joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414295
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
push 0x200
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522c50
lea ecx, [ebp - 0x54c]
push ecx
call fcn.0041e940
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x54c]
push eax
call fcn.0041e940
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x414370
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.0041e930
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041e940
add esp, 8
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x414370
push 0
lea ecx, [ebp - 0x54c]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x41435f
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
or eax, 0xffffffff
jmp 0x41441a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41441a
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x54c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x4143af
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41441a
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4143ea
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41441a
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x414418
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41441a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41441e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x42dfbc], 0
je 0x4144a3
push 0x200
push 0x5ac440
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str...inf
push 0x5ac440
call fcn.0041e940
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x5ac440
call fcn.0041e940
add esp, 8
push 0x5ac440
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4144a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x4144a3
cmp dword [ebp - 4], 5
jne 0x414491
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200401d
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4144a5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x415218
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x2ac], 0
test byte [ebp + 8], 2
je 0x4152d6
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5ab920
lea eax, [ebp - 0x2a8]
push eax
call fcn.0041e930
add esp, 8
push 0x53efb0
lea eax, [ebp - 0x2a8]
push eax
call fcn.0041e940
add esp, 8
push 0x4000
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x4152a6
mov dword [ebp - 0x2ac], 1
test byte [ebp + 8], 1
jne 0x4152d6
cmp dword [ebp - 0x2ac], 1
jne 0x4152cc
mov dword [ebp - 0x98], 2
jmp 0x4152d6
mov dword [ebp - 0x98], 0
test byte [ebp + 8], 1
je 0x415517
push 0x5abb24
push 0xf003f
push 0
push 0x53efc0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x41535d
cmp dword [0x5ab700], 2
je 0x415344
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415522
cmp dword [ebp - 0x2ac], 1
jne 0x415358
or dword [ebp - 0x98], 2
jmp 0x415517
or dword [ebp - 0x98], 1
test byte [ebp + 8], 2
je 0x4154d5
mov dword [ebp - 0xa8], 0xc
push str.version
push 0x5ab6c0
call fcn.0041e930
add esp, 8
mov dword [ebp - 0x94], 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x5ab6c0
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4153e2
push 0x53eff8
lea eax, [ebp - 0xa4]
push eax
call fcn.0041e930
add esp, 8
lea eax, [ebp - 0xa4]
push eax
push 0x5b2fd0
call fcn.0041e930
add esp, 8
push 0x53f000
lea eax, [ebp - 0xa4]
push eax
call fcn.0041efd0
add esp, 8
test eax, eax
jge 0x41542b
cmp dword [ebp - 0x2ac], 1
jne 0x415426
or dword [ebp - 0x98], 2
jmp 0x4154d5
push 0x53f008
lea eax, [ebp - 0xa4]
push eax
call fcn.0041efd0
add esp, 8
test eax, eax
jg 0x415453
or dword [ebp - 0x98], 2
jmp 0x4154d5
or dword [ebp - 0x98], 1
push 0x53f010
push 0x5ab6c0
call fcn.0041e930
add esp, 8
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x90], 4
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x5ab6c0
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4154c1
or dword [ebp - 0x98], 2
test byte [ebp - 0x8c], 2
je 0x4154d5
or dword [ebp - 0x98], 2
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415517
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415522
mov eax, dword [ebp - 0x98]
jmp 0x415522
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415c66
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x53f068
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415cc5
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10007
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415d68
mov dword [ebp - 0x54], 0xffff
push 0x53f07c
lea eax, [ebp - 0x4c]
push eax
call fcn.0041e930
add esp, 8
push 4
lea eax, [ebp - 0x54]
push eax
push 4
push 0
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x415d26
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415d68
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415d61
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415d68
xor eax, eax
jmp 0x415d68
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415dfd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov byte [ebp - 4], 0
push 0x5abb24
push 0xf003f
push 0
push 0x53f088
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415e4f
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415edb
push 1
lea eax, [ebp - 4]
push eax
push 3
push 0
push 0x53f0b4
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415e9f
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x415edb
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415ed4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x415edb
xor eax, eax
jmp 0x415edb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416296
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x5abb24
push 0
push 0xf003f
push 0
push 0
push 0
push 0x53f178
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4162ee
push 0x10007
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416472
mov eax, dword [0x5abb24]
push eax
call fcn.00407ddf
add esp, 4
cmp eax, 0xffffffff
jne 0x41630f
mov eax, 0xffffffff
jmp 0x416472
push str.ProcessorType
push 0x5ab6c0
call fcn.0041e930
add esp, 8
push 4
push 0x53f1c0
push 1
push 0
push 0x5ab6c0
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x416366
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416472
mov dword [ebp - 0xc], 0xffff
push 0x53f1c4
push 0x5ab6c0
call fcn.0041e930
add esp, 8
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x5ab6c0
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4163c3
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416472
mov eax, dword [0x5abb24]
push eax
call fcn.0040787b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4163e8
mov eax, 0xffffffff
jmp 0x416472
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x41641d
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416472
call fcn.0041af1b
cmp dword [0x42dfc0], 0
je 0x416443
push 0x53f1d0
push 0x30
call fcn.0040616c
mov dword [ebp - 8], eax
jmp 0x416452
push 0x53f1e0
push 0x30
call fcn.0040616c
mov dword [ebp - 8], eax
call fcn.0041af30
cmp dword [ebp - 8], 0xffffffff
jne 0x41646b
mov eax, 0xffffffff
jmp 0x416472
xor eax, eax
jmp 0x416472
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417627
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x5abb24
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 2
jne 0x417661
xor eax, eax
jmp 0x41772c
cmp dword [0x5ab700], 0
je 0x417685
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x41772c
cmp dword [ebp + 0xc], 0
je 0x4176a9
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [0x5ab700], eax
jmp 0x4176bd
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4176fa
cmp dword [0x5ab700], 2
je 0x4176fa
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x41772c
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x417725
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x41772c
xor eax, eax
jmp 0x41772c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417731
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test byte [ebp + 8], 4
je 0x4177f4
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5ab4c0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53f3f4
push 0x5ab920
call fcn.0041e940
add esp, 8
push 0x53f400
push 0x5ab4c0
call fcn.0041e940
add esp, 8
push str.pcrdhasp.inf
push 0x5ab4c0
call fcn.0041e940
add esp, 8
push 0x5ab920
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4177f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4177f4
cmp dword [ebp - 8], 5
jne 0x4177e0
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004007
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 8
je 0x4178c6
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53f418
push 0x5ab920
call fcn.0041e940
add esp, 8
push 0x5ab920
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417873
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x417873
cmp dword [ebp - 8], 5
jne 0x41785f
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200400f
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x5ab4c0
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4178c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4178c6
cmp dword [ebp - 8], 5
jne 0x4178b2
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200401d
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x4178ce
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4178d3
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test byte [ebp + 8], 1
je 0x4179e9
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5ab4c0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53f428
push 0x5ab4c0
call fcn.0041e940
add esp, 8
push 0x53f430
push 0x5ab920
call fcn.0041e940
add esp, 8
push 0x5ab920
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417984
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x417984
cmp dword [ebp - 8], 5
jne 0x417970
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004017
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
push str.hlpcmcia.inf
push 0x5ab4c0
call fcn.0041e940
add esp, 8
push 0x5ab4c0
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4179e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4179e9
cmp dword [ebp - 8], 5
jne 0x4179d5
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200401d
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 2
je 0x417a68
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53f450
push 0x5ab920
call fcn.0041e940
add esp, 8
push 0x5ab920
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417a68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x417a68
cmp dword [ebp - 8], 5
jne 0x417a54
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004019
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x417a70
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417a75
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
push ebx
push esi
push edi
mov dword [ebp - 0x404], 0
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5ab920
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push 0x5ab920
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x53f45c
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
push str._aksusb.inf
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
push 0x200
push 0x5ab720
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5ab720
lea eax, [ebp - 0x608]
push eax
call fcn.0041e930
add esp, 8
push 0x53f474
lea eax, [ebp - 0x608]
push eax
call fcn.0041e940
add esp, 8
push 0x53f488
lea eax, [ebp - 0x608]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417b98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x417b98
cmp dword [ebp - 0x408], 5
jne 0x417b81
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004010
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
lea eax, [ebp - 0x200]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417bf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x417bf9
cmp dword [ebp - 0x408], 5
jne 0x417be2
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004011
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
cmp dword [ebp + 8], 0
je 0x417c0e
mov eax, dword [ebp - 0x404]
jmp 0x417c84
test byte [ebp + 0xc], 0x10
je 0x417c79
lea eax, [ebp - 0x608]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417c79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x417c79
cmp dword [ebp - 0x408], 5
jne 0x417c62
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004010
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
mov eax, dword [ebp - 0x404]
jmp 0x417c84
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417c89
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
push ebx
push esi
push edi
mov dword [ebp - 0x404], 0
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5ab720
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5ab920
lea eax, [ebp - 0x608]
push eax
call fcn.0041e930
add esp, 8
push 0x53f494
lea eax, [ebp - 0x608]
push eax
call fcn.0041e940
add esp, 8
push 0x5ab920
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x53f4a4
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
push 0x5ab720
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push str.inf
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
push str._aksusb95.inf
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417dac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x417dac
cmp dword [ebp - 0x408], 5
jne 0x417d95
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004011
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
cmp dword [ebp + 8], 0
je 0x417dc1
mov eax, dword [ebp - 0x404]
jmp 0x417e98
test byte [ebp + 0xc], 0x10
je 0x417e8d
lea eax, [ebp - 0x608]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417e2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x417e2c
cmp dword [ebp - 0x408], 5
jne 0x417e15
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004010
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
lea eax, [ebp - 0x400]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x417e8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x417e8d
cmp dword [ebp - 0x408], 5
jne 0x417e76
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004010
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
mov eax, dword [ebp - 0x404]
jmp 0x417e98
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417e9d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push 0x53f4cc
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.004181d4
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0xffffffff
jne 0x417f11
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push 0x53f4dc
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.004181d4
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x417f67
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push 0x53f4e8
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.0041ad43
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xffffffff
jne 0x417fbd
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push 0x53f4f8
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.0041ad80
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0xffffffff
jne 0x418013
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
cmp dword [ebp + 0xc], 0
je 0x41805c
push 0x200
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system32drivers
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
push 0x53f518
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
jmp 0x418086
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041e930
add esp, 8
push 0x53f524
lea eax, [ebp - 0x400]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.0041ad80
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x4180b2
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
xor eax, eax
jmp 0x4180b9
pop edi
pop esi
pop ebx
leave
ret