joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411fb9
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov dword [ebp - 0x604], 0
mov dword [ebp - 0x608], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x5c2e60], eax
cmp dword [0x5c2e60], 0
jne 0x412015
push 0x20001
call fcn.00406ccc
add esp, 4
push 0x2008001
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4121cc
cmp dword [ebp + 0xc], 0
je 0x412040
mov eax, dword [ebp + 0xc]
push eax
push 0x5c2a40
call fcn.004202d0
add esp, 8
push 0x533c08
push 0x5c2a40
call fcn.004202e0
add esp, 8
jmp 0x412062
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533c0c
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
lea ecx, [ebp - 0x600]
push ecx
call fcn.004202d0
add esp, 8
push 0x533c18
lea edx, [ebp - 0x600]
push edx
call fcn.004202e0
add esp, 8
push 0x5c2a40
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push 0x533c28
lea ecx, [ebp - 0x200]
push ecx
call fcn.004202e0
add esp, 8
push 0x533c30
lea edx, [ebp - 0x200]
push edx
call fcn.004202e0
add esp, 8
mov eax, dword [ebp + 8]
and eax, 2
test eax, eax
je 0x4120f1
lea ecx, [ebp - 0x200]
push ecx
push 0x533c38
mov edx, dword [0x5c2e60]
push edx
call fcn.00411b37
add esp, 0xc
mov dword [ebp - 0x604], eax
mov eax, dword [ebp + 8]
and eax, 1
test eax, eax
je 0x412125
cmp dword [ebp - 0x604], 0
jne 0x412125
lea ecx, [ebp - 0x600]
push ecx
push 0x533c40
mov edx, dword [0x5c2e60]
push edx
call fcn.00411b37
add esp, 0xc
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x604], 0xffffffff
je 0x412137
cmp dword [ebp - 0x608], 0xffffffff
jne 0x412155
mov eax, dword [0x5c2e60]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2008006
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4121cc
mov ecx, dword [0x5c2e60]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0
jne 0x412190
push 0x20002
call fcn.00406ccc
add esp, 4
push 0x2008001
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4121cc
push 0x533c4c
lea edx, [ebp - 0x400]
push edx
call fcn.004202d0
add esp, 8
push 0x533c78
lea eax, [ebp - 0x400]
push eax
call fcn.004202e0
add esp, 8
lea ecx, [ebp - 0x400]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412389
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 4]
push eax
push 0x533ca8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4123f6
cmp dword [ebp - 8], 5
jne 0x4123d4
push 0x2010000
call fcn.00406c68
add esp, 4
push 0
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4124c9
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4124c9
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesHaspCheck
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x200
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Aladdin_TestX.ttt
lea eax, [ebp - 0x208]
push eax
call fcn.004202e0
add esp, 8
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x4124ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jne 0x41248c
push 0x2010000
call fcn.00406c68
add esp, 4
push 0
call fcn.00406ccc
add esp, 4
jmp 0x4124a6
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4124c9
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call fcn.00408b00
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4129d2
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x533da4
push 0x5c2e80
call fcn.004202d0
add esp, 8
push str.PcmciaDataBaseAladdin_Knowledge_Systems_Ltd.PC_CardHASP_V1.1
push 0x5c2e80
call fcn.004202e0
add esp, 8
push 0x5c2c40
push 0x5c2e80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412a1c
xor eax, eax
jmp 0x412a81
push 0x533e08
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 7
push 0x533e10
push 1
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412a72
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412a81
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412a9e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533e6c
push 0x5c2a40
call fcn.004202e0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
je 0x412b05
xor eax, eax
jmp 0x412b40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x412b3e
cmp dword [ebp - 0x208], 3
je 0x412b3e
cmp dword [ebp - 0x208], 5
jne 0x412b39
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412b40
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412b44
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533e78
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533e84
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533e8c
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
je 0x412bc1
xor eax, eax
jmp 0x412c4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x412bfa
cmp dword [ebp - 0x208], 3
je 0x412bfa
cmp dword [ebp - 0x208], 5
jne 0x412bf5
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412c4c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00420150
add esp, 4
test eax, eax
je 0x412c4a
mov edx, dword [ebp + 8]
push edx
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x412c4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x412c4a
cmp dword [ebp - 0x208], 5
jne 0x412c45
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412c4c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412c50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533e94
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533e98
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533ea0
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x412cd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x412cd2
cmp dword [ebp - 4], 5
jne 0x412ccd
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412cd4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412cd8
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533ea8
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533eac
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x412d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x412d48
cmp dword [ebp - 4], 5
jne 0x412d43
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412d4a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412d4e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Drivers_
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533ec4
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
je 0x412db9
xor eax, eax
jmp 0x412e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x412df2
cmp dword [ebp - 0x208], 3
je 0x412df2
cmp dword [ebp - 0x208], 5
jne 0x412ded
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412e44
mov ecx, dword [ebp + 8]
push ecx
call fcn.00420150
add esp, 4
test eax, eax
je 0x412e42
mov edx, dword [ebp + 8]
push edx
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x412e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
je 0x412e42
cmp dword [ebp - 0x208], 5
jne 0x412e3d
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412e44
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412e48
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533ed4
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533ed8
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x412eb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x412eb8
cmp dword [ebp - 4], 5
jne 0x412eb3
push 0x4000b
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412eba
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41327b
Capabilities:
Check if file exists
Get common file path
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov byte [ebp - 0x550], 0
cmp dword [ebp + 8], 0
je 0x4132de
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xffffffff
je 0x4132de
mov ecx, dword [ebp - 0x34c]
and ecx, 0x10
test ecx, ecx
je 0x4132de
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x550]
push eax
call fcn.004202d0
add esp, 8
push 0x533f60
lea ecx, [ebp - 0x550]
push ecx
call fcn.004202e0
add esp, 8
movsx edx, byte [ebp - 0x550]
test edx, edx
jne 0x41330f
push 0x200
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533f64
lea ecx, [ebp - 0x550]
push ecx
call fcn.004202e0
add esp, 8
push 0x533f70
lea edx, [ebp - 0x550]
push edx
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x550]
push eax
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x4133a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4133a8
push 0x200
push 0x5c2c60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533f80
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x533f8c
push 0x5c2c60
call fcn.004202e0
add esp, 8
push str..sy_
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x5c2c60
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [ebp - 0x550]
push edx
call fcn.00408b00
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x413456
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.004202d0
add esp, 8
push 0x533fa0
lea edx, [ebp - 0x208]
push edx
call fcn.004202e0
add esp, 8
push 0x533fa4
lea eax, [ebp - 0x208]
push eax
call fcn.004202e0
add esp, 8
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x413456
push 0
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x413445
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413502
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413502
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x550]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x413495
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413502
push 0
lea edx, [ebp - 4]
push edx
push 0x70c00
push 0x4c0654
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x4134d2
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413502
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x413500
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413502
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413c93
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53407c
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x534080
push 0x5c2a40
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x413d7c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202d0
add esp, 8
push 0x53408c
lea edx, [ebp - 0x204]
push edx
call fcn.004202e0
add esp, 8
push str.haspdos.sys
lea eax, [ebp - 0x204]
push eax
call fcn.004202e0
add esp, 8
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x413d7c
push 0
push 0x5c2a40
lea eax, [ebp - 0x204]
push eax
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x413d6b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413e46
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413e46
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x413dbc
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413e46
push 0
lea eax, [ebp - 0x208]
push eax
push 0x17f
push 0x532c54
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413e0a
mov edx, dword [0x5c2a24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413e46
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413e44
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413e46
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x413e4a
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
cmp dword [0x43004c], 0
jne 0x413e63
xor eax, eax
jmp 0x4140ae
cmp dword [0x430048], 0
jne 0x413e73
xor eax, eax
jmp 0x4140ae
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x198]
push ecx
call fcn.00404ad0
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x413ea0
mov eax, dword [ebp - 0xd0]
jmp 0x4140ae
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x413f23
push 0x53409c
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x413f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x413f23
push 0x4000d
call fcn.00406ccc
add esp, 4
push 0x2020001
call fcn.00406c68
add esp, 4
mov dword [ebp - 0xd0], 0xffffffff
mov eax, dword [ebp - 0xd0]
jmp 0x4140ae
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x413f50
push 0x5340ac
push 0x5c2a40
call fcn.004202e0
add esp, 8
jmp 0x413f62
push 0x5340bc
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5340c8
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
mov edx, dword [ebp + 8]
push edx
call fcn.0041424f
add esp, 8
cmp eax, 0xffffffff
jne 0x413f9f
push 0x2004012
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4140ae
push 0x200
push 0x5c3120
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x194], 3
jne 0x413fcc
push 0x5340d4
push 0x5c3120
call fcn.004202e0
add esp, 8
jmp 0x413fde
push 0x5340e4
push 0x5c3120
call fcn.004202e0
add esp, 8
push 0x5340ec
push 0x5c3120
call fcn.004202e0
add esp, 8
mov eax, dword [ebp - 0x194]
push eax
push 0x5c3120
mov ecx, dword [ebp + 8]
push ecx
call fcn.004140b2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x414022
push 0x2004013
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4140ae
cmp dword [ebp - 0x194], 3
jne 0x414090
cmp dword [0x5bc8a4], 0
jne 0x414090
push 0x200
push 0x5c3120
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5340f8
push 0x5c3120
call fcn.004202e0
add esp, 8
push 0x534108
push 0x5c3120
call fcn.004202e0
add esp, 8
push 0x5c3120
mov edx, dword [ebp + 8]
push edx
call fcn.004143be
add esp, 8
cmp eax, 0xffffffff
jne 0x414090
push 0x200401e
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x4140ae
cmp dword [ebp - 0x194], 3
jne 0x4140ac
call fcn.004153d5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4140ac
or eax, 0xffffffff
jmp 0x4140ae
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41424f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
cmp dword [ebp + 8], 0
je 0x4142f0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202d0
add esp, 8
push 0x534120
lea edx, [ebp - 0x204]
push edx
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4142f0
push 0
push 0x5c2a40
lea edx, [ebp - 0x204]
push edx
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x4142df
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4143ba
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4143ba
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x41432f
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4143ba
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004089ef
push eax
push 0x4300d8
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x41437e
mov edx, dword [0x5c2a24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4143ba
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4143b8
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4143ba
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4143be
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
cmp dword [ebp + 8], 0
je 0x41445f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202d0
add esp, 8
push str._aksusb.cat
lea edx, [ebp - 0x204]
push edx
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41445f
push 0
push 0x5c3120
lea edx, [ebp - 0x204]
push edx
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x41444e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414529
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x414529
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x41449e
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414529
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00408a04
push eax
push 0x436188
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4144ed
mov edx, dword [0x5c2a24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414529
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x414527
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x414529
xor eax, eax
mov esp, ebp
pop ebp
ret