joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41484a
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov dword [ebp - 0x208], 0x200
push 0x5bc8b4
mov eax, dword [ebp + 8]
push eax
call fcn.004202d0
add esp, 8
push 0x5341c4
push 0x5c2e80
call fcn.004202d0
add esp, 8
cmp dword [ebp + 0xc], 2
jne 0x41489a
push 0x5341e8
push 0x5c2e80
call fcn.004202e0
add esp, 8
jmp 0x4148ac
push 0x5341f0
push 0x5c2e80
call fcn.004202e0
add esp, 8
push 0x5c2c40
push 0xf003f
push 0
push 0x5c2e80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x4148fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
je 0x4148f3
or eax, 0xffffffff
jmp 0x414a88
xor eax, eax
jmp 0x414a88
push 0x5341fc
push 0x5c30e0
call fcn.004202d0
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x200]
push edx
push 0
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x414952
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x414a88
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x414975
or eax, 0xffffffff
jmp 0x414a88
push 0x534208
lea eax, [ebp - 0x200]
push eax
call fcn.004208f0
add esp, 8
test eax, eax
je 0x4149fb
push str.SystemRoot_
call fcn.00420150
add esp, 4
lea ecx, [ebp + eax - 0x200]
push ecx
lea edx, [ebp - 0x200]
push edx
call fcn.004202d0
add esp, 8
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x534228
push 0x5c2a40
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
lea ecx, [ebp - 0x200]
push ecx
call fcn.004202d0
add esp, 8
push 0x53422c
lea edx, [ebp - 0x200]
push edx
call fcn.004208f0
add esp, 8
test eax, eax
je 0x414a37
push 0x534234
call fcn.00420150
add esp, 4
lea eax, [ebp + eax - 0x200]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.004202d0
add esp, 8
push 0x53423c
lea edx, [ebp - 0x200]
push edx
call fcn.004208f0
add esp, 8
test eax, eax
je 0x414a73
push 0x53424c
call fcn.00420150
add esp, 4
lea eax, [ebp + eax - 0x200]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.004202d0
add esp, 8
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004202d0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x414a8c
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.SYSTEMCurrentControlSetServices_
push 0x5c2e80
call fcn.004202d0
add esp, 8
cmp dword [ebp + 8], 2
jne 0x414abc
push 0x534280
push 0x5c2e80
call fcn.004202e0
add esp, 8
jmp 0x414ace
push 0x534288
push 0x5c2e80
call fcn.004202e0
add esp, 8
push 0x5c2c40
push 0x5c2e80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414b01
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414b94
push 0x534294
push 0x5c2e80
call fcn.004202d0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00420150
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 2
push 0
push 0x5c2e80
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414b6a
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414b94
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414b92
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414b94
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x414db3
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e0
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x4dc]
push ecx
call fcn.00404ad0
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x414de9
mov eax, dword [ebp - 0x414]
jmp 0x415039
cmp dword [ebp - 0x4d8], 2
jne 0x414e0e
push str._akspccard.cat
mov edx, dword [ebp + 8]
push edx
call fcn.00420970
add esp, 8
test eax, eax
jne 0x414e0e
xor eax, eax
jmp 0x415039
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x4d8], 3
jne 0x414e91
push 0x534314
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
jne 0x414e91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x414e91
push 0x4000d
call fcn.00406ccc
add esp, 4
push 0x2020001
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x414], 0xffffffff
mov eax, dword [ebp - 0x414]
jmp 0x415039
push 0x200
lea eax, [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x4d8], 3
jne 0x414ec2
push 0x534324
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.004202e0
add esp, 8
jmp 0x414ed6
push 0x534334
lea edx, [ebp - 0x6dc]
push edx
call fcn.004202e0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.004202e0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x414f8e
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x2d0]
push eax
call fcn.004202d0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2d0]
push edx
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x2d0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffff
je 0x414f8e
push 0
lea edx, [ebp - 0x6dc]
push edx
lea eax, [ebp - 0x2d0]
push eax
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x414f7a
push 0x4000c
call fcn.00406ccc
add esp, 4
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
or eax, 0xffffffff
jmp 0x415039
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x415039
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x414fcd
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x415039
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x415009
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x415039
mov edx, dword [0x5c2a24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x415037
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x415039
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41503d
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e0
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x4dc]
push ecx
call fcn.00404ad0
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x415073
mov eax, dword [ebp - 0x414]
jmp 0x41529d
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x4d8], 3
jne 0x4150f6
push 0x53433c
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
jne 0x4150f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4150f6
push 0x4000d
call fcn.00406ccc
add esp, 4
push 0x2020001
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x414], 0xffffffff
mov eax, dword [ebp - 0x414]
jmp 0x41529d
push 0x200
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x4d8], 3
jne 0x415127
push 0x53434c
lea eax, [ebp - 0x6dc]
push eax
call fcn.004202e0
add esp, 8
jmp 0x41513b
push str.drivers
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.004202e0
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x6dc]
push eax
call fcn.004202e0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x4151f3
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2d0]
push edx
call fcn.004202d0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2d0]
push ecx
call fcn.004202e0
add esp, 8
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffff
je 0x4151f3
push 0
lea ecx, [ebp - 0x6dc]
push ecx
lea edx, [ebp - 0x2d0]
push edx
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x4151df
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
or eax, 0xffffffff
jmp 0x41529d
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41529d
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x415232
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41529d
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x41526d
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41529d
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x41529b
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41529d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4152a1
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x430044], 0
je 0x415344
push 0x200
push 0x5c3120
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp + 0xc], 0
je 0x4152dc
push 0x534368
push 0x5c3120
call fcn.004202e0
add esp, 8
jmp 0x4152ee
push str...inf
push 0x5c3120
call fcn.004202e0
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x5c3120
call fcn.004202e0
add esp, 8
push 0x5c3120
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x415344
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x415344
cmp dword [ebp - 4], 5
jne 0x415332
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200401d
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x415346
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x416af8
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x2ac], 0
test byte [ebp + 8], 2
je 0x416bb6
push 0x200
push 0x5c2600
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5c2600
lea eax, [ebp - 0x2a8]
push eax
call fcn.004202d0
add esp, 8
push 0x550868
lea eax, [ebp - 0x2a8]
push eax
call fcn.004202e0
add esp, 8
push 0x4000
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x416b86
mov dword [ebp - 0x2ac], 1
test byte [ebp + 8], 1
jne 0x416bb6
cmp dword [ebp - 0x2ac], 1
jne 0x416bac
mov dword [ebp - 0x98], 2
jmp 0x416bb6
mov dword [ebp - 0x98], 0
test byte [ebp + 8], 1
je 0x416df7
push 0x5c2804
push 0xf003f
push 0
push 0x550878
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x416c3d
cmp dword [0x5c23e0], 2
je 0x416c24
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416e02
cmp dword [ebp - 0x2ac], 1
jne 0x416c38
or dword [ebp - 0x98], 2
jmp 0x416df7
or dword [ebp - 0x98], 1
test byte [ebp + 8], 2
je 0x416db5
mov dword [ebp - 0xa8], 0xc
push str.version
push 0x5c23a0
call fcn.004202d0
add esp, 8
mov dword [ebp - 0x94], 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x5c23a0
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x416cc2
push 0x5508b0
lea eax, [ebp - 0xa4]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 0xa4]
push eax
push 0x5c9cb0
call fcn.004202d0
add esp, 8
push 0x5508b8
lea eax, [ebp - 0xa4]
push eax
call fcn.00420970
add esp, 8
test eax, eax
jge 0x416d0b
cmp dword [ebp - 0x2ac], 1
jne 0x416d06
or dword [ebp - 0x98], 2
jmp 0x416db5
push 0x5508c0
lea eax, [ebp - 0xa4]
push eax
call fcn.00420970
add esp, 8
test eax, eax
jg 0x416d33
or dword [ebp - 0x98], 2
jmp 0x416db5
or dword [ebp - 0x98], 1
push 0x5508c8
push 0x5c23a0
call fcn.004202d0
add esp, 8
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x90], 4
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x5c23a0
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x416da1
or dword [ebp - 0x98], 2
test byte [ebp - 0x8c], 2
je 0x416db5
or dword [ebp - 0x98], 2
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x416df7
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416e02
mov eax, dword [ebp - 0x98]
jmp 0x416e02
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417443
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
call fcn.00416af8
add esp, 4
cmp eax, 1
jne 0x41755b
push str.3.81
push 0x5c9cb0
call fcn.00420970
add esp, 8
test eax, eax
jl 0x41755b
push 0x5c2804
push 0xf003f
push 0
push 0x5508e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x4174c8
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417562
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x550918
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417519
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417562
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x41755b
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417562
xor eax, eax
jmp 0x417562
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417567
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x550920
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4175c6
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10007
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417669
mov dword [ebp - 0x54], 0xffff
push 0x550934
lea eax, [ebp - 0x4c]
push eax
call fcn.004202d0
add esp, 8
push 4
lea eax, [ebp - 0x54]
push eax
push 4
push 0
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417627
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417669
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417662
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417669
xor eax, eax
jmp 0x417669
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4176fe
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov byte [ebp - 4], 0
push 0x5c2804
push 0xf003f
push 0
push 0x550940
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417750
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x4177dc
push 1
lea eax, [ebp - 4]
push eax
push 3
push 0
push 0x55096c
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x4177a0
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4177dc
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x4177d5
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x4177dc
xor eax, eax
jmp 0x4177dc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417b97
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x5c2804
push 0
push 0xf003f
push 0
push 0
push 0
push 0x550a30
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417bef
push 0x10007
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417d73
mov eax, dword [0x5c2804]
push eax
call fcn.00407ddf
add esp, 4
cmp eax, 0xffffffff
jne 0x417c10
mov eax, 0xffffffff
jmp 0x417d73
push str.ProcessorType
push 0x5c23a0
call fcn.004202d0
add esp, 8
push 4
push 0x550a78
push 1
push 0
push 0x5c23a0
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417c67
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417d73
mov dword [ebp - 0xc], 0xffff
push 0x550a7c
push 0x5c23a0
call fcn.004202d0
add esp, 8
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x5c23a0
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417cc4
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417d73
mov eax, dword [0x5c2804]
push eax
call fcn.0040787b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x417ce9
mov eax, 0xffffffff
jmp 0x417d73
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417d1e
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417d73
call fcn.0041c84e
cmp dword [0x430048], 0
je 0x417d44
push 0x550a88
push 0x30
call fcn.0040616c
mov dword [ebp - 8], eax
jmp 0x417d53
push 0x550a98
push 0x30
call fcn.0040616c
mov dword [ebp - 8], eax
call fcn.0041c863
cmp dword [ebp - 8], 0xffffffff
jne 0x417d6c
mov eax, 0xffffffff
jmp 0x417d73
xor eax, eax
jmp 0x417d73
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418f28
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x5c2804
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 2
jne 0x418f62
xor eax, eax
jmp 0x41902d
cmp dword [0x5c23e0], 0
je 0x418f86
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x41902d
cmp dword [ebp + 0xc], 0
je 0x418faa
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [0x5c23e0], eax
jmp 0x418fbe
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x418ffb
cmp dword [0x5c23e0], 2
je 0x418ffb
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x41902d
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x419026
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x41902d
xor eax, eax
jmp 0x41902d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x419032
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test byte [ebp + 8], 4
je 0x4190f5
push 0x200
push 0x5c2600
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5c21a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x550cac
push 0x5c2600
call fcn.004202e0
add esp, 8
push 0x550cb8
push 0x5c21a0
call fcn.004202e0
add esp, 8
push str.pcrdhasp.inf
push 0x5c21a0
call fcn.004202e0
add esp, 8
push 0x5c2600
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x4190f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4190f5
cmp dword [ebp - 8], 5
jne 0x4190e1
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004007
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 8
je 0x4191c7
push 0x200
push 0x5c2600
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x550cd0
push 0x5c2600
call fcn.004202e0
add esp, 8
push 0x5c2600
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x419174
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x419174
cmp dword [ebp - 8], 5
jne 0x419160
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200400f
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x5c21a0
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x4191c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4191c7
cmp dword [ebp - 8], 5
jne 0x4191b3
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200401d
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x4191cf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4191d4
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test byte [ebp + 8], 1
je 0x4192ea
push 0x200
push 0x5c2600
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5c21a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x550ce0
push 0x5c21a0
call fcn.004202e0
add esp, 8
push 0x550ce8
push 0x5c2600
call fcn.004202e0
add esp, 8
push 0x5c2600
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x419285
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x419285
cmp dword [ebp - 8], 5
jne 0x419271
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004017
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
push str.hlpcmcia.inf
push 0x5c21a0
call fcn.004202e0
add esp, 8
push 0x5c21a0
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x4192ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4192ea
cmp dword [ebp - 8], 5
jne 0x4192d6
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x200401d
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 2
je 0x419369
push 0x200
push 0x5c2600
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x550d08
push 0x5c2600
call fcn.004202e0
add esp, 8
push 0x5c2600
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x419369
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x419369
cmp dword [ebp - 8], 5
jne 0x419355
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2004019
call fcn.00406c68
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x419371
pop edi
pop esi
pop ebx
leave
ret