 0x10
jmp 0x417c42
push 0x4a00a4
push 1
call fcn.00446b80
add esp, 8
call fcn.00446aa0
lea eax, [ebp - 0x18]
push eax
call fcn.0041e620
lea ecx, [ebp - 0x18]
inc eax
push ecx
push eax
call fcn.00416e80
add esp, 0xc
test eax, eax
jne 0x417b43
push edi
push 1
push esi
push 0x4a0158
call fcn.0041c1b0
push 0
push 0
push 0
push 0
call fcn.00416c20
add esp, 0x1c
mov edi, eax
push 0x4a01b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x417ca3
cmp eax, 2
je 0x417ca3
xor esi, esi
jmp 0x417ca8
mov esi, 1
push 0x4a01f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x417cc5
cmp eax, 2
je 0x417cc5
xor eax, eax
jmp 0x417cca
mov eax, 1
push eax
push esi
push edi
push 0x4a021c
push 0x20
call fcn.00446b80
add esp, 0x14
call fcn.00446aa0
test edi, edi
pop edi
je 0x417d00
test esi, esi
je 0x417d00
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
Function at 0x417d20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push 0
push 0x4a1a7c
call fcn.00447210
test esi, esi
mov eax, 0x4a0b74
cmovne eax, esi
push eax
push 0x4a1a98
push 0x80
call fcn.00446b80
add esp, 0x1c
test esi, esi
je 0x417d81
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417d70
sub ecx, edx
sar ecx, 1
jne 0x417db8
lea esi, [ebp - 0x210]
push 0x105
mov eax, esi
push eax
push 0x4a1abc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
ja 0x417f13
mov eax, esi
push eax
push 0x4a1ae8
push 2
call fcn.00446b80
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push 0x4a01b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417def
push eax
push 0x4a1b68
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x417f2e
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push 0x4a0158
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417e1f
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417e53
cmp eax, 5
jne 0x417e53
push 0x4a0158
push 0x4a20a0
push 8
call fcn.00446b80
push 1
push 0x4a20e8
push 0x4a0158
push reloc.OLEAUT32.dll_SysReAllocString
push 0x4a2150
call fcn.0041d680
add esp, 0x20
push 0
push 0x4a0158
push reloc.OLEAUT32.dll_SysReAllocString
push 0x4a21a0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004154f0
add esp, 0x14
push 0x4a221c
test eax, eax
je 0x417ea6
push 0x4a2224
push 0x10
call fcn.00446b80
push 1
push 0x4a20e8
push 0x4a0158
push reloc.OLEAUT32.dll_SysReAllocString
push 0x4a2150
call fcn.0041d680
add esp, 0x20
jmp 0x417eb5
push 0x4a2254
push 1
call fcn.00446b80
add esp, 0xc
call fcn.004284f0
push 0
push esi
push dword [ebp - 0x214]
call fcn.004163a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x417edb
lea ecx, [eax + 1]
mov edx, 0x4a1ba8
jmp 0x417ee5
mov ecx, 0x10
mov edx, 0x4a1bdc
push edx
push ecx
call fcn.00446b80
add esp, 8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00446aa0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4a1abc
push 0x4a1b20
push 1
call fcn.00446b80
add esp, 0x10
call fcn.00446aa0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
Function at 0x418b10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push 0
push 0x4a1c18
call fcn.00447210
test esi, esi
mov eax, 0x4a0b74
cmovne eax, esi
push eax
push 0x4a1c38
push 0x80
call fcn.00446b80
add esp, 0x1c
test esi, esi
je 0x418b71
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418b60
sub ecx, edx
sar ecx, 1
jne 0x418ba8
lea esi, [ebp - 0x210]
push 0x105
mov eax, esi
push eax
push 0x4a1abc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
ja 0x418c37
mov eax, esi
push eax
push 0x4a1c5c
push 2
call fcn.00446b80
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0x4a01b0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417370
add esp, 0x14
test eax, eax
je 0x418bde
push eax
push 0x4a1ce4
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x418c52
push 0xc
push esi
push dword [ebp - 0x214]
call fcn.00416220
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x418bff
lea ecx, [eax + 1]
mov edx, 0x4a1d24
jmp 0x418c09
mov ecx, 0x10
mov edx, 0x4a1d5c
push edx
push ecx
call fcn.00446b80
add esp, 8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00446aa0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4a1abc
push 0x4a1c98
push 1
call fcn.00446b80
add esp, 0x10
call fcn.00446aa0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 4
Function at 0x41a410
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push esi
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x41a482
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41a471
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.IsFileSymLink
push str._hs:_GetFileAttributesExW___ls___...__failed__error:__u_n
push 1
call fcn.00446b80
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
test dword [ebp - 0x28], 0x400
je 0x41a471
push 0
push 0
push 0
lea eax, [ebp - 0x278]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp eax, 0xffffffff
je 0x41a471
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x254]
cmp eax, 0xa000000c
je 0x41a4c1
cmp eax, 0xa0000003
jne 0x41a471
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x41b6c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41b70c
test bl, 1
je 0x41b70c
push esi
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
jne 0x41b707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ebx
push str.RemoveReadOnlyFileAttribute:_failed_to_change_attrs_to__08x_for__S:__d
push 4
call fcn.00446b80
add esp, 0x14
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x41b9c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.0047dca0
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2810]
push edi
xor edi, edi
mov dword [ebp - 0x281c], 0
push 0x280c
push edi
push eax
mov dword [ebp - 0x2820], 0
mov dword [ebp - 0x2818], edi
mov word [ebp - 0x2814], 0x500
call fcn.00411960
add esp, 0xc
lea eax, [ebp - 0x281c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x2818]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x41ba65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TokenHasAdminGroup:_could_not_create_administrators_SUID:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2820]
push eax
push 0x280c
lea eax, [ebp - 0x2810]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41bab2
push str.TokenHasAdminGroup:_could_not_obtain_token_privilege_information
push 1
call fcn.00446b80
add esp, 8
push dword [ebp - 0x281c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp dword [ebp - 0x2810], esi
jbe 0x41bb1b
nop dword [eax]
push dword [ebp - 0x281c]
push dword [ebp + esi*8 - 0x280c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x41bb0b
mov eax, dword [ebp + esi*8 - 0x2808]
test al, 0x10
je 0x41baf8
push str.TokenHasAdminGroup:_group_present_for_deny_only
push 2
call fcn.00446b80
mov eax, dword [ebp + esi*8 - 0x2808]
add esp, 8
test al, 4
jne 0x41bb16
push str.TokenHasAdminGroup:_group_is_not_enabled
push 2
call fcn.00446b80
add esp, 8
inc esi
cmp esi, dword [ebp - 0x2810]
jb 0x41bac0
jmp 0x41bb1b
mov edi, 1
mov eax, 0x4a7b90
test edi, edi
mov ecx, 0x4a7b88
cmove ecx, eax
push ecx
push str.TokenHasAdminGroup:_Done_scanning__result_is__s
push 2
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0x281c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x41bb60
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.0047dca0
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x2814]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x2810
xor edi, edi
mov dword [ebp - 0x2818], 0
push edi
push eax
call fcn.00411960
add esp, 0xc
lea eax, [ebp - 0x2820]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x41bbdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TokenHasPrivilege:_could_not_get_privilege_LUID:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2818]
push eax
push 0x2810
lea eax, [ebp - 0x2814]
push eax
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41bc1f
push str.TokenHasPrivilege:_could_not_obtain_token_privilege_information
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x2814]
xor ecx, ecx
test edx, edx
je 0x41bc58
mov esi, dword [ebp - 0x281c]
lea eax, [ebp - 0x280c]
mov ebx, dword [ebp - 0x2820]
nop dword [eax]
cmp dword [eax - 4], ebx
jne 0x41bc49
cmp dword [eax], esi
je 0x41bc53
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x41bc40
jmp 0x41bc58
mov edi, 1
mov eax, 0x4a7b90
test edi, edi
mov ecx, 0x4a7b88
cmove ecx, eax
push ecx
push str.TokenHasPrivilege:_Done_scanning_for_privilege__result_is__s
push 2
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x41bc90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push 0x20a
push 0
push eax
call fcn.00411960
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov eax, ecx
mov dword [ebp - 0x218], 0
sub eax, 0x5000
je 0x41bce9
sub eax, 6
je 0x41bd05
push ecx
push str.VNLAddFileToUninstallList:_Case_for_product__u_needs_to_be_implemented
push 1
call fcn.00446b80
add esp, 0xc
call fcn.00417760
test eax, eax
je 0x41bd18
push str.VNLAddFileToUninstallList:_writing_uninstall_keys_for_VMware_Workstation
push 0x20
call fcn.00446b80
push 0x4a1150
jmp 0x41bd32
push str.VNLAddFileToUninstallList:_writing_uninstall_keys_for_USB
push 0x20
call fcn.00446b80
push 0x4a1328
jmp 0x41bd32
call fcn.004172c0
test eax, eax
je 0x41bd52
push str.VNLAddFileToUninstallList:_writing_uninstall_keys_for_player
push 0x20
call fcn.00446b80
push 0x4a1200
push 0x4a0cd0
push str.SOFTWARE_S_SPrivateUninstallFiles
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x1c
jmp 0x41bd7c
push str.VNLAddFileToUninstallList:_writing_uninstall_keys_for_product_branch
push 2
call fcn.00446b80
push str.SOFTWAREVMware__Inc.VMware_WorkstationPrivate
push str._SUninstallFiles
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x18
push 0
lea eax, [ebp - 0x214]
push eax
push 7
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417370
mov edi, eax
add esp, 0x14
test edi, edi
je 0x41bdd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x210]
push ecx
push eax
push edi
push str.VNLAddFileToUninstallList:_Could_not_create_uninstall_files_path:_0x_08x_0x_08x__S
push 1
call fcn.00446b80
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push 2
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x41be27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
push edi
push str.VNLAddFileToUninstallList:_Could_not_set_uninstall_key_for_file:_0x_08x_0x_08x__s
push 1
call fcn.00446b80
add esp, 0x14
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push esi
push str.VNLAddFileToUninstallList:_set_uninstall_key:__S
push 0x10
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret