joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4156a4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x64]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 8
push esi
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
call fcn.0058e700
add esp, 0xc
test edi, edi
jne 0x4156df
xor eax, eax
jmp 0x4157ac
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4156d8
push dword [ebp + 0x10]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.004700a1
add esp, 0x10
test eax, eax
jne 0x415719
push str.GetFileVersion_failed._n
push str.CInitInfoStorage::GetVersionString
push 5
call fcn.00424dad
add esp, 0xc
jmp 0x4156d8
push esi
push esi
push 3
push esi
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x415747
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0x5c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x58]
movzx eax, cx
push eax
movzx eax, word [ebp - 0x54]
shr ecx, 0x10
push ecx
push eax
movzx eax, word [ebp - 0x4e]
push eax
movzx eax, word [ebp - 0x52]
push eax
lea eax, [ebp - 0x44]
push str._02d__02d__04d___d._d._d._d
push eax
call fcn.004069d2
add esp, 0x24
cmp word [ebp - 0x44], si
je 0x41579d
lea eax, [ebp - 0x44]
push eax
call fcn.0058edd4
pop ecx
mov esi, eax
push esi
lea ecx, [ebp - 0x44]
push ecx
mov ecx, ebx
call fcn.00404be0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41adf9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x5c59f8
mov ebx, str.CInitInfoStorage::IsEnablePortSelect
mov edi, ecx
push ebx
push 5
call fcn.00424dad
add esp, 0xc
cmp dword [edi + 0x4538], 0
jne 0x41ae44
push str.this_class_instance_has_not_been_initialized_yet._n
push ebx
push 2
call fcn.00424dad
push 0x5c5a30
push ebx
push 5
call fcn.00424dad
add esp, 0x18
xor eax, eax
jmp 0x41afc6
mov ecx, edi
call fcn.00413a83
and eax, 0x30000
cmp eax, 0x10000
jne 0x41ae62
mov eax, dword [edi + 0xa54]
jmp 0x41afc6
push esi
push 0x5c7230
mov ecx, edi
call fcn.0040bed1
push 0x5c723c
mov ecx, edi
mov esi, eax
call fcn.0040bed1
test esi, esi
je 0x41ae88
xor ecx, ecx
cmp cx, word [esi]
jne 0x41ae93
test eax, eax
je 0x41aeb5
xor ecx, ecx
cmp cx, word [eax]
je 0x41aeb5
push str._Enable_PRINT_or_FAX_._n
push ebx
push 4
call fcn.00424dad
push 0x5c5a14
push ebx
push 5
call fcn.00424dad
add esp, 0x18
jmp 0x41b008
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0x5c7230
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.0040ec3b
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [eax]
mov dword [ebp - 8], esi
jmp 0x41af21
cmp dword [esi + 0x108], 0
je 0x41aef7
push str.in_box
lea ecx, [esi + 0xf8]
call fcn.0041fdbb
test eax, eax
jne 0x41af41
cmp dword [esi + 0x2c], 1
jne 0x41af16
cmp dword [esi + 0x60], 0
je 0x41af16
add esi, 0x50
cmp dword [esi + 0x14], 8
jb 0x41af0e
mov esi, dword [esi]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x41af4b
lea ecx, [ebp - 8]
call fcn.004212e4
mov esi, dword [ebp - 8]
cmp esi, dword [ebp - 4]
jne 0x41aeda
push 0x5c723c
lea eax, [ebp - 4]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040ec3b
mov esi, dword [eax]
mov dword [ebp - 8], esi
jmp 0x41af9c
push str._Enable_PRINT___Preinstall_._n
jmp 0x41afd8
push str._Enable_PRINT___ExistInf_._n
jmp 0x41afd8
cmp dword [esi + 0x108], 0
je 0x41af72
push str.in_box
lea ecx, [esi + 0xf8]
call fcn.0041fdbb
test eax, eax
jne 0x41afcc
cmp dword [esi + 0x2c], 1
jne 0x41af91
cmp dword [esi + 0x60], 0
je 0x41af91
add esi, 0x50
cmp dword [esi + 0x14], 8
jb 0x41af89
mov esi, dword [esi]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x41afd3
lea ecx, [ebp - 8]
call fcn.004212e4
mov esi, dword [ebp - 8]
cmp esi, dword [ebp - 4]
jne 0x41af55
push str._Disable_PRINT_or_FAX_._n
mov esi, str.CInitInfoStorage::IsEnablePortSelect
push esi
push 4
call fcn.00424dad
push 0x5c5a14
push esi
push 5
call fcn.00424dad
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push str._Enable_FAX___Preinstall_._n
jmp 0x41afd8
push str._Enable_FAX___ExistInf_._n
mov esi, str.CInitInfoStorage::IsEnablePortSelect
push esi
push 4
call fcn.00424dad
push dword [edi + 0xa54]
push str._ULONG_m_nSelectPort
push esi
push 4
call fcn.00424d53
push 0x5c5a14
push esi
push 5
call fcn.00424dad
add esp, 0x28
mov eax, dword [edi + 0xa54]
jmp 0x41afc5
Function at 0x41b010
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
xor edi, edi
mov dword [ebp - 0x208], ebx
push 0
mov dword [ebp - 0x20c], eax
inc edi
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call ebx
cmp eax, 0xffffffff
je 0x41b140
push dword [ebp - 0x20c]
call ebx
cmp eax, 0xffffffff
je 0x41b140
push 0x40
push 0x5c5118
push dword [ebp - 0x208]
call fcn.0058eded
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x41b08a
push 0x6e
jmp 0x41b142
push 0x40
push 0x5c5118
push dword [ebp - 0x20c]
call fcn.0058eded
add esp, 0xc
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x41b0b2
push ebx
call fcn.0058f1d2
pop ecx
jmp 0x41b083
mov esi, dword [ebp - 0x208]
mov eax, 0x100
push ebx
push eax
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.0058f434
push esi
push 0x100
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.0058f434
add esp, 0x20
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x20c], eax
jne 0x41b12c
push 0x100
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00590446
add esp, 0xc
test eax, eax
jne 0x41b12c
mov eax, 0x100
cmp dword [ebp - 0x20c], eax
jne 0x41b12e
cmp dword [ebp - 0x208], eax
je 0x41b0bd
jmp 0x41b12e
xor edi, edi
push ebx
call fcn.0058f1d2
push esi
call fcn.0058f1d2
pop ecx
pop ecx
mov eax, edi
jmp 0x41b146
push 2
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret
Function at 0x41b278
Capabilities:
Read file on windows

Disassembly:
push 0x230
mov eax, 0x5af67b
call fcn.0058f792
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x23c], eax
test edi, edi
jne 0x41b2a3
xor eax, eax
inc eax
jmp 0x41b439
push 0x40
push 0x5c5118
push eax
call fcn.0058eded
mov esi, eax
add esp, 0xc
xor eax, eax
test esi, esi
je 0x41b439
push 2
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.0058e700
push esi
push 1
lea eax, [ebp - 0x238]
push 2
push eax
call fcn.0058f434
add esp, 0x1c
test eax, eax
jne 0x41b2f3
push esi
call fcn.0058f1d2
xor eax, eax
jmp 0x41b438
cmp byte [ebp - 0x238], 0xff
jne 0x41b3c8
cmp byte [ebp - 0x237], 0xfe
jne 0x41b3c8
xor ecx, ecx
mov dword [ebp - 0x220], 7
xor eax, eax
mov dword [ebp - 0x224], ecx
mov word [ebp - 0x234], ax
push 0x20a
mov dword [ebp - 4], ecx
push ecx
jmp 0x41b38c
cmp word [ebp - 0x21c], 0
jne 0x41b341
xor eax, eax
jmp 0x41b34e
lea eax, [ebp - 0x21c]
push eax
call fcn.0058edd4
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00404be0
xor eax, eax
cmp word [edi], ax
je 0x41b36f
push edi
call fcn.0058edd4
pop ecx
push eax
xor eax, eax
lea ecx, [ebp - 0x234]
push eax
push edi
call fcn.00420923
cmp eax, 0xffffffff
jne 0x41b3b3
push 0x20a
xor eax, eax
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0058e700
push esi
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.005924f1
add esp, 0x18
test eax, eax
jne 0x41b333
jmp 0x41b3b6
xor ebx, ebx
inc ebx
xor eax, eax
lea ecx, [ebp - 0x234]
push eax
push 1
call fcn.00404970
jmp 0x41b430
push esi
call fcn.0058f1d2
push 0x40
push 0x5c5fac
push dword [ebp - 0x23c]
call fcn.0058eded
mov esi, eax
add esp, 0x10
xor eax, eax
test esi, esi
je 0x41b439
jmp 0x41b400
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.00591f41
pop ecx
pop ecx
test eax, eax
jne 0x41b42d
push 0x20a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0058e700
push esi
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.005924f1
add esp, 0x18
test eax, eax
jne 0x41b3ed
jmp 0x41b430
xor ebx, ebx
inc ebx
push esi
call fcn.0058f1d2
mov eax, ebx
pop ecx
call fcn.0058f741
ret
Function at 0x41cac6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
xor edi, edi
push 8
push edi
push eax
mov ebx, edi
call fcn.0058e700
push edi
push edi
push edi
push edi
push edi
push edi
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00592b69
push 0x5c4f0c
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.00591c0a
add esp, 0x3c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41cb33
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
jmp 0x41cb4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetDiskFreeSpaceEx_failed.__0x_1_lx___n
push str.MyGetDiskFreeSpace
push 2
call fcn.00424dad
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
mov edx, ebx
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret

Function at 0x41dad4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41daff
xor eax, eax
jmp 0x41db77
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeShutdownPrivilege
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 2
pop esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 8], esi
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebx
push ebx
push ebx
mov esi, eax
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
pop ebx
jne 0x41db74
push str.ExitWindowsEx_failed._n
push str.RestartWindows
push 2
call fcn.00424dad
add esp, 0xc
jmp 0x41dafb
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret
Function at 0x42b69b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x5cca70
push str.CDeviceInf::Init
push 5
mov esi, ecx
call fcn.00424dad
add esp, 0xc
cmp dword [esi + 0xc], 0
jne 0x42b88e
cmp dword [esi + 8], 0
jne 0x42b88e
test ebx, ebx
jne 0x42b6f1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x42b8b1
push dword [ebp + 0xc]
push ebx
call fcn.00591dbe
pop ecx
pop ecx
test eax, eax
je 0x42b6e2
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42b713
push 2
jmp 0x42b893
lea edi, [esi + 0x14]
push ebx
mov ecx, edi
call fcn.00404bb9
cmp dword [edi + 0x14], 8
jb 0x42b728
mov eax, dword [edi]
jmp 0x42b72a
mov eax, edi
push eax
lea ecx, [esi + 0x34]
call fcn.0046dd35
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.0058e700
push 0x10
lea ebx, [esi + 0x31c]
push 0
push ebx
call fcn.0058e700
push 8
lea eax, [esi + 0x324]
push 0
push eax
call fcn.0058e700
add esp, 0x24
cmp dword [edi + 0x14], 8
jb 0x42b76b
mov edi, dword [edi]
push 0
push 0x20
lea eax, [ebp - 0x44]
push eax
push ebx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetINFClassW]
test eax, eax
jne 0x42b79f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetupDiGetINFClass_failed.__0x_1_lX___n
push str.CDeviceInf::Init
push 2
call fcn.00424dad
add esp, 0x10
jmp 0x42b6ea
lea eax, [ebp - 0x44]
push eax
push str.ClassName____1_s___n
push str.CDeviceInf::Init
push 5
call fcn.00424dad
add esp, 0x10
cmp word [ebp - 0x44], 0
jne 0x42b7c2
xor eax, eax
jmp 0x42b7cc
lea eax, [ebp - 0x44]
push eax
call fcn.0058edd4
pop ecx
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [esi + 0x32c]
call fcn.00404be0
movzx eax, byte [esi + 0x32b]
push eax
movzx eax, byte [esi + 0x32a]
push eax
movzx eax, byte [esi + 0x329]
push eax
movzx eax, byte [esi + 0x328]
push eax
movzx eax, byte [esi + 0x327]
push eax
movzx eax, byte [esi + 0x326]
push eax
movzx eax, byte [esi + 0x325]
push eax
movzx eax, byte [esi + 0x324]
push eax
movzx eax, word [esi + 0x322]
push eax
movzx eax, word [esi + 0x320]
push eax
push dword [ebx]
lea eax, [ebp - 0xc4]
push str.GUID___08lX__04lX__04lx__02X_02X__02X_02X_02X_02X_02X_02X_n
push eax
call fcn.00425561
lea eax, [ebp - 0xc4]
push eax
push str.GUID___1_s__n
push str.CDeviceInf::Init
push 5
call fcn.00424dad
mov eax, dword [ebp + 0x10]
xor edi, edi
inc edi
mov dword [esi + 0x10], eax
add esp, 0x44
mov dword [esi + 8], edi
cmp dword [ebp + 0x14], 0
je 0x42b89b
push edi
mov ecx, esi
call sym.SETUP.exe_public:_int___thiscall_CDeviceInf::GetFullInfo_int_
test eax, eax
jne 0x42b89b
push str.CManufacturers_object_creation_failed._n
push str.CDeviceInf::Init
push 2
call fcn.00424dad
add esp, 0xc
jmp 0x42b899
push 0x3e8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
push 0x5cca8c
push str.CDeviceInf::Init
push 5
call fcn.00424dad
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42b8c4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x5cca70
mov ebx, str.CDeviceInfSection::Init
mov esi, ecx
push ebx
push 5
call fcn.00424dad
add esp, 0xc
cmp dword [esi + 0x68], 0
je 0x42b8f8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x42b9d7
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x42b90f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pInfFile_is_NULL._n
jmp 0x42b98c
push dword [ebp + 0xc]
push edi
call fcn.00591dbe
pop ecx
pop ecx
test eax, eax
jne 0x42b92d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pInfFile_is_Zero_length._n
jmp 0x42b98c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42b948
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pInfFile_is_not_found._n
jmp 0x42b98c
push edi
lea ecx, [esi + 0x1c]
call fcn.00404bb9
push edi
lea ecx, [esi + 0x34]
call fcn.00404bb9
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x42b970
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pSectionName_is_NULL._n
jmp 0x42b98c
push dword [ebp + 0x18]
push edi
call fcn.00591dbe
pop ecx
pop ecx
test eax, eax
jne 0x42b9ab
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pSectionName_is_Zero_length._n
push ebx
push 5
call fcn.00424dad
add esp, 0xc
push 0x5cca8c
push ebx
push 5
call fcn.00424dad
add esp, 0xc
xor eax, eax
jmp 0x42b9d6
push edi
lea ecx, [esi + 0x4c]
call fcn.00404bb9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42b9be
mov dword [esi + 0x64], eax
push 0x5cca8c
xor edi, edi
push ebx
inc edi
push 5
mov dword [esi + 0x68], edi
call fcn.00424dad
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x42bac6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0x5cca70
mov ebx, str.CIniSections::Init
mov edi, ecx
push ebx
push 5
call fcn.00424dad
add esp, 0xc
cmp dword [edi + 0x28], 0
je 0x42bafa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x42bb89
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x42bb11
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pInfFile_is_NULL._n
jmp 0x42bb48
push dword [ebp + 0xc]
push esi
call fcn.00591dbe
pop ecx
pop ecx
test eax, eax
jne 0x42bb2f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pInfFile_is_Zero_length._n
jmp 0x42bb48
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42bb67
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.pInfFile_is_not_found._n
push ebx
push 5
call fcn.00424dad
add esp, 0xc
push 0x5cca8c
push ebx
push 5
call fcn.00424dad
add esp, 0xc
xor eax, eax
jmp 0x42bb88
push esi
lea ecx, [edi + 0x10]
call fcn.00404bb9
push 0x5cca8c
xor esi, esi
push ebx
inc esi
push 5
mov dword [edi + 0x28], esi
call fcn.00424dad
add esp, 0xc
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x42bb8f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.SETUP.exe_public:_int___thiscall_CDeviceInfSection::Init_wchar_t_const___unsigned_int__class_CInfStringTable___wchar_t_const___unsigned_int_

Function at 0x42c059
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x5ccab8
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x42c0ff
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.Setup
push dword [ebp - 4]
call esi
test eax, eax
jne 0x42c0bf
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
push str.runonce
push 1
push 0
push str.Wrapper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x42c0c1
xor esi, esi
push 0x16
push str.grpconv__o
push 1
push 0
push str.GrpConv
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], 0
je 0x42c0fd
push 1
push str.runonce__r
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4365c4
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x5b0bd4
call fcn.0058f75f
mov edi, ecx
mov dword [ebp - 0x14], edi
lea ebx, [edi + 4]
mov dword [edi], vtable.CChangeDir.0
xor esi, esi
mov dword [ebx + 0x14], 7
xor eax, eax
mov dword [ebx + 0x10], esi
mov word [ebx], ax
lea ecx, [edi + 0x1c]
mov dword [ebp - 4], esi
call fcn.0046f9cd
push esi
push 0x5c4f10
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00404be0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x31
push str...CommonFileUtil.cpp
mov dword [ebp - 0x10], eax
lea ecx, [eax + eax]
push ecx
call fcn.0045a88d
mov esi, eax
add esp, 0xc
test esi, esi
je 0x436648
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
mov ecx, ebx
call fcn.00404bb9
push esi
call fcn.0045a8a4
pop ecx
mov eax, edi
call fcn.0058f72d
ret

Function at 0x4366b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x1c
mov eax, 0x5b0c1d
call fcn.0058f792
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push str.pFileName___1_lS__n
mov esi, str.FILEEXISTW
mov edi, eax
push esi
push 5
call fcn.00424dad
push edi
push str.dwRet__0x_1_lx_._n
push esi
push 5
call fcn.00424dad
add esp, 0x20
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00404f5d
xor eax, eax
cmp edi, 0xffffffff
setne al
call fcn.0058f741
ret

Function at 0x43671f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push eax
xor esi, esi
call fcn.00593ad4
mov edi, eax
mov dword [ebp - 0x90], edi
pop ecx
test edi, edi
je 0x4367d8
push ebx
call fcn.00593ad4
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4367c6
push 0x88
lea eax, [ebp - 0x8c]
push esi
push eax
call fcn.0058e700
add esp, 0xc
lea eax, [ebp - 0x8c]
push esi
push eax
push edi
call sub.LZ32.dll_LZOpenFileW
mov edi, eax
lea eax, [ebp - 0x8c]
push 0x1000
push eax
push ebx
call sub.LZ32.dll_LZOpenFileW
mov esi, eax
push esi
push edi
call sub.LZ32.dll_LZCopy
xor ecx, ecx
test eax, eax
push edi
setns cl
mov dword [ebp - 0x94], ecx
call sub.LZ32.dll_LZClose
push esi
call sub.LZ32.dll_LZClose
mov esi, dword [ebp - 0x94]
mov edi, dword [ebp - 0x90]
push edi
call fcn.00593b27
pop ecx
test ebx, ebx
je 0x4367d8
push ebx
call fcn.00593b27
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret
Function at 0x43683a
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, str.FU_GetTempDirName
push 0x5cf814
push ebx
push 5
xor esi, esi
call fcn.00424dad
add esp, 0xc
test edi, edi
jne 0x436885
push 0x5cf84c
push ebx
push 5
call fcn.00424dad
add esp, 0xc
xor eax, eax
jmp 0x43697b
push 0x208
push 0
push edi
call fcn.0058e700
mov ebx, 0x20a
lea eax, [ebp - 0x41c]
push ebx
push 0
push eax
call fcn.0058e700
push ebx
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0058e700
add esp, 0x24
xor ebx, ebx
lea eax, [ebp - 0x41c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4369a1
lea eax, [ebp - 0x210]
push eax
push 0
push 0x5ca1f8
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x43698c
cmp eax, 0x6f
je 0x43698c
lea eax, [ebp - 0x210]
push eax
push str.szTempDir
push str.FU_GetTempDirName
push 4
call fcn.00424d8f
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4369a1
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
je 0x4369a1
lea eax, [ebp - 0x210]
push eax
push 0x104
push edi
call fcn.00591d62
add esp, 0xc
push esi
push str._ULONG_bRet
mov ebx, str.FU_GetTempDirName
push ebx
push 4
call fcn.00424d53
push 0x5cf830
push ebx
push 5
call fcn.00424dad
add esp, 0x1c
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret
push eax
push str._ULONG_uiRet
push str.FU_GetTempDirName
push 2
call fcn.00424d53
add esp, 0x10
inc ebx
cmp ebx, 0x3e8
jl 0x4368ba
jmp 0x436956