joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46db30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46dba1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x46db6f
cmp eax, 2
jne 0x46db8b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x46db9b
test ecx, ecx
je 0x46db96
test cl, 1
jne 0x46db8b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x46db9b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4720d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x472102
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x472102
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x472720
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480928
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x472767
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x472786
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x44]
call fcn.00472910
lea ecx, [ebp - 0x1c]
call fcn.00471980
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.00472af0
test al, al
jne 0x4727b2
xor bl, bl
jmp 0x4727bb
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.0042cb6a
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472800
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00473140
add esp, 4
cmp eax, 0xffffffff
je 0x472830
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x472830
and eax, 0xfffffffe
push eax
push esi
call fcn.00472850
add esp, 8
test al, al
je 0x472840
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x472840
mov al, 1
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x472850
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x473140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
pop ebp
ret
Function at 0x474b50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x90], ebx
test edi, edi
je 0x474d1b
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
test eax, eax
jne 0x474ba4
push str.__s__is_not_exist
call fcn.0044e890
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x94], eax
test eax, eax
je 0x474d1b
lea eax, [ebp - 0x84]
mov dword [ebp - 0x88], eax
push esi
add ebx, 0x410
jne 0x474bda
xor eax, eax
mov dword [ebp - 0x88], eax
jmp 0x474cb9
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474be0
sub ecx, edx
sar ecx, 1
push 0x80
lea eax, [ecx + 1]
lea esi, [eax*4]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
push esi
push eax
call fcn.00403870
add esp, 0x10
push 0
push 0
push esi
push dword [ebp - 0x88]
mov esi, dword [ebp - 0x8c]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x474caf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x474caf
mov ebx, dword [ebp - 0x90]
push 0
push 0
push 0
push 0
push esi
add ebx, 0x410
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea eax, [ebp - 0x84]
push 0x80
push eax
lea eax, [ebp - 0x88]
push esi
push eax
call fcn.00403870
add esp, 0x10
push 0
push 0
push esi
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
test ebx, ebx
jne 0x474d2d
mov eax, dword [ebp - 0x88]
push eax
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 0x88]
cmp eax, ecx
je 0x474ce1
push eax
call fcn.0043442e
add esp, 4
test esi, esi
je 0x474d0d
push edi
push str.call_dll_func__dll_path_s
call fcn.0044e890
add esp, 8
push 0x482aa0
call esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 8
push str.dll_func_is_null
call fcn.0044e890
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 8
push 0x80
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x88]
call fcn.004038f0
add esp, 0xc
call fcn.004068d0
int3
Function at 0x474d50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa34], eax
push esi
mov esi, ecx
test eax, eax
jne 0x474d84
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 0x74], 0
mov eax, dword [esi]
push ebx
push edi
push esi
je 0x474d94
call dword [eax + 0x38]
jmp 0x474d97
call dword [eax + 0x40]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x474ee8
push 0x824
lea eax, [ebp - 0xa30]
push 0
push eax
call fcn.00432c40
mov eax, dword [esi]
lea ecx, [ebp - 0xa30]
add esp, 0xc
cmp byte [esi + 0x74], 0
push ecx
push edi
push esi
je 0x474dcf
call dword [eax + 0x34]
jmp 0x474dd2
call dword [eax + 0x3c]
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00432c40
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa34]
push 0x104
push eax
call fcn.00440308
add esp, 0x1c
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4b0060
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x474eb4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
jne 0x474e5a
push str.__s__is_not_exist
call fcn.0044e890
add esp, 8
jmp 0x474edf
call fcn.0045c0f0
mov eax, dword [ebp - 0x210]
cmp eax, 0x1388
ja 0x474e70
test eax, eax
jne 0x474e7b
mov eax, 0x1388
mov dword [ebp - 0x210], eax
push eax
push 0
push 1
push 0
push 1
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045c2f0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.exec_cmdline_:_exepath__s___para__s_
call fcn.0044e890
add esp, 0xc
jmp 0x474edf
push 0x4b0068
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x474edf
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00474b50
inc edi
cmp edi, ebx
jl 0x474da3
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 8
Function at 0x477ca0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1318
call fcn.0042cec0
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x800
mov dword [ebp - 0x1318], eax
lea eax, [ebp - 0x1304]
push 0
push eax
call fcn.00432c40
push 0x800
lea eax, [ebp - 0xb04]
push 0
push eax
call fcn.00432c40
add esp, 0x18
lea eax, [ebp - 0x1304]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xfe
lea eax, [ebp - 0x102]
push 0
push eax
call fcn.00432c40
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x1314]
push eax
movups xmmword [ebp - 0x1314], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.00432c40
movzx eax, byte [ebp - 0x1305]
push eax
movzx eax, byte [ebp - 0x1306]
push eax
movzx eax, byte [ebp - 0x1307]
push eax
movzx eax, byte [ebp - 0x1308]
push eax
movzx eax, byte [ebp - 0x1309]
push eax
movzx eax, byte [ebp - 0x130a]
push eax
movzx eax, byte [ebp - 0x130b]
push eax
movzx eax, byte [ebp - 0x130c]
push eax
movzx eax, word [ebp - 0x130e]
push eax
movzx eax, word [ebp - 0x1310]
push eax
push dword [ebp - 0x1314]
lea eax, [ebp - 0x304]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00452580
lea eax, [ebp - 0x304]
add esp, 0x40
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x477dd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00440308
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1304]
push eax
lea eax, [ebp - 0xb04]
push eax
call edi
push 0x4ac088
lea eax, [ebp - 0xb04]
push 0x400
push eax
call fcn.0044726c
add esp, 0xc
lea eax, [ebp - 0xb04]
push eax
call ebx
test eax, eax
je 0x477e55
inc esi
cmp esi, 0xa
jl 0x477d22
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xb04]
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x477e60
mov ecx, dword [ebp - 0x1318]
lea eax, [ebp - 0xb04]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00416a50
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
Function at 0x477ee0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0042cec0
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x477f3b
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi + 4]
test esi, esi
je 0x47800c
mov ecx, dword [edi + 8]
test ecx, ecx
jle 0x47800c
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [ebp - 0x1010], eax
and ecx, 0x80000fff
jns 0x477f75
dec ecx
or ecx, 0xfffff000
inc ecx
xor edi, edi
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1008], 0
test eax, eax
jle 0x477fda
nop dword [eax + eax]
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00432140
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47800c
inc edi
add esi, 0x1000
cmp edi, dword [ebp - 0x1010]
jl 0x477f90
mov ecx, dword [ebp - 0x100c]
test ecx, ecx
jle 0x47800c
push ecx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00432140
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 4

Function at 0x478050
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47eb08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x10]
call fcn.00403ff0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00477ca0
mov esi, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x4780d1
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
push esi
mov ecx, ebx
call fcn.00477ee0
test eax, eax
je 0x4780d1
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x478108
push 0x64
push 0
push 0
push 0
push 0
push dword [eax]
push esi
call fcn.00470a80
add esp, 0x1c
test eax, eax
jns 0x478125
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4780f2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [eax]
test esi, esi
je 0x4780d1
test eax, eax
je 0x4780d1
push eax
push 0x477ba0
push 0
push esi
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
test eax, eax
je 0x4780d1
push esi
call edi
mov edi, 1
jmp 0x4780d3
Function at 0x478130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4810c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00403ff0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00477ca0
mov edi, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x4782e8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov ecx, esi
call fcn.00477ee0
test eax, eax
je 0x4782e8
lea ecx, [ebp - 0x14]
call fcn.00403ff0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.00477ca0
mov esi, dword [ebp - 0x14]
add esp, 4
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [ebp + 0xc], 0
je 0x478200
push 0x64
push 0
push 0
push 0
push 0
push esi
push edi
call fcn.00470a80
add esp, 0x1c
test eax, eax
jns 0x47821b
xor ebx, ebx
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4782ea
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4782ea
test edi, edi
je 0x4781d9
test esi, esi
je 0x4781d9
push esi
push 0x477ba0
push 0
push edi
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
test eax, eax
je 0x4781d9
mov ecx, dword [ebp + 8]
lea ebx, [esi - 0x10]
mov eax, dword [ecx]
sub eax, 0x10
mov dword [ebp - 0x1c], eax
cmp ebx, eax
je 0x4782d7
cmp dword [eax + 0xc], 0
lea edx, [eax + 0xc]
mov dword [ebp - 0x18], edx
jl 0x4782ce
mov edx, dword [ebx]
cmp edx, dword [eax]
jne 0x4782ce
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
mov ecx, eax
lea eax, [ebx + 0xc]
jl 0x478266
cmp ecx, dword [ebx]
jne 0x478266
lock inc dword [eax]
jmp 0x47829b
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov edx, eax
mov dword [ebp + 0xc], edx
test edx, edx
je 0x47831f
mov eax, dword [ebx + 4]
mov dword [edx + 4], eax
lea eax, [ebx + 0x10]
mov ecx, dword [ebx + 4]
inc ecx
push ecx
push eax
push ecx
lea eax, [edx + 0x10]
push eax
call fcn.0041ab30
mov ebx, dword [ebp + 0xc]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4782b5
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 1
jmp 0x4781db
push dword [esi - 0xc]
push esi
call fcn.00416a50
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 1
jmp 0x4781db
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x478309
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00416f00
int3
Function at 0x478b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481188
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
xor ebx, ebx
mov dword [ebp - 0x10], 0x80000
nop dword [eax + eax]
mov eax, dword [0x4c24a8]
test al, 1
jne 0x478bff
or eax, 1
mov dword [0x4c24a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x481600
mov dword [0x4c249c], 0x482874
mov dword [0x4c24a0], eax
mov byte [0x4c24a4], 0
call fcn.0042c749
mov eax, dword [0x4c24a8]
add esp, 4
test al, 2
jne 0x478c5b
or eax, 2
mov dword [0x4c24ac], 0x483b00
mov dword [0x4c24a8], eax
xor eax, eax
push 0x481630
mov dword [0x4c24b0], 0x4c249c
mov dword [0x4c24c0], 2
mov dword [0x4c24b8], 0
mov dword [0x4c24bc], 0
mov dword [0x4c24c4], eax
mov dword [0x4c24b4], 0x4c24ac
call fcn.0042c749
add esp, 4
mov eax, dword [0x4c24ac]
mov ecx, 0x4c24ac
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 0
test edi, edi
js 0x478dc1
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x478c9d
push edi
lea ecx, [ebp - 0x14]
call fcn.00410500
mov esi, dword [ebp - 0x14]
cmp edi, dword [esi - 8]
jg 0x478dc1
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push str.PendingFileRenameOperations
push 0x4b0078
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [esi - 8]
mov edi, eax
push esi
call fcn.0044043a
add esp, 8
test eax, eax
js 0x478dc1
cmp eax, dword [esi - 8]
jg 0x478dc1
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x478d76
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xea
jne 0x478d4b
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x478d28
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
cmp ebx, 0xa
jl 0x478bc0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x478d60
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + 4]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push esi
call fcn.00478940
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x478da8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004068b0
int3
Function at 0x478dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4803e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00403ff0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + 4]
mov ecx, esi
push eax
call fcn.00478760
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x478e43
push dword [ebp - 0x14]
push esi
push 7
push str.PendingFileRenameOperations
push 0x4b0078
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x478e62
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4792e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x4792f7
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x479322
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x47931c
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x47943b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x479359
cmp byte [edi + 0x18], al
je 0x47934d
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.004067f0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x479392
call fcn.004067f0
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.00479450
test eax, eax
jns 0x479438
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.00478fa0
mov dword [ebp - 4], eax
test eax, eax
jns 0x4793c2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.00479450
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x479369
push 0
push 0
push ebx
mov ecx, esi
call fcn.00478fa0
mov edi, eax
test edi, edi
jns 0x479400
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.00479450
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x479750
push 0
push 0
call fcn.00440a9e
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x479369
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x479438
call fcn.004067f0
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret