joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
je 0x493d6b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x373], 0
jne 0x493d6b
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x373], 1
xor edx, edx
push ebp
push 0x48fc3c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x36d], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004933ac
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00491474
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x373], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004933ac
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
mov edx, 2
call fcn.005b6b08
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004933ac
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor edx, edx
call fcn.005b6b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fcfc
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x372], 0
jne 0x493e24
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 1
xor edx, edx
push ebp
push 0x48fcf5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x365], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004933ac
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00491474
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [eax + 0x372], dl
cmp byte [ebp - 5], 0
je 0x493de3
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fcfc
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493e2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 1
xor ecx, ecx
push ebp
push 0x48fed3
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x238], 0
je 0x493ec2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x373], 0
je 0x493ec2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor ecx, ecx
mov edx, 2
call fcn.005b6b08
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x74]
xor ecx, ecx
xor edx, edx
call fcn.005b6b08
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x36d]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00491474
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x493fc1
mov eax, dword [ebp - 4]
mov byte [eax + 0x373], 0
jmp 0x493fc1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x371], 0
je 0x493ef4
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004938d8
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x493fc1
mov eax, dword [ebp - 4]
mov byte [eax + 0x371], 0
jmp 0x493fc1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x372], 0
je 0x493fc1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x365]
mov ecx, edx
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.00491474
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x493fc1
mov eax, dword [ebp - 4]
mov byte [eax + 0x372], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
test eax, eax
je 0x493fc1
mov esi, dword [eax + 0x244]
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x493fc1
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.0053cbdc
cmp eax, dword [ebp - 4]
je 0x493fbd
mov edx, ebx
mov eax, esi
call fcn.0053cbdc
mov edx, dword [0x488028]
call fcn.0055f068
test al, al
je 0x493fbd
mov edx, ebx
mov eax, esi
call fcn.0053cbdc
mov edx, dword [0x488028]
call fcn.0055f08c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00494070
test al, al
je 0x493fbd
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x371], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x330]
cmp byte [eax + 0x2b], 0
je 0x493fc1
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x493fc1
inc ebx
dec edi
jne 0x493f51
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48feda
mov eax, dword [ebp - 4]
mov byte [eax + 0x345], 0
ret

Function at 0x55e774
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x69bb28], 0x8088405
inc edx
mov dword [ebx + 0x69bb28], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x55e790
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x69bb28], 0x8088405
inc edx
mov dword [ebx + 0x69bb28], edx
fld qword [ebx + 0x69bb78]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret
Function at 0x590fd8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x590fde
ret
Function at 0x4015f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push edi
push eax
push 0xf003f
push 0
push str.SOFTWARE
push 0x80000002
call esi
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.rcdrvinfo
push eax
call edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SOFTWARE_rcdrvinfo
push 0x80000002
call esi
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.geniusdog
push eax
call edi
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push 0
push str.build_no
push edx
mov dword [esp + 0x34], 2
call ebp
mov edi, str.2002_01_02
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x24]
push ecx
push 1
push eax
push str.product_time
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [0x41d8a8]
lea eax, [edx - 4]
cmp eax, 4
ja case.default.0x40171d
jmp dword [eax*4 + 0x401850]
mov eax, dword [esp + 0x124]
push 0
push eax
call fcn.00401870
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x124]
push 1
push ecx
call fcn.00401870
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
mov edx, dword [esp + 0x124]
push 0
push edx
call fcn.00401c30
add esp, 8
mov edi, eax
push 0x2710
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov esi, dword [esp + 0x124]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 2
je 0x4017aa
cmp esi, 3
jne 0x4017c6
push 0x7d0
call edi
push 0x7d0
call edi
push 0xbb8
call edi
push 0xbb8
call edi
push 1
push esi
call fcn.00401c30
add esp, 8
cmp esi, 2
mov ebx, eax
je 0x4017dd
cmp esi, 3
jne 0x4017e4
push 0x2710
call edi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x110
ret
mov esi, dword [esp + 0x124]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 2
je 0x401808
cmp esi, 3
jne 0x40180f
push 0x2710
call ebx
push 2
push esi
call fcn.00401c30
add esp, 8
cmp esi, 2
mov edi, eax
je 0x40182a
cmp esi, 3
jne 0x401786
push 0x2710
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
pop edi
pop esi
pop ebp
mov eax, 0xbbd
pop ebx
add esp, 0x110
ret
Function at 0x4020f0
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x104
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, 0x41dab0
push str.RT_RCDATA
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41c31c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x11c]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 2
push 0
push 0
lea ecx, [esp + 0x28]
push 0xc0000000
push ecx
mov ebp, eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x402201
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x402201
lea edx, [esp + 0x14]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x28]
push 0xc0000000
push eax
call ebx
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push 0
call ebx
lea ecx, [esp + 0x10]
push 0
push ecx
push edi
push 0
mov dword [esp + 0x20], eax
call ebx
push eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x402240
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWARE_rcdrvinfogeniusdog
push 0x80000002
call edi
test eax, eax
jne 0x4022bf
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.build_no
push ecx
call esi
mov edx, dword [esp + 8]
push str.package_time
push edx
call esi
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.SOFTWARE_rcdrvinfo
push 0x80000002
call edi
mov edx, dword [esp + 8]
push str.geniusdog
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 8]
push eax
call esi
mov eax, dword [0x41d8a8]
cmp eax, 4
jne 0x4022d7
push 0
call fcn.00402350
add esp, 4
pop edi
pop esi
pop ecx
ret
cmp eax, 5
jne 0x4022ea
push 1
call fcn.00402350
add esp, 4
pop edi
pop esi
pop ecx
ret
cmp eax, 6
jne 0x402300
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
push 0
jmp 0x40232a
cmp eax, 7
jne 0x402316
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
push 1
jmp 0x40232a
cmp eax, 8
jne 0x402341
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
push 2
call fcn.00402650
add esp, 4
mov edi, eax
push 0x2710
call esi
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret
Function at 0x402650
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x30c
lea eax, [esp + 0x104]
push ebp
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esp + 0x318]
cmp eax, 1
je 0x402680
cmp eax, 2
jne 0x402780
push ebx
push edi
call fcn.00404240
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x114]
lea edx, [esp + 0x10]
push ecx
push edx
call edi
lea eax, [esp + 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push str.drivers_rcugawdm.sys
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10]
push edx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4026f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4026f6
lea eax, [esp + 0x10]
push 0x80
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
call esi
lea edx, [esp + 0x218]
lea eax, [esp + 0x10]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
push str.inf_rcugawdm.inf
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
call esi
test eax, eax
jne 0x40273a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40273a
lea eax, [esp + 0x10]
push 0x80
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
call esi
lea edx, [esp + 0x218]
lea eax, [esp + 0x10]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
push str.inf_rcugawdm.pnf
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
call esi
pop edi
pop ebx
test eax, eax
jne 0x402780
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x402780
lea eax, [esp + 8]
push 0x80
push eax
call ebp
lea ecx, [esp + 8]
push ecx
call esi
mov edx, dword [str.rgga]
mov eax, dword [str.rgga.SYS]
push edx
push eax
call fcn.004029a0
add esp, 8
lea ecx, [esp + 0x10c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0x10b]
pop esi
cmp cl, 0x5c
pop ebp
je 0x4027d4
mov byte [esp + eax + 0x104], 0x5c
mov byte [esp + eax + 0x105], 0
xor eax, eax
add esp, 0x30c
ret
Function at 0x4027e0
Capabilities:
Create service
Persist via windows service
Query service status
Start service

Disassembly:
sub esp, 0x11c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov edi, 0x41dab0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x130]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x402829
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x11c
ret
mov edi, str.drivers_rgga.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf003f
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0
push 0
mov edi, eax
push 0
push 0
lea eax, [esp + 0x3c]
push 0
push eax
push 1
push 2
push 1
push 0xf01ff
push str.rgga
push str.rgga
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x402902
push 0
push 0
push esi
call ebx
test eax, eax
je 0x4028ff
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
je 0x4028e6
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x4028d5
push 0x64
call ebp
jmp 0x4028da
cmp eax, 4
je 0x4028e6
lea edx, [esp + 0x10]
push edx
push esi
call ebx
test eax, eax
jne 0x4028c6
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret
push esi
call ebp
push 0xf01ff
push str.rgga
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40292c
push edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 0xbb9
pop ebx
add esp, 0x11c
ret
push 0
push 0
push esi
call ebx
test eax, eax
je 0x402980
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
je 0x40296d
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x40295c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402961
cmp eax, 4
je 0x40296d
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
jne 0x402949
push esi
call ebp
push edi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret
push esi
call ebp
push edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 0xbba
pop ebx
add esp, 0x11c
ret
Function at 0x4029a0
Capabilities:
Delete file
Delete service
Get common file path
Query service status
Stop service

Disassembly:
sub esp, 0x120
lea eax, [esp + 0x1c]
push ebp
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x24]
push str.drivers_
push ecx
call esi
mov edx, dword [esp + 0x12c]
lea eax, [esp + 0x24]
push edx
push eax
call esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x4029fc
pop esi
mov eax, 1
pop ebp
add esp, 0x120
ret
mov ecx, dword [esp + 0x130]
push 0xf01ff
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x402a25
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
add esp, 0x120
ret
push ebx
lea edx, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_ControlService]
push edx
push 1
push esi
call edi
test eax, eax
jne 0x402a49
lea eax, [esp + 0x10]
push eax
push 1
push esi
call edi
test eax, eax
je 0x402a7b
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
je 0x402a7b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], 3
jne 0x402a7b
push 0x3e8
call ebx
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x402a61
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebx
test eax, eax
jne 0x402aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
add esp, 0x120
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
pop esi
xor eax, eax
pop ebp
add esp, 0x120
ret
Function at 0x4036c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x416738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [esp]
mov dword [esp + 4], 8
push eax
push 1
push 0
push str.SOFTWARE_rcdrvinfogeniusdog
push 0x80000002
mov dword [esp + 0x20], 0x14
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403744
mov ecx, dword [0x41c6a8]
mov dword [esp + 0x28], ecx
push 0x70
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0
call fcn.004103c2
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00410145
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 8]
push edi
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.build_no
push edx
mov dword [esp + 0x28], 4
call esi
mov ecx, dword [esp + 0x30]
mov edi, eax
lea eax, [esp + 0x14]
lea edx, [esp + 0x18]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push 0
push str.product_time
push eax
mov dword [esp + 0x30], 1
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
cmp eax, 2
jne 0x4037c4
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
jae 0x4037cb
mov edi, 2
cmp eax, 2
jbe 0x4037d5
mov edi, 3
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x404250
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
push esi
push edi
push str.setupapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x404377
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetupDiGetClassDevsA
push esi
call edi
test eax, eax
mov dword [0x41dbc0], eax
je 0x404377
push str.SetupDiDestroyDeviceInfoList
push esi
call edi
test eax, eax
mov dword [0x41dbc4], eax
je 0x404377
push str.SetupDiEnumDeviceInfo
push esi
call edi
test eax, eax
mov dword [0x41dbbc], eax
je 0x404377
push str.SetupDiRemoveDevice
push esi
call edi
test eax, eax
mov dword [0x41dbb8], eax
je 0x404377
push str.SetupDiCallClassInstaller
push esi
call edi
test eax, eax
mov dword [0x41dbb4], eax
je 0x404377
push 4
push 0
push str.USBVid_08e2Pid_0005
push 0
call dword [0x41dbc0]
mov edi, eax
test edi, edi
je 0x404377
cmp edi, 0xffffffff
je 0x404377
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ebx, 4
xor esi, esi
add ebx, ebx
cmp esi, ebx
jae 0x404306
mov eax, ebp
mov dword [esp + 0x10], 0x1c
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x10]
push eax
push esi
push edi
mov dword [esp + 0x2c], edx
call dword [0x41dbbc]
test al, al
je 0x404352
lea ecx, [esp + 0x10]
push ecx
push edi
push 5
call dword [0x41dbb4]
jmp 0x40435f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x404366
inc esi
cmp esi, ebx
jb 0x40430c
jmp 0x404306
push edi
call dword [0x41dbc4]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret