joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41213f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522800
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x52280c
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522814
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
call fcn.00408ac1
add esp, 4
test eax, eax
je 0x4121bc
xor eax, eax
jmp 0x412247
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x4121f5
cmp dword [ebp - 0x208], 3
je 0x4121f5
cmp dword [ebp - 0x208], 5
jne 0x4121f0
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412247
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041e7b0
add esp, 4
test eax, eax
je 0x412245
mov edx, dword [ebp + 8]
push edx
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x412245
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x412245
cmp dword [ebp - 0x208], 5
jne 0x412240
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412247
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41224b
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x52281c
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522820
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522828
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4122cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x4122cd
cmp dword [ebp - 4], 5
jne 0x4122c8
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4122cf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4122d3
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522830
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522834
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x412343
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x412343
cmp dword [ebp - 4], 5
jne 0x41233e
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412345
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412349
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Drivers_
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x52284c
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
call fcn.00408ac1
add esp, 4
test eax, eax
je 0x4123b4
xor eax, eax
jmp 0x41243f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x4123ed
cmp dword [ebp - 0x208], 3
je 0x4123ed
cmp dword [ebp - 0x208], 5
jne 0x4123e8
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41243f
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041e7b0
add esp, 4
test eax, eax
je 0x41243d
mov edx, dword [ebp + 8]
push edx
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x41243d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x41243d
cmp dword [ebp - 0x208], 5
jne 0x412438
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41243f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412443
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x52285c
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522860
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4124b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x4124b3
cmp dword [ebp - 4], 5
jne 0x4124ae
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4124b5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412876
Capabilities:
Check if file exists
Get common file path
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov byte [ebp - 0x550], 0
cmp dword [ebp + 8], 0
je 0x4128d9
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xffffffff
je 0x4128d9
mov ecx, dword [ebp - 0x34c]
and ecx, 0x10
test ecx, ecx
je 0x4128d9
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x550]
push eax
call fcn.0041e930
add esp, 8
push 0x5228e8
lea ecx, [ebp - 0x550]
push ecx
call fcn.0041e940
add esp, 8
movsx edx, byte [ebp - 0x550]
test edx, edx
jne 0x41290a
push 0x200
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5228ec
lea ecx, [ebp - 0x550]
push ecx
call fcn.0041e940
add esp, 8
push 0x5228f8
lea edx, [ebp - 0x550]
push edx
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x550]
push eax
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x4129a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4129a3
push 0x200
push 0x5abf80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522908
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x522914
push 0x5abf80
call fcn.0041e940
add esp, 8
push str..sy_
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5abf80
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [ebp - 0x550]
push edx
call fcn.00408ac1
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x412a51
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041e930
add esp, 8
push 0x522928
lea edx, [ebp - 0x208]
push edx
call fcn.0041e940
add esp, 8
push 0x52292c
lea eax, [ebp - 0x208]
push eax
call fcn.0041e940
add esp, 8
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x412a51
push 0
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x412a40
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412afd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x412afd
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x412a90
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412afd
push 0
lea edx, [ebp - 4]
push edx
push 0x6ec00
push 0x4b129c
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x412acd
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412afd
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x412afb
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412afd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41328e
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522a04
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522a08
push 0x5abd60
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x413377
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e930
add esp, 8
push 0x522a14
lea edx, [ebp - 0x204]
push edx
call fcn.0041e940
add esp, 8
push str.haspdos.sys
lea eax, [ebp - 0x204]
push eax
call fcn.0041e940
add esp, 8
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x413377
push 0
push 0x5abd60
lea eax, [ebp - 0x204]
push eax
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x413366
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413441
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413441
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x4133b7
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413441
push 0
lea eax, [ebp - 0x208]
push eax
push 0x17f
push 0x52189c
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413405
mov edx, dword [0x5abd44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413441
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x41343f
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413441
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413445
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
cmp dword [0x42dfc4], 0
jne 0x41345e
xor eax, eax
jmp 0x4136a9
cmp dword [0x42dfc0], 0
jne 0x41346e
xor eax, eax
jmp 0x4136a9
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x198]
push ecx
call fcn.00404ad0
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x41349b
mov eax, dword [ebp - 0xd0]
jmp 0x4136a9
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x41351e
push 0x522a24
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x41351e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41351e
push 0x4000d
call fcn.00406ccc
add esp, 4
push 0x2020001
call fcn.00406c68
add esp, 4
mov dword [ebp - 0xd0], 0xffffffff
mov eax, dword [ebp - 0xd0]
jmp 0x4136a9
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x41354b
push 0x522a34
push 0x5abd60
call fcn.0041e940
add esp, 8
jmp 0x41355d
push 0x522a44
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522a50
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
mov edx, dword [ebp + 8]
push edx
call fcn.0041384a
add esp, 8
cmp eax, 0xffffffff
jne 0x41359a
push 0x2004012
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4136a9
push 0x200
push 0x5ac440
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x4135c7
push 0x522a5c
push 0x5ac440
call fcn.0041e940
add esp, 8
jmp 0x4135d9
push 0x522a6c
push 0x5ac440
call fcn.0041e940
add esp, 8
push 0x522a74
push 0x5ac440
call fcn.0041e940
add esp, 8
mov eax, dword [ebp - 0x194]
push eax
push 0x5ac440
mov ecx, dword [ebp + 8]
push ecx
call fcn.004136ad
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41361d
push 0x2004013
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4136a9
cmp dword [ebp - 0x194], 3
jne 0x41368b
cmp dword [0x5a5bd4], 0
jne 0x41368b
push 0x200
push 0x5ac440
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._setup_aladdin
push 0x5ac440
call fcn.0041e940
add esp, 8
push 0x522a90
push 0x5ac440
call fcn.0041e940
add esp, 8
push 0x5ac440
mov edx, dword [ebp + 8]
push edx
call fcn.004139b9
add esp, 8
cmp eax, 0xffffffff
jne 0x41368b
push 0x200401e
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4136a9
cmp dword [ebp - 0x194], 3
jne 0x4136a7
call fcn.004144a9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4136a7
or eax, 0xffffffff
jmp 0x4136a9
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41384a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
cmp dword [ebp + 8], 0
je 0x4138eb
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e930
add esp, 8
push 0x522aa8
lea edx, [ebp - 0x204]
push edx
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4138eb
push 0
push 0x5abd60
lea edx, [ebp - 0x204]
push edx
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x4138da
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4139b5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4139b5
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x41392a
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4139b5
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004089ef
push eax
push 0x42e050
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413979
mov edx, dword [0x5abd44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4139b5
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4139b3
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4139b5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4139b9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
cmp dword [ebp + 8], 0
je 0x413a5a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e930
add esp, 8
push str._aksusb.cat
lea edx, [ebp - 0x204]
push edx
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x413a5a
push 0
push 0x5ac440
lea edx, [ebp - 0x204]
push edx
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x413a49
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413b24
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413b24
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x413a99
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413b24
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00408a04
push eax
push 0x433f98
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413ae8
mov edx, dword [0x5abd44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413b24
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413b22
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413b24
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413b28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 0xc]
and edx, 1
test edx, edx
je 0x413c8b
push 0x200
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522ac0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0041e940
add esp, 8
push 0x522ac4
lea edx, [ebp - 0x21c]
push edx
call fcn.0041e940
add esp, 8
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x413c1b
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x522ad0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x413c1b
push str.GetVDDVersion
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x413c11
call dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..hasp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x413c82
push 0
lea eax, [ebp - 0x14]
push eax
push 8
lea ecx, [ebp - 8]
push ecx
push 8
lea edx, [ebp - 8]
push edx
push 0x9c402800
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x413c76
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413c8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
and ecx, 2
test ecx, ecx
je 0x413cc4
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0041cf52
mov ecx, dword [ebp - 0x1c]
and ecx, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x220]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
push 0x200
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers
lea eax, [ebp - 0x21c]
push eax
call fcn.0041e940
add esp, 8
push 0x522b04
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0041e940
add esp, 8
lea edx, [ebp - 0x21c]
push edx
call fcn.0041ad80
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x10], 0xffffffff
jne 0x413d26
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413d2c
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov dword [ebp - 0x208], 0x200
push 0x5a5be4
mov eax, dword [ebp + 8]
push eax
call fcn.0041e930
add esp, 8
push 0x522b10
push 0x5ac1a0
call fcn.0041e930
add esp, 8
cmp dword [ebp + 0xc], 2
jne 0x413d7c
push 0x522b34
push 0x5ac1a0
call fcn.0041e940
add esp, 8
jmp 0x413d8e
push 0x522b3c
push 0x5ac1a0
call fcn.0041e940
add esp, 8
push 0x5abf60
push 0xf003f
push 0
push 0x5ac1a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x413ddc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
je 0x413dd5
or eax, 0xffffffff
jmp 0x413f6a
xor eax, eax
jmp 0x413f6a
push 0x522b48
push 0x5ac400
call fcn.0041e930
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x200]
push edx
push 0
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x413e34
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x413f6a
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x413e57
or eax, 0xffffffff
jmp 0x413f6a
push 0x522b54
lea eax, [ebp - 0x200]
push eax
call fcn.0041ef50
add esp, 8
test eax, eax
je 0x413edd
push str.SystemRoot_
call fcn.0041e7b0
add esp, 4
lea ecx, [ebp + eax - 0x200]
push ecx
lea edx, [ebp - 0x200]
push edx
call fcn.0041e930
add esp, 8
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522b74
push 0x5abd60
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
lea ecx, [ebp - 0x200]
push ecx
call fcn.0041e930
add esp, 8
push 0x522b78
lea edx, [ebp - 0x200]
push edx
call fcn.0041ef50
add esp, 8
test eax, eax
je 0x413f19
push 0x522b80
call fcn.0041e7b0
add esp, 4
lea eax, [ebp + eax - 0x200]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.0041e930
add esp, 8
push 0x522b88
lea edx, [ebp - 0x200]
push edx
call fcn.0041ef50
add esp, 8
test eax, eax
je 0x413f55
push 0x522b98
call fcn.0041e7b0
add esp, 4
lea eax, [ebp + eax - 0x200]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.0041e930
add esp, 8
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041e930
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413f6e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.SYSTEMCurrentControlSetServices_
push 0x5ac1a0
call fcn.0041e930
add esp, 8
cmp dword [ebp + 8], 2
jne 0x413f9e
push 0x522bcc
push 0x5ac1a0
call fcn.0041e940
add esp, 8
jmp 0x413fb0
push 0x522bd4
push 0x5ac1a0
call fcn.0041e940
add esp, 8
push 0x5abf60
push 0x5ac1a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413fe3
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414076
push 0x522be0
push 0x5ac1a0
call fcn.0041e930
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041e7b0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 2
push 0
push 0x5ac1a0
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41404c
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414076
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414074
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414076
xor eax, eax
mov esp, ebp
pop ebp
ret