joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407637
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00407b6b
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40765b
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x407794
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x424a58], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x424a58
je 0x40769f
push 1
push 0
push esi
call fcn.004075c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40779a
cmp eax, edi
jg 0x40779a
mov esi, 0x4244d0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40779a
cmp eax, edi
jg 0x40779a
push esi
push ebp
push str._s_s_r_n
push 0x4240d0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x425ef0]
add esp, 0x10
push dword [eax + 0x114]
push esi
call fcn.00407869
push 4
push 0xc0000000
push esi
call fcn.004075c0
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x407794
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40778d
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40778d
cmp edi, dword [esp + 0x18]
jne 0x40778d
push 0x409324
push esi
call fcn.00407527
test eax, eax
jne 0x4077a1
lea eax, [esi + edi]
push 0x409324
push eax
call fcn.00407847
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x4240d0
push eax
call fcn.00407573
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x425f50]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40b370
push eax
call fcn.00407527
test eax, eax
je 0x407758
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4077c8
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4077bd
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x40775a
Function at 0x404ba0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5998f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1774
call fcn.0056c9b0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x7e4]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xb00]
mov dword [ebp - 0x14], esi
test eax, eax
mov dword [ebp - 4], 0
push 0x7cf
je 0x404c28
mov ecx, dword [esi + 0xafc]
lea eax, [ebp - 0x1784]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x404c3c
lea edx, [ebp - 0x7e4]
push 0x7d0
lea eax, [ebp - 0x1784]
push edx
push eax
call fcn.004040b0
add esp, 0xc
jmp 0x404c3c
mov edx, dword [esi + 0xafc]
lea ecx, [ebp - 0x7e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x7e4]
mov ecx, esi
push eax
call fcn.00404850
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406650
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599ce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1770
call fcn.0056c9b0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x7e0]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x4f8]
mov dword [ebp - 4], 0
test eax, eax
push 0x7cf
je 0x4066d5
mov ecx, dword [esi + 0x4f4]
lea eax, [ebp - 0x1780]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4066e9
lea edx, [ebp - 0x7e0]
push 0x7d0
lea eax, [ebp - 0x1780]
push edx
push eax
call fcn.004040b0
add esp, 0xc
jmp 0x4066e9
mov edx, dword [esi + 0x4f4]
lea ecx, [ebp - 0x7e0]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x7e0]
lea ecx, [esi + 0x4d0]
push eax
push 0x638fa8
push ecx
call fcn.0058148b
add esp, 0xc
mov ecx, esi
call fcn.00406d40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407460
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599e48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x19c
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [esi + 0x78]
push ebx
push ebx
push 0x1009
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x98]
cmp ebx, dword [eax + 0x1c]
jge 0x4075e6
mov ecx, dword [0x65ec1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 0x18]
lea ebx, [ebx + ebx*8]
shl ebx, 2
mov byte [ebp - 4], 1
mov ecx, dword [edx + ebx + 4]
mov edx, dword [eax + 4]
push ecx
push edx
lea eax, [ebp - 0x18]
push 0x639278
push eax
call fcn.0058148b
mov edx, dword [ebp - 0x18]
add esp, 0x10
lea ecx, [esi + 0x5c]
push 0
push 0
push 0
push 0
push edx
push edi
push 1
call fcn.005827f7
inc edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edi
mov ecx, 0x58
xor eax, eax
lea edi, [ebp - 0x1a8]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x98]
push 0x4411
lea edx, [ebp - 0x1a8]
push 0x160
mov ecx, dword [eax + 0x18]
push edx
push 0x80
mov eax, dword [ecx + ebx]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [esi + 0x78]
mov eax, dword [ebp - 0x1a4]
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0x1006
push edx
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x98]
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + ebx + 8]
test eax, eax
mov eax, 0x663d9c
jne 0x407583
mov eax, 0x663d98
mov eax, dword [eax]
lea ecx, [esi + 0x5c]
push eax
push 1
push edi
call fcn.005828f2
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0x18]
mov ebx, dword [eax + ebx]
push ebx
lea ebx, [esi + 0x5c]
push 2
push edi
mov ecx, ebx
call fcn.005828f2
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
push 0
push 0
push 4
push 0
push edi
mov ecx, ebx
call fcn.00582879
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005886c0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x14], eax
mov ebx, eax
jmp 0x4074a1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407910
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x599edb
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x407a28
mov eax, dword [esi + 8]
mov dword [esp + 8], edi
cmp eax, edi
mov dword [esp + 0xc], edi
jle 0x407a28
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
mov eax, dword [eax + ebx + 4]
push edx
push edi
push 0xf003f
push edi
push 0x663188
push edi
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4079ba
lea ecx, [esp + 0x20]
call fcn.00478b50
push 1
push str.Cannot_open__create__registry_subkey_during_CBrowsersIntegration::Save__._r_n
lea ecx, [esp + 0x28]
mov dword [esp + 0x138], edi
call fcn.00478c60
lea ecx, [esp + 0x20]
mov dword [esp + 0x130], 0xffffffff
call fcn.00478c50
jmp 0x407a00
mov ecx, dword [esi + 4]
xor eax, eax
mov edx, dword [ecx + ebx]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push 0x6395d0
push edx
call ebp
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push 4
push edx
mov ecx, dword [eax + ebx + 8]
mov eax, dword [esp + 0x18]
push 4
push 0
push 0x6395cc
push eax
mov dword [esp + 0x30], ecx
call ebp
xor edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x407957
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, edi
pop ebx
je 0x407a28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x409c60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp]
push esi
xor esi, esi
push eax
mov eax, dword [ecx + 0x14]
push 1
push esi
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409cb5
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.found
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409cb5
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
test eax, eax
je 0x409cc4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4
Function at 0x40af30
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a0eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
mov eax, dword [0x663654]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.idmmzcc.xpi
push eax
lea ecx, [ebp - 0x170]
xor ebx, ebx
push 0x639028
push ecx
mov dword [ebp - 4], ebx
call fcn.0056d05a
add esp, 0x10
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b07d
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
mov eax, dword [0x65ec1c]
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 3
mov word [ebp - 0x3c], 5
mov dword [ebp - 0x54], 0x12c
mov dword [ebp - 0x50], 0xc8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x170]
push ecx
push edx
lea eax, [ebp - 0x14]
push str.__s____s_
push eax
mov byte [ebp - 4], 1
call fcn.0058148b
add esp, 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x6c]
push ecx
push edx
push ebx
push ebx
push 0x30
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x40b092
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x65ec1c]
mov dword [ebp + 8], ecx
push ebx
lea edx, [ebp - 0x18]
push ebx
push edx
push 0x400
push eax
push ebx
push 0x1100
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + 8]
push eax
push str.Cannot_start_browser._r_n_s
push ecx
call fcn.0058148b
mov edx, dword [ebp - 0x18]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
push 0x50030
push str.Internet_Download_Manager
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.005886c0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.005886c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x28]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x28]
push eax
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.005886c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b110
Capabilities:
Shutdown system
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59a12c
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x12c
test eax, eax
je 0x40b1a2
push 0
lea ecx, [esp + 0x18]
call fcn.004c8b50
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0
call fcn.00584656
lea ecx, [esp + 0xe8]
mov dword [esp + 0x134], 3
call fcn.0059035b
lea ecx, [esp + 0xac]
mov byte [esp + 0x134], 2
call fcn.00582dd2
lea ecx, [esp + 0x70]
mov byte [esp + 0x134], 1
call fcn.00590393
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0xffffffff
call fcn.00584297
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b1f4
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40bf10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
add ecx, 4
push ebx
push ebp
push esi
push edi
push str.IEXPLORE
call fcn.00409c00
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
jne 0x40bfe3
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40bfb1
test ebx, ebx
je 0x40bfd8
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40bfa8
test cl, cl
je 0x40bfa4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40bfa8
add eax, 2
add esi, 2
test cl, cl
jne 0x40bf84
xor eax, eax
jmp 0x40bfad
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40bfd8
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WSOCK32.dll_bind
call ebp
test eax, eax
jne 0x40c09d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.DownloadUI
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c06b
test ebx, ebx
je 0x40c092
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40c062
test cl, cl
je 0x40c05e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40c062
add eax, 2
add esi, 2
test cl, cl
jne 0x40c03a
xor eax, eax
jmp 0x40c067
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c092
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40c1e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59a1db
push eax
mov dword fs:[0], esp
sub esp, 0x40c
call fcn.0042f370
neg eax
mov edx, dword [esp + 0x41c]
lea ecx, [esp + 4]
sbb eax, eax
push ecx
and eax, 0x100
add eax, 0xf003f
push eax
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c3cc
mov edx, dword [0x663658]
push ebx
lea eax, [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0x400
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40c2c1
lea ecx, [esp + 0x14]
push ecx
call fcn.0056f394
lea edx, [esp + 0x18]
push 0x639f6c
push edx
call fcn.0056c6b0
add esp, 0xc
test eax, eax
jne 0x40c2b3
lea eax, [esp + 0x14]
push str.RUNAS
push eax
call fcn.0056c6b0
add esp, 8
test eax, eax
jne 0x40c2b3
lea ecx, [esp + 0x14]
push str.VISTA
push ecx
call fcn.0056c6b0
add esp, 8
test eax, eax
je 0x40c2c1
mov edx, dword [0x663658]
mov eax, dword [esp + 0xc]
push edx
push eax
call ebx
mov ecx, dword [0x65ec1c]
mov dword [esp + 8], ecx
mov edx, dword [0x663654]
lea eax, [esp + 8]
push edx
push str._sUninstall.exe
push eax
mov dword [esp + 0x428], 0
call fcn.0058148b
mov eax, dword [esp + 0x14]
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push 0
push eax
push ecx
mov dword [esp + 0x28], 0x400
call esi
test eax, eax
jne 0x40c341
lea edx, [esp + 0x14]
push edx
call fcn.0056f394
lea eax, [esp + 0x18]
push 0x639f6c
push eax
call fcn.0056c6b0
add esp, 0xc
test eax, eax
je 0x40c341
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
push edx
call ebx
mov eax, dword [0x663654]
lea ecx, [esp + 8]
push eax
push str._sIDMGrHlp.exe
push ecx
call fcn.0058148b
mov ecx, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push 0
push 0
push ecx
push edx
mov dword [esp + 0x28], 0x400
call esi
test eax, eax
jne 0x40c3ab
lea eax, [esp + 0x14]
push eax
call fcn.0056f394
lea ecx, [esp + 0x18]
push 0x639f6c
push ecx
call fcn.0056c6b0
add esp, 0xc
test eax, eax
je 0x40c3ab
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edx
push eax
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x41c], 0xffffffff
call fcn.005886c0
pop esi
pop ebx
mov ecx, dword [esp + 0x40c]
mov dword fs:[0], ecx
add esp, 0x418
ret
Function at 0x40d4a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
call fcn.0042f370
neg eax
sbb eax, eax
lea ecx, [esp + 8]
and eax, 0x100
push ecx
add eax, 0xf003f
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40d506
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [esp + 0x24], 1
call esi
mov ecx, dword [esp + 8]
push ecx
call edi
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0x663188
push 0
push 0x638e68
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d557
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.AdvIntDriverEnabled2
push ecx
mov dword [esp + 0x24], 1
call esi
mov edx, dword [esp + 8]
push edx
call edi
pop edi
pop esi
add esp, 8
ret
Function at 0x40d560
Capabilities:
Check if file exists
Check os version
Create process on windows
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x59a33b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
lea eax, [esp + 0x88]
push edi
mov ebx, ecx
push eax
mov dword [esp + 0x90], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40d71e
cmp dword [esp + 0x9c], 2
jne 0x40d71e
cmp dword [esp + 0x90], 6
jb 0x40d6a4
mov ecx, dword [0x65ec1c]
mov dword [esp + 0xc], ecx
mov edx, dword [0x663654]
push str.Uninstall.exe
push edx
lea eax, [esp + 0x14]
xor esi, esi
push 0x639028
push eax
mov dword [esp + 0x138], esi
call fcn.0058148b
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], 0x3c
push eax
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x24], 0x638f44
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d68e
mov ecx, dword [esp + 0xc]
push esi
push ecx
mov ecx, ebx
call fcn.0040c0b0
test al, al
je 0x40d68e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea edx, [esp + 0x14]
mov dword [esp + 0x1c], eax
push edx
mov dword [esp + 0x2c], str._startdriv
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40d688
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x40d68e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0xc]
mov dword [esp + 0x128], 0xffffffff
call fcn.005886c0
jmp 0x40d71e
mov ecx, ebx
call fcn.0040d4a0
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x50]
xor esi, esi
rep stosd dword es:[edi], eax
mov dword [esp + 0x50], 0x3c
mov dword [esp + 0x54], 0x40
mov dword [esp + 0x5c], 0x638f44
mov dword [esp + 0x60], str.net.exe
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 6
mov dword [esp + 0x70], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x68], str.start_idmtdi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40d71e
mov ecx, dword [esp + 0x88]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret