joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b1c0
Capabilities:
Delete file

Disassembly:
push 0xf4
mov eax, 0x467344
call fcn.00463b54
mov edi, ecx
lea eax, [ebp - 0xdc]
xor ebx, ebx
push eax
push str.PrepareRemoteUpdateDescriptor
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xdc], ebx
call fcn.0041bb53
mov dword [ebp - 4], ebx
call fcn.004068d0
push eax
lea ecx, [ebp - 0xe8]
call fcn.00405f99
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd8]
call fcn.0043bcc0
mov byte [ebp - 4], 3
or ebx, 0xffffffff
test edi, edi
je 0x41b378
xor eax, eax
cmp word [edi], ax
je 0x41b378
mov edx, str..xml
lea ecx, [ebp - 0xe0]
call fcn.0041c23b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe8]
push eax
call fcn.0040764f
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xe0]
add ecx, 0xfffffff0
call fcn.00406985
mov esi, dword [ebp - 0xe8]
cmp dword [esi - 0xc], 0
jne 0x41b27a
mov dword [ebp - 0xdc], 0x52
jmp 0x41b388
xor eax, eax
mov edx, esi
push eax
push ecx
mov ecx, edi
call fcn.0041a2b7
mov dword [ebp - 0xdc], eax
pop ecx
pop ecx
test eax, eax
jne 0x41b388
xor edi, edi
mov dword [ebp - 0xe4], ebx
push esi
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe0], edi
call fcn.00409673
mov dword [ebp - 0xe0], eax
mov byte [ebp - 4], 6
mov dword [ebp - 0xdc], eax
test eax, eax
je 0x41b2ec
mov byte [ebp - 4], 3
cmp dword [ebp - 0xe4], ebx
je 0x41b388
push dword [ebp - 0xe4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xe4], ebx
jmp 0x41b388
push edi
mov ecx, esi
call fcn.0041ed18
mov dword [ebp - 0xdc], eax
pop ecx
test eax, eax
jne 0x41b2c5
push edi
push 0x74
push esi
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0043cbd0
lea ecx, [ebp - 0xf4]
call fcn.0043be00
test al, al
jne 0x41b358
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xf4]
push dword [ebp - 0xf4]
call fcn.0043c6e0
push eax
push str.XML_is_not_valid:___hs__error:_u__file_offset:_u
call fcn.0041b909
add esp, 0x10
mov dword [ebp - 0xdc], 0xd
jmp 0x41b2c5
lea ecx, [ebp - 0xd8]
call fcn.00426c46
xor ecx, ecx
cmp eax, 0x490
cmove eax, ecx
mov dword [ebp - 0xdc], eax
jmp 0x41b2c5
mov esi, dword [ebp - 0xe8]
mov dword [ebp - 0xdc], 0x57
cmp dword [esi - 0xc], 0
je 0x41b3c1
push 9
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x41b3be
cmp eax, 0x20
je 0x41b3ae
cmp eax, 5
jne 0x41b3be
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x41b391
or ebx, 0xffffffff
mov edi, dword [ebp - 0xdc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd8]
call fcn.0043bdc0
xor eax, eax
mov byte [ebp - 4], al
lea ecx, [esi - 0x10]
call fcn.00406985
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x100]
call fcn.0041bbc1
mov eax, edi
call fcn.00463afe
ret

Function at 0x41b909
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
lea edx, [ebp + 0xc]
pop ebp
jmp fcn.0041b918
Function at 0x41cfac
Capabilities:
Create directory

Disassembly:
push 0x14
mov eax, 0x4678ef
call fcn.00463b20
mov esi, ecx
xor eax, eax
mov ebx, eax
call fcn.004068d0
push eax
lea ecx, [ebp - 0x14]
call fcn.00405f99
mov dword [ebp - 4], 1
call fcn.004068d0
push eax
lea ecx, [ebp - 0x10]
call fcn.00405f99
mov byte [ebp - 4], 3
or edi, 0xffffffff
test esi, esi
je 0x41d180
xor eax, eax
cmp word [esi], ax
je 0x41d180
push esi
lea eax, [ebp - 0x14]
push str.__s
push eax
call fcn.00406215
add esp, 0xc
lea ecx, [ebp - 0x14]
push 0x5c
push 0x2f
call fcn.004075aa
push ecx
lea ecx, [ebp - 0x14]
call fcn.00405e2a
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040764f
jmp 0x41d0a4
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41d04a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor eax, eax
jmp 0x41d04e
xor eax, eax
mov ebx, eax
cmp ebx, 0xb7
je 0x41d0c5
cmp ebx, 3
jne 0x41d0d0
push 0x5c
push esi
call fcn.00441d1b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41d186
sub edi, esi
sar edi, 1
cmp edi, 0xffffffff
je 0x41d186
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00409467
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
push eax
call fcn.0040764f
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406985
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov eax, dword [esi - 0xc]
dec eax
push eax
call fcn.004076f0
push 0x3a
pop ecx
cmp ax, cx
jne 0x41d030
jmp 0x41d186
cmp edi, 0xffffffff
je 0x41d186
mov ebx, eax
test ebx, ebx
jne 0x41d186
cmp edi, 0xffffffff
je 0x41d186
lea eax, [edi + 1]
push eax
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0041a239
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
cmp eax, 0xffffffff
je 0x41d122
sub eax, edi
push eax
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00414af7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00409578
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
jmp 0x41d145
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.00414abd
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00409578
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00406985
mov esi, dword [ebp - 0x10]
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41d166
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41d168
mov eax, ebx
mov edi, dword [ebp - 0x20]
xor ebx, ebx
cmp eax, 0xb7
cmovne ebx, eax
cmp edi, 0xffffffff
jne 0x41d0e1
jmp 0x41d186
mov esi, dword [ebp - 0x10]
push 0x57
pop ebx
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.00406985
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406985
mov eax, ebx
call fcn.00463ae9
ret
Function at 0x41d1a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x28
mov eax, 0x467912
call fcn.00463b20
mov esi, ecx
push ecx
lea ecx, [ebp - 0x34]
call fcn.004327b3
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004327d5
mov al, bl
call fcn.00463ae9
ret

Function at 0x41d2c6
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48a024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
mov dword [ebp - 0x14], ebx
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x41d31b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x41d335
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x41d311
cmp dword [ebp - 0x14], ebx
setne al
mov byte [esi], al
cmp dword [ebp - 0x10], 0
je 0x41d344
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043fc0b
leave
ret

Function at 0x41d355
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x48a024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push eax
push 8
mov edi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41d3fb
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
inc esi
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41d3fa
push 0x4c
pop eax
push esi
push eax
mov dword [ebp - 0x18], eax
call fcn.00454d8b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41d3fa
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41d3f3
push dword [ebp - 0x10]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
push 1
pop eax
cmovne edi, eax
push esi
call fcn.00445d2e
pop ecx
pop esi
cmp dword [ebp - 0x10], ebx
je 0x41d40c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x41d41a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0043fc0b
leave
ret
Function at 0x41da25
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
push edi
mov edi, ecx
test esi, esi
je 0x41dbab
cmp dword [ebp + 8], ecx
je 0x41dbab
test ebx, ebx
jne 0x41da9a
lea eax, [ebp - 8]
push eax
mov eax, dword [0x48bd80]
or eax, 0x2001b
push eax
push ecx
push dword [0x48bd7c]
push dword [0x48bd78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x41da94
push esi
push str.Unable_to_open_product_registry_key_gle_u
call fcn.0041b909
pop ecx
pop ecx
jmp 0x41dbae
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x10]
jne 0x41daa0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
xor ecx, ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
push ecx
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41db4c
cmp dword [ebp - 0xc], 7
jne 0x41db4c
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.00445d23
mov edi, eax
pop ecx
test edi, edi
jne 0x41daf2
push 8
jmp 0x41dbad
mov eax, dword [ebp - 4]
add eax, 4
push eax
xor eax, eax
push eax
push edi
call fcn.00441660
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41dbae
mov eax, dword [ebp - 4]
test al, 1
je 0x41db2e
inc eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41db51
xor ecx, ecx
cmp word [edi + eax], cx
jne 0x41db43
dec eax
sub eax, 1
mov dword [ebp - 4], eax
jne 0x41db34
test eax, eax
je 0x41db51
add eax, 4
jmp 0x41db4e
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
add eax, ecx
push eax
push edi
call fcn.00454d96
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41daeb
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edi, esi
push dword [ebp + 8]
add eax, esi
push eax
call fcn.004422a0
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax], cx
mov eax, dword [ebp - 4]
add eax, 2
push eax
push esi
push 7
mov dword [ebp - 4], eax
xor eax, eax
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x41dbae
push 0x57
pop esi
cmp dword [ebp - 8], 0
je 0x41dbbd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41dbc8
push edi
call fcn.00445d2e
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41dcc2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov dword [edi], edx
test eax, eax
jne 0x41dd2b
lea eax, [ebp - 8]
push eax
mov eax, dword [0x48bd80]
or eax, 0x20019
push eax
push edx
push dword [0x48bd7c]
push dword [0x48bd78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x41dd23
push esi
push str.Unable_to_open_product_registry_key_gle_u
call fcn.0041b909
pop ecx
pop ecx
jmp 0x41de1c
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x14], eax
push edi
push edx
lea ecx, [ebp - 4]
push ecx
push edx
push dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41de1c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [ecx]
test edx, edx
je 0x41dd5e
cmp edx, eax
je 0x41dd60
push 0x32
pop esi
jmp 0x41de1c
mov dword [ecx], eax
test eax, eax
je 0x41dd79
cmp eax, 2
jbe 0x41dd73
cmp eax, 7
jne 0x41dd79
push 2
pop ebx
jmp 0x41dd76
xor ebx, ebx
inc ebx
mov dword [ebp - 0xc], ebx
mov eax, dword [edi]
mov esi, dword [ebp + 0xc]
lea eax, [eax + ebx*2]
add eax, 2
push eax
push dword [esi]
call fcn.00454d96
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x41dd98
push 8
jmp 0x41dd58
mov dword [esi], ecx
mov eax, dword [edi]
lea eax, [eax + ebx*2]
add eax, 2
push eax
xor eax, eax
push eax
push ecx
call fcn.00441660
add esp, 0xc
lea eax, [ebp - 4]
push edi
push dword [esi]
push eax
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [ebp + 0x10], esi
test esi, esi
jne 0x41de1c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
jne 0x41dd56
test ebx, ebx
je 0x41de1c
mov edx, dword [edi]
mov ecx, edx
test dl, 1
je 0x41ddee
inc edx
mov dword [edi], edx
mov ecx, edx
cmp edx, 2
jbe 0x41de13
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [esi]
cmp word [eax + edx - 2], bx
jne 0x41de0d
lea ecx, [edx - 2]
mov dword [edi], ecx
mov edx, ecx
cmp ecx, 2
ja 0x41ddf8
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0xc]
test ecx, ecx
je 0x41de1c
lea eax, [ecx + ebx*2]
mov dword [edi], eax
cmp dword [ebp - 8], 0
je 0x41de2b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41e3a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x41e3c2
push 0x57
pop eax
jmp 0x41e454
push edi
push esi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push edi
push str.PendingFileDeleteOperations
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e44f
cmp dword [ebp - 4], 7
jne 0x41e44f
mov eax, dword [esi]
add eax, 4
push eax
call fcn.00445d23
pop ecx
mov ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [eax], ecx
test ecx, ecx
jne 0x41e401
push 8
pop eax
jmp 0x41e453
mov eax, dword [esi]
add eax, 4
push eax
push edi
push ecx
call fcn.00441660
add esp, 0xc
lea eax, [ebp - 4]
push esi
push dword [ebp - 0xc]
push eax
push edi
push str.PendingFileDeleteOperations
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e453
mov ecx, dword [esi]
test cl, 1
je 0x41e434
inc ecx
mov dword [esi], ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + ecx], di
jne 0x41e44a
add dword [esi], 0xfffffffe
mov ecx, dword [esi]
cmp word [ecx + edx], di
je 0x41e43f
lea edi, [ecx + 4]
jmp 0x41e451
mov eax, edi
mov dword [esi], edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e458
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
test ebx, ebx
je 0x41e54d
cmp word [ebx], cx
je 0x41e54d
lea eax, [ebp - 8]
push eax
mov eax, dword [0x48bd80]
or eax, 0x2001b
push eax
push ecx
push dword [0x48bd7c]
push dword [0x48bd78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41e55b
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.0041e3a6
mov esi, eax
pop ecx
test esi, esi
jne 0x41e548
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41e4cc
mov eax, dword [ebp - 4]
sub ecx, edx
mov edi, dword [ebp - 0xc]
add eax, 2
sar ecx, 1
lea ecx, [ecx*2 + 2]
add eax, ecx
mov dword [ebp - 0x10], ecx
push eax
push edi
call fcn.00454d96
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x41e503
push 8
jmp 0x41e54f
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edi, esi
add eax, esi
push ebx
push eax
call fcn.004422a0
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax], cx
mov eax, dword [ebp - 4]
add eax, 2
push eax
push esi
push 7
mov dword [ebp - 4], eax
xor eax, eax
push eax
push str.PendingFileDeleteOperations
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x41e550
mov edi, dword [ebp - 0xc]
jmp 0x41e550
push 0x57
pop esi
test edi, edi
je 0x41e55b
push edi
call fcn.00445d2e
pop ecx
cmp dword [ebp - 8], 0
je 0x41e56a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41e571
Capabilities:
Check if file exists
Delete file
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
lea eax, [ebp - 0xc]
xor edx, edx
push eax
mov eax, dword [0x48bd80]
or eax, 0x2001b
mov dword [ebp - 8], edx
push eax
push edx
push dword [0x48bd7c]
mov dword [ebp - 0x10], edx
push dword [0x48bd78]
mov dword [ebp - 0xc], edx
mov byte [ebp - 1], dl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x41e6fb
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
push eax
lea edx, [ebp - 0x10]
call fcn.0041e3a6
mov ebx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 0x20], edi
pop ecx
test edi, edi
jne 0x41e6ef
mov eax, dword [ebp - 8]
test eax, eax
je 0x41e6ef
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x41e6ef
xor edi, edi
push esi
lea esi, [ecx + ebx]
mov ecx, esi
mov dword [ebp - 0x1c], esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x41e5f9
sub ecx, edx
mov dword [ebp - 0x14], 9
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp - 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x41e673
cmp eax, 0x20
je 0x41e636
cmp eax, 5
jne 0x41e64a
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x14], 1
mov esi, dword [ebp - 0x1c]
jns 0x41e619
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41e65a
cmp eax, 3
jne 0x41e65c
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
lea edx, [esi + ecx]
test eax, eax
je 0x41e67c
mov eax, dword [ebp - 8]
mov ecx, edx
mov dword [ebp - 0x10], ecx
jmp 0x41e6a3
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
lea edx, [esi + ecx]
mov eax, dword [ebp - 8]
sub eax, esi
mov byte [ebp - 1], 1
sub eax, ecx
push eax
lea eax, [edx + ebx]
push eax
lea eax, [ecx + ebx]
push eax
call fcn.00442820
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp - 0x10]
sub eax, esi
mov dword [ebp - 8], eax
cmp ecx, eax
jb 0x41e5ee
cmp byte [ebp - 1], 0
mov edi, dword [ebp - 0x20]
pop esi
je 0x41e6ef
test eax, eax
jne 0x41e6c9
push str.PendingFileDeleteOperations
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e6ed
xor ecx, ecx
mov word [ebx + eax], cx
mov eax, dword [ebp - 8]
add eax, 2
push eax
push ebx
push 7
mov dword [ebp - 8], eax
xor eax, eax
push eax
push str.PendingFileDeleteOperations
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test ebx, ebx
je 0x41e6fa
push ebx
call fcn.00445d2e
pop ecx
pop ebx
cmp dword [ebp - 0xc], 0
je 0x41e70a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret
Function at 0x41e70f
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push esi
push edi
mov edi, ecx
xor eax, eax
mov esi, eax
test edi, edi
je 0x41e778
cmp word [edi], ax
je 0x41e778
test dl, dl
je 0x41e743
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41e77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41e73f
cmp eax, 3
jne 0x41e74c
xor esi, esi
jmp 0x41e77b
call fcn.0041d1a9
test al, al
je 0x41e77b
cmp byte [0x48bcbc], 0
jne 0x41e76d
push 4
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41e77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41e774
mov ecx, edi
call fcn.0041e458
mov esi, eax
jmp 0x41e77b
push 0x57
pop esi
pop edi
mov eax, esi
pop esi
ret

Function at 0x41e802
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ecx, ecx
push eax
mov eax, dword [0x48bd80]
mov esi, ecx
or eax, 0x2001b
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [0x48bd7c]
mov dword [ebp - 0xc], ecx
mov ebx, ecx
push dword [0x48bd78]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x41e8f3
lea eax, [ebp - 0xc]
push eax
push 0x20006
push edi
push str.EmUpdateVolatile
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x41e8f3
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 7
push eax
lea eax, [ebp - 0x10]
mov edx, str.PendingNotifications
push eax
call fcn.0041dcc2
mov esi, dword [ebp - 8]
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x18], edi
test edi, edi
je 0x41e89b
xor edi, edi
jmp 0x41e8f3
xor edi, edi
lea edx, [ebx + esi]
mov ecx, edx
mov dword [ebp - 8], edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x41e8ab
sub ecx, dword [ebp - 0x10]
sar ecx, 1
lea ebx, [ebx + ecx*2]
lea ebx, [ebx + 2]
je 0x41e8dd
mov ecx, edx
call fcn.0041a756
push edi
push edi
push edi
push dword [ebp - 8]
xor edx, edx
mov ecx, eax
inc edx
call fcn.00431ec4
add esp, 0x10
cmp ebx, dword [ebp - 0x14]
jb 0x41e89d
push str.PendingNotifications
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [ebp - 0x18]
cmp dword [ebp - 4], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41e904
push dword [ebp - 4]
call ebx
cmp dword [ebp - 0xc], 0
je 0x41e90f
push dword [ebp - 0xc]
call ebx
test esi, esi
je 0x41e91a
push esi
call fcn.00445d2e
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret