joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027e1
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x480244]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xc
mov eax, 0x468789
call fcn.0043eaab
xor eax, eax
mov dword [edi + 0x2c], eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
inc ebx
push ebx
push str.SYSTEMCurrentControlSet_serviceskisknl
push reloc.WS2_32.dll_bind
lea esi, [ebp - 0x10]
mov dword [ebp - 4], eax
call fcn.004012d0
test eax, eax
jne 0x402836
mov dword [edi + 0x2c], ebx
cmp dword [ebp - 0x10], 0
jmp 0x4029e6
mov ecx, 0x481bd4
lea esi, [ebp - 0x14]
call fcn.0040189d
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], bl
xor esi, esi
push str.Start
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esi
call fcn.0040132f
test eax, eax
je 0x4029d1
cmp dword [ebp - 0x18], 2
jne 0x4029d1
lea eax, [ebp - 0x18]
push eax
push str.Type
lea eax, [ebp - 0x10]
call fcn.0040132f
test eax, eax
je 0x4029c8
cmp dword [ebp - 0x18], ebx
jne 0x4029c8
lea eax, [ebp - 0x14]
push eax
push str.DisplayName
lea ebx, [ebp - 0x10]
call fcn.00401375
test eax, eax
je 0x4029bf
push str.kisknl
lea eax, [ebp - 0x14]
push eax
call fcn.00402d3a
test eax, eax
jne 0x4029bf
lea eax, [ebp - 0x14]
push eax
push str.ImagePath
call fcn.00401375
xor ebx, ebx
cmp eax, ebx
jne 0x4028ed
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [edi + 0x2c], 5
call fcn.004023f7
cmp dword [ebp - 0x10], ebx
jmp 0x4029e6
mov ecx, 0x481bd4
lea esi, [ebp - 0x18]
call fcn.0040189d
push 0x208
lea eax, [ebp + 2]
push ebx
mov byte [ebp - 4], 2
push eax
mov word [ebp], bx
call fcn.00437c90
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp]
push eax
mov eax, esi
push str.___sdriverskisknl.sys
push eax
call fcn.00402102
mov ebx, dword [ebp - 0x14]
push str._systemroot_system32driverskisknl.sys
push ebx
call fcn.004379de
mov esi, dword [ebp - 0x18]
add esp, 0x14
test eax, eax
je 0x40297f
push esi
push ebx
call fcn.004379de
test eax, eax
pop ecx
pop ecx
je 0x40297f
lea eax, [esi - 0x10]
mov dword [edi + 0x2c], 6
call fcn.004023f7
lea eax, [ebx - 0x10]
call fcn.004023f7
jmp 0x40282d
lea eax, [ebp - 0x14]
push eax
push str.Group
lea ebx, [ebp - 0x10]
call fcn.00401375
test eax, eax
je 0x4029b6
push str.FSFilter_Anti_Virus
lea eax, [ebp - 0x14]
push eax
call fcn.00402d3a
test eax, eax
jne 0x4029b6
lea eax, [esi - 0x10]
call fcn.004023f7
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
jmp 0x402975
mov dword [edi + 0x2c], 7
jmp 0x4029a6
mov dword [edi + 0x2c], 4
jmp 0x4029d8
mov dword [edi + 0x2c], 3
jmp 0x4029d8
mov dword [edi + 0x2c], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
cmp dword [ebp - 0x10], esi
je 0x4029f1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00437538
add ebp, 0x210
leave
ret
Function at 0x402a14
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push 0x4713e0
push eax
mov ecx, esi
call fcn.004016d7
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
push dword [eax]
call edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004023f7
cmp dword [esi + 4], 0
lea eax, [ebp - 4]
mov ecx, esi
je 0x402a55
push str.securityksdekisknl64.sys
jmp 0x402a5a
push str.securityksdekisknl.sys
push eax
call fcn.004016d7
pop ecx
pop ecx
push dword [eax]
call edi
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004023f7
pop edi
leave
ret

Function at 0x402a94
Capabilities:
Persist via run registry key

Disassembly:
push 0x10
mov eax, 0x468756
call fcn.0043eaab
mov edi, ecx
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [ebp - 0x10], eax
push 1
push str.SoftwarekingsoftAntiVirusKSetting
mov ebx, reloc.WS2_32.dll_bind
push ebx
lea esi, [ebp - 0x10]
mov dword [ebp - 4], eax
call fcn.004012d0
test eax, eax
je 0x402bff
lea eax, [ebp - 0x18]
push eax
xor esi, esi
push str.kxesc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esi
call fcn.0040132f
cmp eax, esi
jne 0x402aec
cmp dword [ebp - 0x10], esi
jmp 0x402c03
cmp dword [ebp - 0x18], 1
jne 0x402bff
mov dword [ebp - 0x14], esi
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push ebx
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004012d0
xor ebx, ebx
cmp eax, ebx
jne 0x402b40
mov dword [edi + 0x24], 1
cmp dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x402b2a
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
je 0x402c0e
push dword [ebp - 0x10]
call esi
jmp 0x402c0e
mov ecx, 0x481bd4
lea esi, [ebp - 0x18]
call fcn.0040189d
mov eax, esi
push eax
push str.kxesc
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00401375
xor ebx, ebx
cmp eax, ebx
jne 0x402b7b
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov dword [edi + 0x24], 2
call fcn.004023f7
jmp 0x402b1a
mov ecx, 0x481bd4
lea esi, [ebp - 0x1c]
call fcn.0040189d
mov byte [ebp - 4], 3
push dword [edi]
mov eax, esi
push str.__skxetray.exe___autorun
push eax
call fcn.00402102
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
push esi
push ebx
call fcn.004379de
add esp, 0x14
test eax, eax
lea eax, [esi - 0x10]
je 0x402be3
mov dword [edi + 0x24], 3
call fcn.004023f7
lea eax, [ebx - 0x10]
call fcn.004023f7
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x402bd8
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jmp 0x402b30
call fcn.004023f7
lea eax, [ebx - 0x10]
call fcn.004023f7
cmp dword [ebp - 0x14], 0
je 0x402bff
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x402c0e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043eb83
ret
Function at 0x402d99
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x402dc7
push dword [esp + 0xc]
call fcn.00437547
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402dc7
inc edi
mov eax, edi
pop edi
ret 8
Function at 0x402dfd
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0x190
mov eax, 0x46870e
call fcn.0043eb14
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x144], esi
mov edi, edx
mov dword [ebp - 0x134], eax
call fcn.00402dda
xor ebx, ebx
cmp edi, ebx
jne 0x402e31
xor eax, eax
jmp 0x403028
mov ecx, 0x481bd4
lea esi, [ebp - 0x140]
call fcn.0040189d
push dword [ebp - 0x134]
mov eax, esi
push edi
push str.__s___s
push eax
mov dword [ebp - 4], ebx
call fcn.00402102
push 0x110
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.00437c90
add esp, 0x1c
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402e94
cmp dword [ebp - 0x128], 6
jne 0x402e94
inc esi
cmp esi, ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
lea esi, [ebp - 0x130]
jne 0x402eb1
call fcn.0041d1c6
jmp 0x402eb6
call fcn.0041d176
cmp eax, ebx
jne 0x403000
push 0x40
lea eax, [ebp - 0x198]
push ebx
push eax
mov dword [ebp - 0x19c], 0x44
call fcn.00437c90
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x154], ebx
xor eax, eax
lea edi, [ebp - 0x150]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov dword [ebp - 0x170], 1
mov word [ebp - 0x16c], bx
call fcn.0041d245
test al, al
jne 0x402f18
lea eax, [ebp - 0x130]
push eax
call fcn.0041d443
pop ecx
push str.userenv.dll
mov dword [ebp - 0x194], str.Winsta0Default
mov dword [ebp - 0x134], 0x30
mov dword [ebp - 0x138], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x13c], eax
je 0x402f92
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x13c]
mov esi, eax
call edi
cmp esi, ebx
mov edi, eax
je 0x402f92
push ebx
push dword [ebp - 0x130]
lea eax, [ebp - 0x138]
push eax
call esi
test eax, eax
je 0x402f8c
mov dword [ebp - 0x134], 0x430
jmp 0x402f92
mov dword [ebp - 0x138], ebx
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x19c]
push eax
push ebx
push dword [ebp - 0x138]
push dword [ebp - 0x134]
push ebx
push ebx
push ebx
push dword [ebp - 0x140]
push ebx
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp edi, ebx
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x154]
mov dword [eax + 4], ecx
je 0x402fec
push dword [ebp - 0x138]
call edi
cmp dword [ebp - 0x13c], ebx
je 0x403000
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x130], ebx
je 0x403014
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x140]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x134]
call fcn.0043eb97
ret 4
Function at 0x4030f3
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x46a1be
call fcn.0043eaab
mov ecx, 0x481bd4
lea esi, [ebp - 0x10]
call fcn.0040189d
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00403062
pop ecx
mov edi, esi
mov byte [ebp - 4], 1
call fcn.004018d4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
push str.knatsvc.exe
mov eax, esi
push eax
call fcn.004036ef
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403162
push 0x2710
push str._install__name_knatsvc__description
mov edx, esi
call fcn.00405623
pop ecx
pop ecx
lea eax, [esi - 0x10]
call fcn.004023f7
call fcn.0043eb83
ret

Function at 0x403170
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x46a193
call fcn.0043eaab
mov ecx, 0x481bd4
lea esi, [ebp - 0x10]
call fcn.0040189d
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00403062
pop ecx
mov edi, esi
mov byte [ebp - 4], 1
call fcn.004018d4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
push str.knatsvc.exe
mov eax, esi
push eax
call fcn.004036ef
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4031df
push 0x7530
push str._start_knatsvc
mov edx, esi
call fcn.00405623
pop ecx
pop ecx
lea eax, [esi - 0x10]
call fcn.004023f7
call fcn.0043eb83
ret

Function at 0x4031ed
Capabilities:
Persist via run registry key

Disassembly:
push 0x14
mov eax, 0x46a168
call fcn.0043eaab
mov ebx, 0x481bd4
xor edi, edi
mov ecx, ebx
lea esi, [ebp - 0x10]
inc edi
call fcn.0040189d
and dword [ebp - 4], 0
mov ecx, ebx
lea esi, [ebp - 0x18]
call fcn.0040189d
and dword [ebp - 0x14], 0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004012d0
test eax, eax
je 0x4032de
lea eax, [ebp - 0x18]
push eax
push str.kwifi
mov ebx, esi
call fcn.00401375
test eax, eax
je 0x4032de
mov esi, 0x471ed0
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.00401ef0
lea eax, [ebp - 0x20]
push eax
call fcn.00403062
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
mov dword [esp], 0x471ed4
push ecx
mov ecx, eax
call fcn.004016d7
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403731
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.004023f7
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.004036ef
push str.__autorun
lea eax, [ebp - 0x10]
push eax
call fcn.004036ef
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.004379de
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
and edi, 2
cmp dword [ebp - 0x14], 0
je 0x4032ed
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x14], 0
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, edi
call fcn.0043eb83
ret
Function at 0x40330f
Capabilities:
Persist via run registry key

Disassembly:
push 0x10
mov eax, 0x46a125
call fcn.0043eaab
mov ecx, 0x481bd4
lea esi, [ebp - 0x10]
call fcn.0040189d
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, 0x471ed0
push esi
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.004036ef
lea eax, [ebp - 0x1c]
push eax
call fcn.00403062
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov dword [esp], 0x471ed4
push ecx
mov ecx, eax
call fcn.004016d7
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403731
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004023f7
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.004036ef
push str.__autorun
lea eax, [ebp - 0x10]
push eax
call fcn.004036ef
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
lea esi, [ebp - 0x14]
call fcn.004012d0
mov ebx, dword [ebp - 0x10]
mov esi, eax
cmp esi, edi
je 0x4033d4
push ebx
push str.kwifi
lea esi, [ebp - 0x14]
call fcn.00402d99
mov esi, eax
cmp dword [ebp - 0x14], edi
je 0x4033e2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [ebp - 0x14], edi
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret
Function at 0x403de2
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x46a7af
call fcn.0043eaab
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
mov ebx, 0x481bd4
mov ecx, ebx
call fcn.0040189d
mov dword [ebp - 4], edi
inc edi
mov ecx, ebx
lea esi, [ebp - 0x18]
mov dword [ebp - 0x14], edi
call fcn.0040189d
push str.ProgramPath
mov edx, str.softwarekingsoft_antivirus
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.00403786
pop ecx
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
call fcn.004018d4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
lea eax, [ebp - 0x20]
push str.kislive.exe
mov esi, edi
push eax
mov ecx, esi
call fcn.004016d7
pop ecx
pop ecx
mov byte [ebp - 4], 3
push dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x14], 3
call edi
test eax, eax
je 0x403e99
lea eax, [ebp - 0x1c]
push 0x47169c
push eax
mov ecx, esi
call fcn.004016d7
pop ecx
pop ecx
push dword [eax]
mov dword [ebp - 0x14], 7
call edi
test eax, eax
mov byte [ebp - 0xd], 1
jne 0x403e9d
mov byte [ebp - 0xd], 0
test byte [ebp - 0x14], 4
je 0x403eb2
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x14], 0xfffffffb
add eax, 0xfffffff0
call fcn.004023f7
mov dword [ebp - 4], 1
test byte [ebp - 0x14], 2
je 0x403ece
mov eax, dword [ebp - 0x20]
and dword [ebp - 0x14], 0xfffffffd
add eax, 0xfffffff0
call fcn.004023f7
cmp byte [ebp - 0xd], 0
jne 0x403fc3
call fcn.00401735
push 0x472084
lea esi, [ebp - 0x18]
call fcn.00404190
test eax, eax
pop ecx
je 0x403fa2
mov ecx, ebx
lea esi, [ebp - 0x1c]
call fcn.0040189d
mov byte [ebp - 4], 4
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00404260
test eax, eax
pop ecx
je 0x403f57
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push str.kislive.exe
push eax
call fcn.004016d7
pop ecx
pop ecx
mov byte [ebp - 4], 5
push dword [eax]
or dword [ebp - 0x14], 8
call edi
test eax, eax
je 0x403f57
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0x47169c
push eax
call fcn.004016d7
or dword [ebp - 0x14], 0x10
pop ecx
pop ecx
push dword [eax]
call edi
test eax, eax
je 0x403f57
mov bl, 1
jmp 0x403f59
xor bl, bl
test byte [ebp - 0x14], 0x10
je 0x403f6e
mov eax, dword [ebp - 0x20]
and dword [ebp - 0x14], 0xffffffef
add eax, 0xfffffff0
call fcn.004023f7
mov dword [ebp - 4], 4
test byte [ebp - 0x14], 8
je 0x403f8a
mov eax, dword [ebp - 0x24]
and dword [ebp - 0x14], 0xfffffff7
add eax, 0xfffffff0
call fcn.004023f7
test bl, bl
je 0x403f93
mov eax, dword [ebp - 0x1c]
jmp 0x403fbb
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
lea eax, [ebp - 0x24]
push eax
call fcn.00403b57
pop ecx
mov byte [ebp - 4], 6
mov edi, dword [ebp + 8]
call fcn.004018d4
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp + 8]
call fcn.0043eb83
ret
Function at 0x403fd7
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x46aa29
call fcn.0043eaab
lea eax, [ebp - 0x10]
push eax
xor esi, esi
call fcn.00403de2
pop ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x404024
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404024
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x18], 0x47169c
mov dword [ebp - 0x14], str.kislive.exe
call fcn.0040387c
pop ecx
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret

Function at 0x404037
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x46a05c
call fcn.0043eaab
and dword [ebp - 0x18], 0
push str.AppPath
mov edx, str.SOFTWAREMyDriversDriverGenius
lea ecx, [ebp - 0x10]
call fcn.00403786
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], str.DgService.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.004016d7
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004023f7
test esi, esi
je 0x4040a0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401c46
add eax, 0x10
mov dword [edi], eax
jmp 0x404120
mov ebx, 0x481bd4
mov ecx, ebx
lea esi, [ebp - 0x14]
call fcn.0040189d
push 0x472104
mov byte [ebp - 4], 1
call fcn.00404190
test eax, eax
pop ecx
je 0x40410a
mov ecx, ebx
lea esi, [ebp - 0x18]
call fcn.0040189d
mov eax, esi
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00404260
test eax, eax
pop ecx
je 0x4040fb
mov esi, dword [ebp - 0x18]
add esi, 0xfffffff0
mov eax, esi
call fcn.00401c46
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.004023f7
jmp 0x404115
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004023f7
push 0x4713dc
push edi
call fcn.00401673
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, edi
call fcn.0043eb83
ret

Function at 0x404133
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x46a729
call fcn.0043eaab
lea edi, [ebp - 0x10]
xor esi, esi
call fcn.00404037
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x40417d
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40417d
lea eax, [ebp - 0x18]
push eax
mov eax, edi
push eax
mov dword [ebp - 0x18], str.DriverGenius.exe
mov dword [ebp - 0x14], str.DgService.exe
call fcn.0040387c
pop ecx
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret
Function at 0x404190
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x480244]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x198]
push ebx
push edi
xor edi, edi
push 0x206
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7a]
push edi
push eax
mov word [ebp - 0x7c], di
call fcn.00437c90
add esp, 0xc
push edi
push 0x19
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x404212
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.00401ef0
push dword [ebp - 0x80]
push esi
call fcn.004036ef
push dword [esi]
call ebx
test eax, eax
je 0x404212
xor eax, eax
inc eax
jmp 0x404249
push 0
push 0x10
lea eax, [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x404247
lea eax, [ebp - 0x7c]
push eax
call edi
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.00401ef0
push dword [ebp - 0x80]
push esi
call fcn.004036ef
push dword [esi]
call ebx
test eax, eax
jne 0x40420d
xor eax, eax
mov ecx, dword [ebp + 0x18c]
pop edi
xor ecx, ebp
pop ebx
call fcn.00437538
add ebp, 0x190
leave
ret

Function at 0x404260
Capabilities:
Check if file exists

Disassembly:
push 0x2b8
mov eax, 0x46a01c
call fcn.0043eb14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2bc]
push eax
mov esi, ecx
call fcn.0041e4fc
xor edi, edi
mov dword [ebp - 4], edi
push dword [esi]
lea ecx, [ebp - 0x2bc]
call fcn.0041e5c1
test eax, eax
jl 0x404319
push 0x206
lea eax, [ebp - 0x21a]
push edi
push eax
mov word [ebp - 0x21c], di
call fcn.00437c90
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea ebx, [ebp - 0x2c4]
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x2c4], 0x103
call fcn.0041e63b
test eax, eax
jl 0x404319
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x2c0]
call fcn.00401ef0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
lea esi, [ebp - 0x2bc]
call fcn.0041e51b
mov eax, edi
call fcn.0043eb97
ret

Function at 0x404ea1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404f04
cmp dword [ebp + 0xc], 1
je 0x404edd
cmp dword [ebp + 0xc], 2
je 0x404edd
push 0xd
pop eax
jmp 0x404f04
test edi, edi
mov eax, dword [ebp - 4]
je 0x404efe
test eax, eax
je 0x404efa
test al, 1
jne 0x404ed8
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x404efe
jmp 0x404ed8
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x40511c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4051a5
push ebx
call fcn.00436e9c
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x405196
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x472238
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x405196
cmp dword [ebp - 0xc], ebx
je 0x405196
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x4051a5
push dword [ebp - 4]
call fcn.00437d0a
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret