joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c750
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4d8e73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004cb1fa
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004d0896
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004d1df5
test eax, eax
je 0x48c86c
mov ecx, dword [esp + 0x3c]
call fcn.004d08c3
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x48c830
push edi
mov ecx, esi
call fcn.004cdf26
mov ecx, esi
call fcn.0048ca10
cmp dword [esp + 0x38], 1
jne 0x48c865
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004ce061
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x48ea50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x48ea83
push esi
call fcn.0049ce10
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x48ea7c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x48eb09
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x48eaf2
mov eax, dword [esi + 8]
test eax, eax
je 0x48eaa7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x48eaee
cmp eax, 2
je 0x48eaf2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x48ea9a
cmp eax, 3
je 0x48eacd
cmp eax, 1
jne 0x48ea9a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x48ea9a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x48ea9a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0048eb30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x48eb18
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0048eb30
add esp, 4
pop esi
ret

Function at 0x48f3a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x48f3c1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x48f3c1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x48f3c1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4ab340
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4ab3e3
test eax, eax
jbe 0x4ab3e3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4ab3e3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4ab38e
xor esi, esi
jmp 0x4ab394
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4ab3bf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004af940
add esi, eax
push esi
mov ebx, esi
call fcn.004af940
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4ab3a0
pop ebp
test edi, edi
pop edi
jne 0x4ab3e3
test ebx, ebx
je 0x4ab3e3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004b94a0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4ab505
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4ab61d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ab61d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004cb64c
mov esi, eax
test esi, esi
je 0x4ab61d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4ab61d
mov ecx, esi
call fcn.004ab490
cmp edi, eax
jge 0x4ab61d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4ab5a3
mov dword [esp + 0x34], 1
jmp 0x4ab5fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4ab61d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004a9ce0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4afb30
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4afb96
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4afb96
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4afb77
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4b02a0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4b02d8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4b0f50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4b0f99
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4b1410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d9990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004b0fc0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004b1040
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004b1040
lea ecx, [esi + 0xc]
call fcn.004c9baa
lea ecx, [esi + 0x10]
call fcn.004c9baa
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004b25d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004b25d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004b25d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004c9c1f
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004c9c1f
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4cbff0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4cc028
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ca07a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ca052
jmp 0x4cc034
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cd6de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cd720
call fcn.004d3496
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4cd720
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4cd717
xor eax, eax
jmp 0x4cd728
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cd72e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d39c6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d39f4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d3a12
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d392c
jmp 0x4d3a12
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d3a12
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d392c
test edi, edi
mov eax, edi
jne 0x4d39fc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401880
Capabilities:
Unmount volume via ioctl

Disassembly:
sub esp, 0x214
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
push 0x5668b0
lea eax, [esp + 0x1c]
push eax
mov esi, ecx
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
cmp eax, 8
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
jle 0x4018d7
push 9
push ebx
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor edx, edx
mov word [esp + 0x30], dx
jmp 0x4018df
push ebx
lea eax, [esp + 0x1c]
push eax
call ebp
mov ecx, 0x3a
cmp cx, word [esp + 0x22]
jne 0x4018f2
xor edx, edx
mov word [esp + 0x24], dx
push ebx
call edi
cmp eax, 1
jne 0x401906
push 0x5668bc
lea eax, [esp + 0x1c]
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0x90018
push esi
call edi
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0x90020
push esi
call edi
push 0
mov ebp, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
push esi
call edi
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0x80002004
push esi
call edi
test eax, eax
jne 0x401998
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0x9001c
push esi
mov ebx, eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4019ee
test ebp, ebp
je 0x401994
push 0
lea eax, [esp + 0x24]
push eax
push 2
call dword [0x5a22c0]
test eax, eax
je 0x401994
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0x800024dc
push esi
call edi
movzx esi, word [ebx]
shl esi, 0x10
or esi, 0x8004
call fcn.00401320
lea eax, [esp + 0x18]
call fcn.0040cdb0
lea ecx, [esp + 0x18]
call fcn.00404e80
mov eax, 1
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f8124
add esp, 0x214
ret
Function at 0x401fd0
Capabilities:
Modify service
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x1810
call fcn.004fa800
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x180c], eax
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x402158
push ebx
push 0xf003f
push 0x5668c4
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x402150
push 0xfff
lea eax, [esp + 0x819]
push 0
push eax
mov byte [esp + 0x820], 0
call fcn.004f8090
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x81c]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x402149
push ebp
push edi
push str.SystemCurrentControlSetServices_
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x5668c4
lea ecx, [esp + 0x20]
push ecx
call esi
push str.Instances
lea edx, [esp + 0x20]
push edx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x566980
call ebp
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add eax, eax
push eax
push 0x566980
push 1
push str.DefaultInstance
lea eax, [esp + 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.Top
lea ecx, [esp + 0x20]
push ecx
call esi
push str.586333
call ebp
add eax, eax
push eax
push str.586333
push 1
push str.Altitude
lea edx, [esp + 0x2c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.Flags
lea ecx, [esp + 0x2c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
call edi
cmp dword [esp + 0x81c], 2
pop edi
pop ebp
je 0x402145
push 0
push 0
push 0
push str.FltMgr
push 0
push str.FSFilter_Activity_Monitor
push 0
push 1
push 1
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, dword [esp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [esp + 0x1810]
pop esi
xor ecx, esp
call fcn.004f8124
add esp, 0x1810
ret
Function at 0x402170
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x543100
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5954a0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
xor ebp, ebp
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebp
call fcn.00401050
mov dword [esp + 0x2c], ebp
mov edi, dword [eax]
cmp edi, ebp
je 0x4021ca
cmp dword [edi + 4], ebp
jne 0x4021c5
mov ecx, dword [edi]
push ecx
call fcn.00531a50
mov dword [edi + 4], eax
mov edi, dword [edi + 4]
jmp 0x4021cc
xor edi, edi
mov esi, dword [sym.imp.imagehlp.dll_ImageLoad]
push ebp
push edi
call esi
mov dword [esp + 0x2c], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x40222a
mov edi, eax
add eax, 8
push eax
call ebx
cmp eax, ebp
jne 0x402226
cmp edi, ebp
je 0x402226
mov eax, dword [edi]
cmp eax, ebp
je 0x40220d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x40221d
push eax
call fcn.004b3044
add esp, 4
push edi
call fcn.004b3044
add esp, 4
mov dword [esp + 0x14], ebp
mov edx, dword [esp + 0x38]
push edx
lea ecx, [esp + 0x1c]
call fcn.00401050
mov dword [esp + 0x2c], 1
mov edi, dword [eax]
cmp edi, ebp
je 0x40225b
cmp dword [edi + 4], ebp
jne 0x402256
mov eax, dword [edi]
push eax
call fcn.00531a50
mov dword [edi + 4], eax
mov edi, dword [edi + 4]
jmp 0x40225d
xor edi, edi
push ebp
push edi
call esi
mov esi, eax
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4022a5
mov edi, eax
add eax, 8
push eax
call ebx
test eax, eax
jne 0x4022a1
cmp edi, ebp
je 0x4022a1
mov eax, dword [edi]
cmp eax, ebp
je 0x402288
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x402298
push eax
call fcn.004b3044
add esp, 4
push edi
call fcn.004b3044
add esp, 4
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.imagehlp.dll_ImageUnload]
cmp eax, ebp
je 0x4022d2
cmp esi, ebp
je 0x4022cf
mov edx, dword [eax + 0xc]
mov ecx, dword [esi + 0xc]
mov dx, word [edx + 4]
cmp dx, word [ecx + 4]
jne 0x4022cf
mov dword [esp + 0x1c], 1
push eax
call edi
cmp esi, ebp
je 0x4022d9
push esi
call edi
cmp dword [esp + 0x1c], ebp
je 0x402312
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
call fcn.00403160
test eax, eax
je 0x402312
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x402330
Capabilities:
Get common file path

Disassembly:
sub esp, 0x80c
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
push edi
push 0
call fcn.00401380
add esp, 4
cmp eax, 0xffffffff
jne 0x40236e
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004f8124
add esp, 0x80c
ret
push eax
call dword [sym.imp.ntdll.dll_NtClose]
push 0x200
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Drivers_
lea ecx, [esp + 0xc]
push ecx
call esi
push str.Estdlock.SYS
lea edx, [esp + 0xc]
push edx
call esi
push 0x200
lea eax, [esp + 0x40c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x408]
push 0x5c
push ecx
call fcn.004f8f45
add esp, 8
test eax, eax
je 0x40241e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea esi, [eax + 2]
push 0x566a14
push esi
call edi
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x40c]
push eax
call fcn.00402170
add esp, 8
test eax, eax
jne 0x402419
push 0x566a30
push esi
call edi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x40c]
push edx
call fcn.00402170
add esp, 8
test eax, eax
je 0x40241e
call fcn.00401fd0
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004f8124
add esp, 0x80c
ret
Function at 0x403160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x410], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
je 0x40318d
push esi
call edi
test eax, 0x10000
je 0x4031b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x4031b3
mov eax, 1
pop edi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004f8124
add esp, 0x414
ret
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.0040b2d0
add esp, 4
test eax, eax
je 0x403198
lea ecx, [esp + 0x20c]
push ecx
mov ecx, ebx
call fcn.0040b2d0
add esp, 4
test eax, eax
je 0x403198
lea edx, [esp + 4]
push edx
lea ecx, [esp + 0x210]
call fcn.0040b4a0
mov ecx, dword [esp + 0x418]
dec eax
add esp, 4
neg eax
sbb eax, eax
pop edi
xor ecx, esp
inc eax
call fcn.004f8124
add esp, 0x414
ret
Function at 0x403220
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x542eeb
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5954a0]
xor eax, esp
push eax
lea eax, [esp + 0x844]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x854]
push str.SystemCurrentControlSetServices_
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
lea ecx, [esp + 0x40]
push ecx
call esi
push str.Instances
lea edx, [esp + 0x40]
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x566980
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add eax, eax
push eax
push 0x566980
push 1
push str.DefaultInstance
lea eax, [esp + 0x4c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.Top
lea ecx, [esp + 0x40]
push ecx
call esi
push str.586333
call ebx
add eax, eax
push eax
push str.586333
mov esi, 1
push esi
push str.Altitude
lea edx, [esp + 0x4c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 4
lea eax, [esp + 0x24]
push eax
push 4
push str.Flags
lea ecx, [esp + 0x4c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], esi
call edi
lea edx, [esp + 0x1c]
push edx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40336c
lea eax, [esp + 0x24]
push eax
push str.SeLoadDriverPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40336c
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push 0
push 0
push 0x10
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x2c]
push 0
push ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x50], 2
mov dword [esp + 0x4c], edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push str.FltLib
mov esi, 0x45a
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4033d9
push str.FilterLoad
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4033d2
push ebp
lea ecx, [esp + 0x1c]
call fcn.00401050
mov dword [esp + 0x84c], 0
mov eax, dword [eax]
test eax, eax
je 0x4033b3
mov eax, dword [eax]
jmp 0x4033b5
xor eax, eax
push eax
call edi
test eax, eax
jg 0x4033c0
mov esi, eax
jmp 0x4033c9
movzx esi, ax
or esi, 0x80070000
lea ecx, [esp + 0x18]
call fcn.00401100
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4033f8
cmp esi, 0xb7
je 0x4033f8
cmp esi, 0x420
je 0x4033f8
xor eax, eax
jmp 0x403402
call fcn.00404230
mov eax, 1
mov ecx, dword [esp + 0x844]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.004f8124
add esp, 0x83c
ret