joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push str.DeviceAccess
push dword [0x499014]
lea eax, [ebp - 0x108]
push dword [0x499010]
push dword [section..data]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046a6f0
mov edi, eax
test edi, edi
je 0x405243
push ebx
push esi
lea eax, [ebp - 0x10c]
push eax
push 0
push str.HWBlockList
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c1d2
leave
ret

Function at 0x405252
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push str.DeviceAccess
push dword [0x499014]
lea eax, [ebp - 0x108]
push dword [0x499010]
push dword [section..data]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046a6f0
mov edi, eax
test edi, edi
je 0x4052d8
push ebx
push esi
lea eax, [ebp - 0x10c]
push eax
push 0
push str.HWAllowList
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c1d2
leave
ret

Function at 0x405374
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [esi + 0x14]
push edi
mov edi, dword [esi + 0xc]
test edi, edi
je 0x4053fb
cmp dword [esi], 1
jne 0x4053fb
push edi
call fcn.0046aa10
pop ecx
cmp eax, 1
jne 0x4053a8
mov bl, 0x6e
jmp 0x4053fb
cmp eax, 2
jne 0x4053b1
mov bl, 0x6f
jmp 0x4053fb
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4053fb
xor eax, eax
push 0x400
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0046c445
lea eax, [esi + 0x141c]
push eax
push 0
push 1
push 0x20
lea eax, [esi + 0x15]
push eax
lea eax, [ebp - 0x804]
push eax
push eax
call fcn.00412d91
add esp, 0x28
mov bl, al
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0046c1d2
leave
ret
Function at 0x40540e
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0xa4]
sub esp, 0x124
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0xa0], eax
mov eax, dword [ebp + 0xac]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xb0]
push esi
mov dword [ebp - 0x80], eax
xor esi, esi
lea eax, [ebp - 0x78]
push eax
push edi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x68], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, esi
je 0x4054e5
cmp eax, dword [ebp + 0xb4]
ja 0x4054e5
cmp ebx, esi
je 0x4054e5
push ebx
push eax
push dword [ebp - 0x78]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4054e5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4054e5
mov eax, dword [ebp - 0x68]
movzx ecx, word [eax]
movzx edx, word [eax + 2]
push dword [ebp - 0x7c]
shl ecx, 0x10
or ecx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
push dword [eax]
lea eax, [ebp - 0x64]
push 0x485258
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4054e5
push dword [ebp - 0x6c]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x70], 1
mov ecx, dword [ebp + 0xa0]
mov eax, dword [ebp - 0x70]
xor ecx, ebp
pop esi
call fcn.0046c1d2
add ebp, 0xa4
leave
ret
Function at 0x4054fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor eax, eax
xor edx, edx
test esi, esi
jbe 0x405631
dec esi
shr esi, 3
inc esi
push ebx
mov dword [ebp - 4], esi
mov esi, 0xff
push edi
mov edi, dword [ebp + 0xc]
xor dword [ecx], edi
mov edi, dword [ebp + 8]
xor dword [ecx + 4], edi
add edi, dword [ebp + 0xc]
add dword [ebp + 0xc], edi
mov dword [ebp + 8], edi
movzx edi, byte [ecx]
xor edi, eax
shrd eax, edx, 8
shr edx, 8
mov ebx, eax
mov eax, edx
and edi, esi
xor ebx, dword [edi*8 + 0x484a58]
xor eax, dword [edi*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
shr eax, 8
xor eax, dword [edx*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
shr eax, 8
xor eax, dword [edx*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
shr eax, 8
xor eax, dword [edx*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
shr eax, 8
xor eax, dword [edx*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
shr eax, 8
xor eax, dword [edx*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
shr eax, 8
xor eax, dword [edx*8 + 0x484a5c]
inc ecx
movzx edx, byte [ecx]
xor edx, ebx
shrd ebx, eax, 8
shr eax, 8
and edx, esi
xor ebx, dword [edx*8 + 0x484a58]
mov edi, eax
xor edi, dword [edx*8 + 0x484a5c]
inc ecx
dec dword [ebp - 4]
mov eax, ebx
mov edx, edi
jne 0x405520
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4061b9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push 3
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40620b
push 0x47
push 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
mov dword [ebp - 4], ebx
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jne 0x406204
test byte [ebp - 4], 1
je 0x406204
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x406211
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push 0x1000
push esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x406381
push ebx
push edi
lea ebx, [edi + 0x400]
mov byte [edi], 0
call fcn.00401f60
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp], 0x494bb0
push edi
call esi
push str.K7OemCfg.dat
push edi
call esi
lea eax, [ebp - 8]
push eax
push 0
push edi
call fcn.00401d50
add esp, 0xc
cmp eax, 1
jne 0x406370
mov eax, dword [ebp + 8]
mov esi, dword [eax]
and dword [ebp - 0xc], 0
push 0
push 0x494e0c
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x40633b
cmp byte [ebx], 0
je 0x406364
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x4062bc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x406323
and al, 0x10
xor cl, cl
push 0xfa0
cmp cl, al
lea eax, [esi + 0x10]
push eax
push 0xffffffffffffffff
sbb ebx, ebx
xor ecx, ecx
push edi
push ecx
and ebx, 0xfeffff00
push 1
add ebx, 0x2000107
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esi + 0x10]
cmp word [eax], 0
je 0x406323
push eax
call fcn.0046de55
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], ecx
mov dword [esi + 4], 0x4b374558
mov dword [esi + 8], ebx
add esi, ecx
inc dword [eax]
inc dword [ebp - 0xc]
push dword [ebp - 0xc]
push 0x494e0c
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
lea ebx, [edi + 0x400]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push ebx
mov byte [ebx], 0
mov ecx, dword [ebp - 8]
push edi
mov dword [ebp - 4], 0x400
mov eax, dword [ecx]
push str.DynaExclude
call dword [eax + 0x14]
cmp eax, 1
je 0x40629a
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [ebp - 0xc], 1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
test ecx, ecx
je 0x40638f
mov eax, dword [ecx]
call dword [eax + 0x40]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x406686
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ecx
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
cmp dword [0x49c444], ebx
je 0x406726
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0x800
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x406724
push ebx
push 0x19
push esi
push ebx
mov byte [esi], bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x5c
push esi
call fcn.0046df51
pop ecx
pop ecx
cmp eax, ebx
je 0x406719
inc eax
push 0x5c
push eax
call fcn.0046df51
pop ecx
pop ecx
cmp eax, ebx
je 0x406719
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.All_Users
inc eax
push eax
call edi
push str.K7_ComputingK7TSecurityK7AntiVirusQuarantine
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406718
push esi
push dword [esp + 0x1c]
call edi
mov dword [esp + 0x10], 1
pop edi
push esi
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebp
mov eax, dword [esp + 4]
pop ebx
pop ecx
ret
Function at 0x406926
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x48], 0
push esi
push edi
push 0x1000
mov esi, ecx
push 0
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x4c], edi
test edi, edi
je 0x406ac7
push edi
mov byte [edi], 0
call fcn.00403d4d
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406ab7
mov esi, dword [esi]
push 0xfa0
lea edi, [esi + 0x10]
push edi
push 0xffffffffffffffff
push dword [ebp - 0x4c]
xor eax, eax
push eax
push eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp word [edi], 0
je 0x4069c1
push edi
call fcn.0046de55
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [esi], ecx
mov dword [esi + 4], 0x4b374558
mov dword [esi + 8], 0x1000007
mov dword [esi + 0xc], eax
add esi, ecx
inc dword [ebx]
mov edi, dword [ebp - 0x4c]
push edi
mov byte [edi], 0
call fcn.00406686
cmp byte [edi], 0
pop ecx
je 0x406aa8
lea eax, [ebp - 0x44]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x406a65
cmp byte [ebp - 0x44], 0
lea eax, [ebp - 0x44]
jmp 0x406a5e
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x406a4b
mov eax, dword [ebp - 0x48]
mov al, byte [eax]
push 0xfa0
mov byte [edi], al
lea edi, [esi + 0x10]
push edi
push 0xffffffffffffffff
push dword [ebp - 0x4c]
xor eax, eax
push eax
push eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp word [edi], 0
je 0x406a48
push edi
call fcn.0046de55
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [esi], ecx
mov dword [esi + 4], 0x4b374558
mov dword [esi + 8], 0x1000007
mov dword [esi + 0xc], eax
add esi, ecx
inc dword [ebx]
mov edi, dword [ebp - 0x4c]
push dword [ebp - 0x48]
call fcn.0046df70
pop ecx
mov ecx, dword [ebp - 0x48]
lea eax, [ecx + eax + 1]
cmp byte [eax], 0
mov dword [ebp - 0x48], eax
jne 0x4069f0
jmp 0x406aa8
push 0xfa0
lea edi, [esi + 0x10]
push edi
push 0xffffffffffffffff
push dword [ebp - 0x4c]
xor eax, eax
push eax
push eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp word [edi], 0
je 0x406aa8
push edi
call fcn.0046de55
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [esi], ecx
mov dword [esi + 4], 0x4b374558
mov dword [esi + 8], 0x1000007
mov dword [esi + 0xc], eax
add esi, ecx
inc dword [ebx]
mov eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
mov dword [eax], esi
mov dword [ebp - 0x48], 1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
pop edi
xor ecx, ebp
pop esi
call fcn.0046c1d2
leave
ret
Function at 0x406ad8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push 0x12000
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x406c9c
push ebx
push esi
mov dword [eax], edi
lea ebx, [eax + 4]
lea esi, [eax + 0x10000]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.00403acd
pop ecx
cmp dword [ebp - 0x10], edi
je 0x406c37
mov dword [ebp - 0x14], edi
jmp 0x406c20
push esi
push dword [ebp - 0x14]
mov byte [esi], 0
push dword [ebp - 0x10]
call fcn.00403b3b
add esp, 0xc
cmp eax, 1
jne 0x406c2e
push 0x7c
push esi
call fcn.0046df51
pop ecx
pop ecx
cmp eax, edi
je 0x406c1d
lea ecx, [ebp - 8]
push ecx
mov byte [eax], 0
inc eax
push 0x494e0c
push eax
mov dword [ebp - 8], edi
call fcn.0046e065
add esp, 0xc
cmp dword [ebp - 8], edi
je 0x406c1d
push 0x400
lea edi, [esi + 0x418]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x406b9e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jb 0x406c1b
lea eax, [eax + edi - 1]
cmp byte [eax], 0x5c
jne 0x406bb6
mov byte [eax], 0
test dword [ebp - 8], 0x17c
je 0x406c1b
push 0xfa0
lea edi, [ebx + 0x10]
push edi
xor eax, eax
push 0xffffffffffffffff
mov word [edi], ax
lea eax, [esi + 0x418]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp word [edi], 0
je 0x406c1b
call fcn.004065f4
test al, al
je 0x406bf6
or dword [ebp - 8], 0x10000000
push edi
call fcn.0046de55
mov edx, dword [ebp - 8]
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [ebx], ecx
mov dword [ebx + 4], 0x4b374558
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
add ebx, ecx
inc dword [ebp - 4]
mov dword [ebp - 0xc], ebx
xor edi, edi
inc dword [ebp - 0x14]
lea eax, [ebx + 0x400]
cmp eax, esi
jb 0x406b30
push dword [ebp - 0x10]
call fcn.00405191
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00406394
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00406211
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edi
push eax
lea ecx, [ebp - 0x14]
lea edi, [ebp - 4]
call fcn.0040672d
add esp, 0x14
cmp dword [ebp - 0x14], 0
jne 0x406c76
mov ebx, edi
lea ecx, [ebp - 0xc]
call fcn.00406926
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
push esi
sub eax, esi
push eax
call fcn.00411729
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
xor eax, eax
inc eax
pop edi
leave
ret
Function at 0x406dbb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xe0
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x4854b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x406df0
push str.GetVolumePathNamesForVolumeNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49c420], eax
push 0x49c404
call fcn.00402010
pop ecx
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x406e40
cmp dword [ebp - 0x64], 6
jb 0x406e40
xor eax, eax
inc eax
cmp dword [ebp - 0x64], 6
mov dword [0x49c444], eax
jne 0x406e36
cmp dword [ebp - 0x60], 2
jb 0x406e2f
mov dword [0x49c44c], eax
cmp dword [ebp - 0x60], eax
jb 0x406e40
jmp 0x406e3b
mov dword [0x49c44c], eax
mov dword [0x49c448], eax
call fcn.00406d82
cmp dword [0x49c44c], 0
mov dword [0x49c440], eax
je 0x406e5f
mov dword [str.D:P_A__GA___SY__A__GR___WD_], 0x485450
jmp 0x406e7c
cmp dword [0x49c444], 0
mov dword [str.D:P_A__GA___SY__A__GR___WD_], 0x48541c
jne 0x406e7c
mov dword [str.D:P_A__GA___SY__A__GR___WD_], 0x4853e4
push 0
lea eax, [ebp + 0x34]
push 0
push eax
call fcn.00402050
add esp, 0xc
push 0x49c128
lea eax, [ebp + 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringA]
push 0x49c460
call fcn.004021a0
pop ecx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0046c1d2
add ebp, 0x78
leave
ret
Function at 0x407058
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push 0xf003f
push edi
push 0x485588
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40713e
mov eax, 0x4000
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x40713e
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push edi
push 0x48554c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4070d7
mov eax, dword [ebp - 0xc]
shr eax, 1
lea esi, [esi + eax*2 - 2]
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, str.___s
push ebx
push esi
call edi
lea esi, [esi + eax*2]
xor eax, eax
add esp, 0xc
mov word [esi], ax
inc esi
inc esi
cmp dword [ebp + 0xc], eax
je 0x407108
push dword [ebp + 0xc]
push ebx
push esi
call edi
add esp, 0xc
lea esi, [esi + eax*2]
xor eax, eax
mov word [esi], ax
inc esi
inc esi
mov word [esi], ax
sub esi, dword [ebp - 4]
inc esi
inc esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
push 7
push eax
push 0x48554c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
xor edi, edi
pop ebx
test eax, eax
jne 0x40713e
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], edi
je 0x40714c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], edi
je 0x407162
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x10]
pop edi
leave
ret
Function at 0x407168
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
sub esp, 0xc
and dword [esp + 8], 0
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [esp + 0x20]
push 0x80
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x14], eax
call esi
mov ebx, eax
xor eax, eax
cmp dword [esp + 0x14], eax
jne 0x407251
cmp ebx, 0x20
je 0x4071b1
cmp ebx, 5
jne 0x407230
mov dword [esp + 0x10], eax
cmp dword [esp + 0x2c], eax
je 0x407211
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x30]
call fcn.00407027
pop ecx
pop ecx
test eax, eax
jne 0x407211
cmp dword [esp + 0x10], eax
je 0x407211
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x407200
push 0x80
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x14], eax
call esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0
jne 0x407251
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 5
jl 0x407184
cmp ebx, 5
je 0x40725d
cmp ebx, 0x20
je 0x40725d
cmp ebx, 0x21
je 0x40725d
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
xor eax, eax
cmp ebx, 2
setne al
dec eax
and eax, 3
add eax, 0x12
jmp 0x4072b5
mov eax, dword [esp + 0x28]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x4072b5
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
call esi
xor ebp, ebp
mov esi, eax
cmp ebx, ebp
je 0x40727e
mov eax, dword [esp + 0x28]
mov dword [eax], ebp
push 2
jmp 0x4072b4
push ebp
push edi
call fcn.00407058
pop ecx
test eax, eax
mov eax, dword [esp + 0x2c]
pop ecx
jne 0x407278
mov dword [eax], esi
cmp esi, 5
jne 0x40729a
push 0x13
jmp 0x4072b4
cmp esi, 0x20
je 0x4072b2
cmp esi, 0x21
je 0x4072b2
xor eax, eax
cmp esi, 2
setne al
dec eax
and eax, 0x5e
jmp 0x40724c
push 0x72
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4072bd
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call edi
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ebx, ecx
je 0x4072f6
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x40737b
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x18], ecx
je 0x40734d
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
call fcn.00407027
pop ecx
pop ecx
test eax, eax
jne 0x40734a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x407335
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
call edi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40734a
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x4072ee
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, 5
jne 0x40735b
push 0x13
jmp 0x40737a
cmp eax, 0x20
je 0x407378
cmp eax, 0x21
je 0x407378
xor ecx, ecx
cmp eax, 2
setne cl
dec ecx
and ecx, 0x5e
add ecx, 0x12
mov eax, ecx
jmp 0x40737b
push 0x72
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407380
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call edi
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ebx, ecx
je 0x4073b9
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x40743e
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x18], ecx
je 0x407410
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
call fcn.00407027
pop ecx
pop ecx
test eax, eax
jne 0x40740d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4073f8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
call edi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40740d
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x4073b1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, 5
jne 0x40741e
push 0x13
jmp 0x40743d
cmp eax, 0x20
je 0x40743b
cmp eax, 0x21
je 0x40743b
xor ecx, ecx
cmp eax, 2
setne cl
dec ecx
and ecx, 0x5e
add ecx, 0x12
mov eax, ecx
jmp 0x40743e
push 0x72
pop eax
pop edi
pop esi
pop ebx
leave
ret