joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee8d
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
mov dword [ebp - 0x6c], 0
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 4
je 0x40ef94
push 0x422e50
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a850
add esp, 8
push 0x484c14
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x40ef27
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a7d8
add esp, 4
add eax, 0x32
push eax
call fcn.0041addb
add esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a850
add esp, 8
push 0x484c20
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x469a30
call fcn.00410449
add esp, 4
push 0
push 0xa03c
push 0x469a30
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0040f755
add esp, 0x14
mov dword [ebp - 0x68], eax
cmp dword [ebp + 0xc], 0
je 0x40ef73
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a905
add esp, 4
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x68], 0xffffffff
jne 0x40ef94
push 0x2004001
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x40f0dd
test byte [ebp + 8], 8
je 0x40f0d6
push 0x422e50
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a850
add esp, 8
push 0x484c2c
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x40f00e
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a7d8
add esp, 4
add eax, 0x32
push eax
call fcn.0041addb
add esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a850
add esp, 8
push 0x484c3c
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x64
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x484c48
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40f070
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40f070
push 0x40001
call fcn.004054a2
add esp, 4
push 0x200400e
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x40f0dd
push 0x473a70
call fcn.00410449
add esp, 4
push 0
push 0x11052
push 0x473a70
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0040f755
add esp, 0x14
mov dword [ebp - 0x68], eax
cmp dword [ebp + 0xc], 0
je 0x40f0b5
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a905
add esp, 4
cmp dword [ebp - 0x68], 0xffffffff
jne 0x40f0d6
push 0x200400e
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x40f0dd
xor eax, eax
jmp 0x40f0dd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f0e2
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
mov dword [ebp - 0x6c], 0
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 1
je 0x40f26c
push 0x422e50
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a850
add esp, 8
push 0x484c58
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x40f17c
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a7d8
add esp, 4
add eax, 0x32
push eax
call fcn.0041addb
add esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a850
add esp, 8
push 0x484c68
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x64
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x484c78
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40f1de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40f1de
push 0x40001
call fcn.004054a2
add esp, 4
push 0x2004016
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x40f36c
push 0
push 0
call fcn.0040e2f9
add esp, 4
push eax
push 0x454c28
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0040f755
add esp, 0x14
mov dword [ebp - 0x68], eax
push 1
push 1
call fcn.0040e2f9
add esp, 4
push eax
push 0x464c28
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0040f755
add esp, 0x14
mov dword [ebp - 0x68], eax
cmp dword [ebp + 0xc], 0
je 0x40f24b
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a905
add esp, 4
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x68], 0xffffffff
jne 0x40f26c
push 0x2004016
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x40f36c
test byte [ebp + 8], 2
je 0x40f365
push 0x422e50
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a850
add esp, 8
push 0x484c88
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a84c
add esp, 8
push 0x484c8c
lea eax, [ebp - 0xd0]
push eax
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x40f30b
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a7d8
add esp, 4
add eax, 0x32
push eax
call fcn.0041addb
add esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a850
add esp, 8
push 0x484c98
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x484c9c
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0
call fcn.004156e2
push eax
push 0x4ae268
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0040f755
add esp, 0x14
mov dword [ebp - 0x68], eax
cmp dword [ebp + 0xc], 0
je 0x40f344
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0041a905
add esp, 4
cmp dword [ebp - 0x68], 0xffffffff
jne 0x40f365
push 0x2004018
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x40f36c
xor eax, eax
jmp 0x40f36c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f755
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
je 0x40f7df
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x40f7df
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40f7cb
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x40f7fc
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40f7fc
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e010
add esp, 0x10
jmp 0x40f7fc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f8c1
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x422eb8
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x422dd4], eax
cmp dword [0x422dd4], 2
jne 0x40f8fb
xor eax, eax
jmp 0x40f9c6
cmp dword [0x422dd4], 0
je 0x40f91f
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x40f9c6
cmp dword [ebp + 0xc], 0
je 0x40f943
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x422eb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [0x422dd4], eax
jmp 0x40f957
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [0x422dd4], eax
cmp dword [0x422dd4], 0
je 0x40f994
cmp dword [0x422dd4], 2
je 0x40f994
mov eax, dword [0x422eb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10005
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x40f9c6
mov eax, dword [0x422eb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40f9bf
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x40f9c6
xor eax, eax
jmp 0x40f9c6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f9cb
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x484db8
push 0x422e50
call fcn.0041a84c
add esp, 8
push 0x422e50
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fa4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x40fa4b
cmp dword [ebp - 8], 5
jne 0x40fa37
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004007
call fcn.00405434
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x484dc4
push 0x422e50
call fcn.0041a84c
add esp, 8
push 0x422e50
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fabb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x40fabb
cmp dword [ebp - 8], 5
jne 0x40faa7
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x200400f
call fcn.00405434
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x40fac3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40fac8
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x484dd4
push 0x422e50
call fcn.0041a84c
add esp, 8
push 0x422e50
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fb48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x40fb48
cmp dword [ebp - 8], 5
jne 0x40fb34
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004007
call fcn.00405434
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x484de4
push 0x422e50
call fcn.0041a84c
add esp, 8
push 0x422e50
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fbb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x40fbb8
cmp dword [ebp - 8], 5
jne 0x40fba4
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x200400f
call fcn.00405434
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x40fbc0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fbc5
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
mov dword [ebp - 0xcc], 0
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x422e50
lea eax, [ebp - 0xc8]
push eax
call fcn.0041a850
add esp, 8
push 0x422e50
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x484df0
lea eax, [ebp - 0xc8]
push eax
call fcn.0041a84c
add esp, 8
push str._aksusb.inf
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
push 0x64
push 0x422de0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x422de0
lea eax, [ebp - 0x134]
push eax
call fcn.0041a850
add esp, 8
push 0x484e08
lea eax, [ebp - 0x134]
push eax
call fcn.0041a84c
add esp, 8
push 0x484e1c
lea eax, [ebp - 0x134]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fcda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
je 0x40fcda
cmp dword [ebp - 0xd0], 5
jne 0x40fcc3
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004010
call fcn.00405434
add esp, 4
mov dword [ebp - 0xcc], 0xffffffff
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fd36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
je 0x40fd36
cmp dword [ebp - 0xd0], 5
jne 0x40fd1f
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004011
call fcn.00405434
add esp, 4
mov dword [ebp - 0xcc], 0xffffffff
cmp dword [ebp + 8], 0
je 0x40fd4b
mov eax, dword [ebp - 0xcc]
jmp 0x40fdb5
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fdaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
je 0x40fdaa
cmp dword [ebp - 0xd0], 5
jne 0x40fd93
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004010
call fcn.00405434
add esp, 4
mov dword [ebp - 0xcc], 0xffffffff
mov eax, dword [ebp - 0xcc]
jmp 0x40fdb5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fdba
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
mov dword [ebp - 0xcc], 0
push 0x64
push 0x422e50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x64
push 0x422de0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x422e50
lea eax, [ebp - 0x134]
push eax
call fcn.0041a850
add esp, 8
push 0x484e28
lea eax, [ebp - 0x134]
push eax
call fcn.0041a84c
add esp, 8
push 0x422e50
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x484e38
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
push 0x422de0
lea eax, [ebp - 0xc8]
push eax
call fcn.0041a850
add esp, 8
push str.inf
lea eax, [ebp - 0xc8]
push eax
call fcn.0041a84c
add esp, 8
push str._aksusb95.inf
lea eax, [ebp - 0xc8]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
je 0x40fecc
cmp dword [ebp - 0xd0], 5
jne 0x40feb5
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004011
call fcn.00405434
add esp, 4
mov dword [ebp - 0xcc], 0xffffffff
cmp dword [ebp + 8], 0
je 0x40fee1
mov eax, dword [ebp - 0xcc]
jmp 0x40ffaa
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ff40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
je 0x40ff40
cmp dword [ebp - 0xd0], 5
jne 0x40ff29
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004010
call fcn.00405434
add esp, 4
mov dword [ebp - 0xcc], 0xffffffff
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ff9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
je 0x40ff9f
cmp dword [ebp - 0xd0], 5
jne 0x40ff88
push 0x4000b
call fcn.004054a2
add esp, 4
push 0x2004010
call fcn.00405434
add esp, 4
mov dword [ebp - 0xcc], 0xffffffff
mov eax, dword [ebp - 0xcc]
jmp 0x40ffaa
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ffaf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push pe_nt_image_headers32
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0041a850
add esp, 8
push str.hasp95dl.vxd
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x100]
push eax
call fcn.004102af
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0xffffffff
jne 0x41001d
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0041a850
add esp, 8
push str.hasp95.vxd
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x100]
push eax
call fcn.004102af
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x410070
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0041a850
add esp, 8
push 0x484e7c
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x100]
push eax
call fcn.0040e228
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xffffffff
jne 0x4100c3
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0041a850
add esp, 8
push 0x484e8c
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x100]
push eax
call fcn.0040e265
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0xffffffff
jne 0x410116
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
cmp dword [ebp + 0xc], 0
je 0x41015f
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system32drivers
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
push str._aksusb.sys
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
jmp 0x410186
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0041a850
add esp, 8
push str._aksusb95.sys
lea eax, [ebp - 0x100]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x100]
push eax
call fcn.0040e265
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x4101b2
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
jmp 0x4101b7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410be4
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a8df4
push 0x422c10
call fcn.0041a84c
add esp, 8
push 0x4a8df8
push 0x422c10
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 8], 0
je 0x410cbb
mov eax, dword [ebp + 8]
push eax
push 0x422c80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a8e08
push 0x422c80
call fcn.0041a84c
add esp, 8
push 0x4a8e0c
push 0x422c80
call fcn.0041a84c
add esp, 8
push 0
push 0x422c80
call fcn.0041fbfb
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x410cbb
mov eax, dword [ebp - 8]
push eax
call fcn.0041d99d
add esp, 4
push 0
push 0x422c10
push 0x422c80
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x410cb4
push 0x4000c
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x410d38
xor eax, eax
jmp 0x410d38
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a8e1c
push 0x422c10
call fcn.0041a84c
add esp, 8
push 0x4a8e20
push 0x422c10
call fcn.0041a84c
add esp, 8
push 0
push 0x422c10
push 0
call fcn.0040e2f9
add esp, 4
push eax
push 0x454c28
call fcn.0040e010
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x422c10
push 1
call fcn.0040e2f9
add esp, 4
push eax
push 0x464c28
call fcn.0040e010
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x410d38
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410d3d
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a8e30
push 0x422c10
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 8], 0
je 0x410df0
mov eax, dword [ebp + 8]
push eax
push 0x422c80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a8e40
push 0x422c80
call fcn.0041a84c
add esp, 8
push 0
push 0x422c80
call fcn.0041fbfb
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x410df0
mov eax, dword [ebp - 8]
push eax
call fcn.0041d99d
add esp, 4
push 0
push 0x422c10
push 0x422c80
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x410de9
push 0x4000c
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x410e14
xor eax, eax
jmp 0x410e14
push 0
push 0x422c10
push 0xbc00
push 0x49d170
call fcn.0040e010
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x410e14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410e19
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a8e50
push 0x422c10
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 8], 0
je 0x410ecc
mov eax, dword [ebp + 8]
push eax
push 0x422c80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a8e5c
push 0x422c80
call fcn.0041a84c
add esp, 8
push 0
push 0x422c80
call fcn.0041fbfb
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x410ecc
mov eax, dword [ebp - 8]
push eax
call fcn.0041d99d
add esp, 4
push 0
push 0x422c10
push 0x422c80
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x410ec5
push 0x4000c
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x410ef0
xor eax, eax
jmp 0x410ef0
push 0
push 0x422c10
push 0xb08e
push 0x4920e0
call fcn.0040e010
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x410ef0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410ef5
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00415721
test eax, eax
jne 0x410f12
xor eax, eax
jmp 0x410fe0
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a8e68
push 0x422c10
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 8], 0
je 0x410fbc
mov eax, dword [ebp + 8]
push eax
push 0x422c80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a8e78
push 0x422c80
call fcn.0041a84c
add esp, 8
push 0
push 0x422c80
call fcn.0041fbfb
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x410fbc
mov eax, dword [ebp - 8]
push eax
call fcn.0041d99d
add esp, 4
push 0
push 0x422c10
push 0x422c80
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x410fb5
push 0x4000c
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x410fe0
xor eax, eax
jmp 0x410fe0
push 0
push 0x422c10
push 0xd200
push 0x484ee0
call fcn.0040e010
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x410fe0
pop edi
pop esi
pop ebx
leave
ret