joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a866
Capabilities:
Get number of processors

Disassembly:
add esp, 4
add eax, 0x16f35
call 0x40a866
add byte [esi + 0x32], al
aas
inc edx
xor cl, byte [ecx + 0x3b]
dec ebp
cmp byte [ebx - 0x177efb3c], al
fild dword [ebx]
add byte [eax - 0x75], bl
test dword [edx + edi*8 + 0x88bffff], esp
mov dword [ebp - 0x55c], ecx
mov edx, dword [ebp - 0x55c]
cmp edx, dword [ebp - 0xdd8]
je 0x40a89c
mov eax, dword [ebp - 0x55c]
cmp dword [eax + 0x30], 0
jne 0x40a667
mov dword [ebp - 0x320], 0
Function at 0x443f62
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push edi
mov edi, dword [ebp + 0xc]
push pe_nt_image_headers32
push 0
push eax
call fcn.0042f710
mov eax, dword [0x46c7bc]
add esp, 0xc
test eax, eax
jne 0x444048
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
or ecx, eax
cmp dword [ebp - 0x11c], 4
mov dword [0x46c7c0], ecx
jne 0x443fd8
xor eax, eax
inc eax
jmp 0x444043
cmp dword [ebp - 0x11c], 5
jne 0x444009
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x443fef
push 2
jmp 0x444042
cmp ecx, 1
jne 0x443ff8
push 3
jmp 0x444042
xor eax, eax
cmp ecx, 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
jmp 0x444043
cmp dword [ebp - 0x11c], 6
jne 0x444040
cmp dword [ebp - 0x118], 0
jne 0x444029
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x444043
cmp dword [ebp - 0x118], 1
jne 0x444040
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x444043
push 9
pop eax
mov dword [0x46c7bc], eax
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [0x46c7c0]
mov dword [edi], eax
pop edi
pop esi
call fcn.0042de30
leave
ret 8

Function at 0x44445c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
sete al
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x444543
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x4444a2
cmp eax, 0x50
je 0x44449a
cmp eax, 0xb7
jne 0x4444a2
xor esi, esi
inc esi
jmp 0x444543
cmp eax, 3
jne 0x444532
movzx eax, word [edi]
mov ebx, esi
mov ecx, edi
test ax, ax
je 0x44452b
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x4444c3
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4444bc
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x44452b
push esi
xor eax, eax
push edi
mov word [ebx], ax
call fcn.0040419a
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x444543
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x444543
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444517
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x444543
push esi
push 0x454
push str.c:_agent_work138_s_srclibsdutil_fileutil.cpp
call fcn.004038f5
jmp 0x444543
mov esi, 0x80070003
jmp 0x444543
test eax, eax
jg 0x44453a
mov esi, eax
jmp 0x444543
movzx esi, ax
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x44459d
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
xor esi, esi
call fcn.0044488b
test eax, eax
je 0x444626
test byte [ebp - 4], 7
push ebx
mov ebx, 0x80070000
je 0x4445f3
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4445f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4445e9
movzx esi, si
or esi, ebx
test esi, esi
jns 0x4445f3
push esi
push 0x5c4
jmp 0x44461b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x444625
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444613
movzx esi, si
or esi, ebx
test esi, esi
jns 0x444625
push esi
push 0x5ca
push str.c:_agent_work138_s_srclibsdutil_fileutil.cpp
call fcn.004038f5
pop ebx
mov eax, esi
pop esi
leave
ret 4

Function at 0x44462d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], ebx
setne bl
cmp dword [ebp + 0x14], esi
je 0x444644
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x444741
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp + 0x10], esi
jne 0x44467c
cmp edi, 0x50
je 0x444674
cmp edi, 0xb7
jne 0x44467c
xor esi, esi
inc esi
jmp 0x444740
cmp edi, 2
jne 0x444695
push esi
push dword [ebp + 8]
call fcn.0044488b
test eax, eax
je 0x444737
push 3
pop edi
cmp edi, 3
jne 0x44472f
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov edx, edi
movzx eax, word [edi]
test ax, ax
je 0x444728
push 0x5c
mov edi, eax
pop esi
cmp di, si
jne 0x4446b9
mov ecx, edx
add edx, 2
movzx eax, word [edx]
mov edi, eax
test ax, ax
jne 0x4446b2
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x10], ecx
push 0
pop esi
test ecx, ecx
je 0x444728
push esi
xor eax, eax
push edi
mov word [ecx], ax
call fcn.0040419a
mov esi, eax
mov eax, dword [ebp + 0x10]
push 0x5c
pop ecx
mov word [eax], cx
test esi, esi
js 0x444740
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x444740
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444714
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x444740
push esi
push 0x4d4
push str.c:_agent_work138_s_srclibsdutil_fileutil.cpp
call fcn.004038f5
jmp 0x444740
mov esi, 0x80070003
jmp 0x444740
test edi, edi
jg 0x444737
mov esi, edi
jmp 0x444740
movzx esi, di
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push esi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x401047
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
push esi
jne 0x40104e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xor edx, edx
pop esi
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
add esp, 0x10
ret

Function at 0x401070
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov eax, esi
call fcn.00401000
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010b8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x34]
push ebx
push 0x80
push 4
push ebx
push 3
push 0x40000000
push eax
call esi
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4010ac
push 0x400000
call fcn.0040434f
add esp, 4
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x400000
mov esi, eax
push esi
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401140
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x401140
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push esi
add ebx, eax
adc dword [esp + 0x38], 0
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401140
push 0
lea eax, [esp + 0x18]
push eax
push 0x400000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401105
push esi
call fcn.004043b9
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp dword [esp + 0x20], ecx
jl 0x40119e
mov esi, dword [esp + 0x1c]
jg 0x40115d
cmp esi, ebx
jbe 0x40119e
sub esi, ebx
push esi
call fcn.0040434f
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401195
cmp dword [esp + 0x14], 0
jbe 0x401195
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.004043b9
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebp
call esi
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [esp + 0x34]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 8
Function at 0x4013a0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.004089f0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.004047dc
mov word [eax], 0
lea eax, [esp + 0x10]
add esp, 8
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401400
mov ecx, dword [str.log]
mov edx, dword [0x415d00]
push esi
mov dword [eax], ecx
mov cx, word [0x415d04]
push edi
mov dword [eax + 4], edx
push 0
lea edx, [esp + 0x14]
push edx
mov word [eax + 8], cx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [esp + 0x10]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401440
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x28]
mov ecx, 9
mov esi, str.loaddrivelog.txt
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401540
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x208
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004089f0
add esp, 0xc
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4014d8
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4014e6
cmp dword [esp + 8], 0
je 0x4014e6
mov esi, 1
jmp 0x4014e8
xor esi, esi
call fcn.004021d0
push eax
push esi
push 0
lea eax, [esp + 0x1c]
push str.Is64Exe:_d__IsWOW64:__d__Is64bitOS:__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x24]
add esp, 0x14
mov dword [esp + 0xc], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401513
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.004043be
add esp, 0x214
ret
Function at 0x401870
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push 0x80000002
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4018b7
xor eax, eax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004043be
add esp, 0xc
ret
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 4]
push ecx
push 4
push 0
push str.EnableLinkedConnections
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.004043be
add esp, 0xc
ret

Function at 0x4018f0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push str.SYSTEMCurrentControlSet_services_ambakdrv
push 0x80000002
mov esi, 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40194c
mov ecx, dword [esp + 4]
push str.DeleteFlag
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x401953
cmp eax, 2
je 0x401953
mov eax, 0x415ee8
xor esi, esi
call fcn.004020f0
call fcn.00401e20
mov eax, esi
pop esi
add esp, 8
ret
mov eax, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x401a90
Capabilities:
Delete file
Get disk information

Disassembly:
sub esp, 0x210
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
push 0x103
lea eax, [esp + 0x111]
push 0
push eax
mov byte [esp + 0x118], 0
call fcn.004089f0
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.004089f0
add esp, 0x18
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea edx, [esp + 0x10c]
push edx
push 0x104
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 0x10c], 0
lea edi, [esp + 0x10c]
je 0x401c2b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
lea esp, [esp]
lea esi, [esp + 0x10]
mov eax, edi
sub esi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
test cl, cl
jne 0x401b28
lea eax, [esp + 0x10]
add eax, 0xffffffff
jmp 0x401b40
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401b40
mov ecx, dword [str.amresimg.bin]
mov edx, dword [0x4160ac]
mov dword [eax], ecx
mov ecx, dword [0x4160b0]
mov dword [eax + 4], edx
mov dl, byte [0x4160b4]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x10]
push eax
call ebp
mov eax, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
test cl, cl
jne 0x401b76
lea eax, [esp + 0x10]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401b90
mov ecx, dword [str.amrestor.bin]
mov edx, dword [0x4160bc]
mov dword [eax], ecx
mov ecx, dword [0x4160c0]
mov dword [eax + 4], edx
mov dl, byte [0x4160c4]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x10]
push eax
call ebp
mov eax, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
test cl, cl
jne 0x401bc6
lea eax, [esp + 0x10]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401be0
mov ecx, dword [str.amclone.bin]
mov edx, dword [0x4160cc]
mov dword [eax], ecx
mov ecx, dword [0x4160d0]
mov dword [eax + 4], edx
lea edx, [esp + 0x10]
push edx
mov dword [eax + 8], ecx
call ebp
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401c10
sub eax, edx
cmp byte [edi + eax + 1], cl
lea edi, [edi + eax + 1]
jne 0x401b20
pop esi
pop ebp
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [esp + 0x210]
pop edi
xor ecx, esp
call fcn.004043be
add esp, 0x210
ret
Function at 0x401c50
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
push 0x3ff
xor edi, edi
lea eax, [esp + 0x19]
push edi
push eax
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0x400
mov byte [esp + 0x20], 0
call fcn.004089f0
push 0x3ff
lea ecx, [esp + 0x425]
push edi
push ecx
mov byte [esp + 0x42c], 0
call fcn.004089f0
add esp, 0x18
lea edx, [esp + 8]
push edx
push 0x2001f
push edi
push str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
push 0x80000002
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401d33
push edi
lea eax, [esp + 0xc]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
jne 0x401df3
mov ecx, dword [str.ambakdrv]
mov edx, dword [0x4160d8]
mov al, byte [0x4160dc]
push 0xa
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
push ecx
push 7
push edi
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x18]
push str.UpperFilters
push edx
mov byte [esp + 0x34], al
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x401df1
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push str.UpperFilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401d6a
push str.Failed_to_get_upper_fileters_value.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
mov dword [esp + 0xc], edx
jmp 0x401d6e
mov edx, dword [esp + 0xc]
xor eax, eax
movzx ecx, word [eax + 0x415ee8]
mov word [esp + eax + 0x414], cx
add eax, 2
cmp cx, di
jne 0x401d70
shr edx, 1
push ebx
mov ebx, edx
test ebx, ebx
push ebp
lea ebp, [esp + 0x42e]
jle 0x401dce
lea esi, [esp + 0x1c]
lea esp, [esp]
push 0x415ee8
push esi
call fcn.004042a5
add esp, 8
test eax, eax
jne 0x401dba
add edi, 8
add esi, 0x10
jmp 0x401dc4
mov cx, word [esi]
mov word [ebp], cx
add ebp, 2
add edi, 1
add esi, 2
cmp edi, ebx
jl 0x401da0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x41c]
sub ebp, edx
push ebp
mov eax, edx
push eax
push 7
push 0
push str.UpperFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebp
pop ebx
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x401e02
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x814]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
xor ecx, esp
call fcn.004043be
add esp, 0x810
ret
Function at 0x401e20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push 0x3ff
lea eax, [esp + 0x415]
push 0
push eax
mov dword [esp + 0x18], 7
mov dword [esp + 0x14], 0x400
mov byte [esp + 0x41c], 0
call fcn.004089f0
push 0x3ff
lea ecx, [esp + 0x21]
push 0
push ecx
mov byte [esp + 0x28], 0
call fcn.004089f0
add esp, 0x18
lea edx, [esp + 4]
push edx
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x401f46
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x414]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push str.UpperFilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401f46
push ebp
push edi
xor edi, edi
test dword [esp + 0x10], 0xfffffffe
lea ebp, [esp + 0x18]
jbe 0x401f24
lea esi, [esp + 0x418]
jmp 0x401ef0
push 0x415ee8
push esi
call fcn.004042a5
add esp, 8
test eax, eax
jne 0x401f0a
add edi, 8
add esi, 0x10
jmp 0x401f14
mov cx, word [esi]
mov word [ebp], cx
add ebp, 2
mov edx, dword [esp + 0x10]
add edi, 1
shr edx, 1
add esi, 2
cmp edi, edx
jb 0x401ef0
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub ebp, eax
push ebp
mov ecx, eax
push ecx
push 7
push 0
push str.UpperFilters
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov esi, eax
pop ebp
mov eax, dword [esp + 4]
test eax, eax
je 0x401f55
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x810]
xor eax, eax
test esi, esi
sete al
pop esi
xor ecx, esp
call fcn.004043be
add esp, 0x810
ret
Function at 0x401f80
Capabilities:
Create service
Print debug messages
Start service

Disassembly:
sub esp, 0x204
mov eax, dword [0x4197b8]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Enter_loadDriver:
mov esi, ecx
mov ebx, edx
call edi
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0x100
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
jne 0x401fe2
push str.OpenSCManager___Faild___n
call edi
xor esi, esi
jmp 0x4020c0
push str.OpenSCManager___ok____n
call edi
mov edx, dword [esp + 0x218]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push edx
push 1
push 0xf01ff
push esi
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x40206a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40203e
cmp eax, 0x431
je 0x40203e
cmp eax, 0x420
je 0x40203e
cmp eax, 0x430
je 0x40203e
xor esi, esi
jmp 0x4020ae
push str.CrateService___Faild_Service_is_ERROR_IO_PENDING_or_ERROR_SERVICE_EXISTS___n
call edi
push 0xf01ff
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x402063
push str.Failed_to_open_service_n
call edi
xor esi, esi
jmp 0x4020ae
push str.OpenService___ok____n
jmp 0x40206f
push str.CrateService___ok____n
call edi
cmp dword [esp + 0x218], 2
jb 0x4020a9
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4020a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40209e
cmp eax, 0x420
je 0x4020a2
xor esi, esi
jmp 0x4020ae
push str.StartService___Faild_ERROR_SERVICE_ALREADY_RUNNING____n
call edi
mov esi, 1
test ebx, ebx
je 0x4020b9
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.Leave_loadDriver:
call edi
mov ecx, dword [esp + 0x210]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004043be
add esp, 0x204
ret