joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4206e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e6a5
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 1
jne 0x42071f
call fcn.00424b80
test eax, eax
jne 0x42071f
jmp 0x420941
mov al, byte [0x433086]
mov byte [ebp - 0x45c], al
push 0x103
push 0
lea ecx, [ebp - 0x45b]
push ecx
call fcn.004097d0
add esp, 0xc
push 0x43a078
lea ecx, [ebp - 0x478]
call fcn.004012e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x494]
call fcn.004012b0
mov byte [ebp - 4], 1
mov dword [ebp - 0x354], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x498], eax
push 0x104
push 0
lea edx, [ebp - 0x224]
push edx
call fcn.004097d0
add esp, 0xc
lea ecx, [ebp - 0x478]
call fcn.004014a0
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00409b50
add esp, 8
lea ecx, [ebp - 0x224]
push ecx
call fcn.00415fdb
add esp, 4
lea edx, [ebp - 0x224]
push edx
push str.The_Monitor1_Name_is_:_s
call fcn.0042a0d0
add esp, 8
cmp dword [ebp - 0x498], 0
jne 0x420802
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x494]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.00401360
jmp 0x420941
lea eax, [ebp - 0x354]
push eax
mov ecx, dword [ebp - 0x498]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x420913
push 0x104
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.004097d0
add esp, 0xc
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00409b50
add esp, 8
lea edx, [ebp - 0x11c]
push edx
call fcn.00415fdb
add esp, 4
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.00415d01
add esp, 8
test eax, eax
je 0x420897
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x224]
push eax
call fcn.00404ea0
add esp, 8
test eax, eax
je 0x4208f5
lea ecx, [ebp - 0x494]
call fcn.004014a0
push eax
push str.The_monitor_name2_is__s
call fcn.0042a0d0
add esp, 8
push str.get_same_process
call fcn.0042a0d0
add esp, 4
mov ecx, dword [ebp - 0x34c]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x49c], eax
push 0
mov edx, dword [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420913
lea ecx, [ebp - 0x354]
push ecx
mov edx, dword [ebp - 0x498]
push edx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x228], eax
jmp 0x42081b
mov eax, dword [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x494]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.00401360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret
Function at 0x420bf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x80
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.004097d0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x8c], 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80
lea edx, [ebp - 0x88]
push edx
push 0x4398c8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x420c72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
push edx
push str.GetPrivateProfileString_failed_Error_Code:_d
call fcn.0042a070
add esp, 8
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.004013a0
mov ecx, dword [ebp + 0x14]
push ecx
push str.This_value_is_not_found
call fcn.004031b0
add esp, 8
movzx edx, al
test edx, edx
je 0x420c9d
xor eax, eax
jmp 0x420ca2
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret
Function at 0x420cb0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x420d05
push 0x439760
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x420e59
cmp dword [ebp - 0x2c], 4
jne 0x420d1f
push str.Service_has_been_started
call fcn.0042a0d0
add esp, 4
mov al, 1
jmp 0x420e59
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x420d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, 0x44342c
call fcn.004014a0
push eax
push str.error_happens_during_starting_a_service:__s_Error_Code:_d
call fcn.0042a070
add esp, 0xc
xor al, al
jmp 0x420e59
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x420d96
push 0x4397d4
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x420e59
cmp dword [ebp - 0x2c], 2
jne 0x420e31
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e8
jae 0x420dc1
mov dword [ebp - 8], 0x3e8
jmp 0x420dd1
cmp dword [ebp - 8], 0x2710
jbe 0x420dd1
mov dword [ebp - 8], 0x2710
mov edx, dword [ebp - 8]
push edx
push str.ChangeSrvStatusToRuning_sleep_:_d
call fcn.0042a0d0
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x420e03
jmp 0x420e31
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 4]
jbe 0x420e1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
jmp 0x420e2c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jbe 0x420e2c
jmp 0x420e31
jmp 0x420d96
cmp dword [ebp - 0x2c], 4
jne 0x420e4a
push str.StartService_SUCCESS._n
call fcn.0042a0d0
add esp, 4
mov al, 1
jmp 0x420e59
push str.StartService_fail._n
call fcn.0042a070
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x420e60
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x420e7a
mov ecx, dword [ebp - 0x10]
cmp dword [ecx], 0
jne 0x420e81
xor eax, eax
jmp 0x420fa4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x420f54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x420eb4
push str.LockServiceDatabase_fail
call fcn.0042a070
add esp, 4
push 0x10c
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420ed7
push str.LocalAlloc_is_fail
call fcn.0042a070
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
push 0x10c
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusA]
test eax, eax
jne 0x420f0b
push str.QueryServiceLockStatus
call fcn.0042a0d0
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x420f30
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
push str.Locked_by:__s__duration:__d_seconds_n
call fcn.0042a0d0
add esp, 0xc
jmp 0x420f3d
push str.No_longer_locked_n
call fcn.0042a0d0
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.Could_not_lock_database
call fcn.0042a0d0
add esp, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x420f88
push str.ChangeServiceConfig_fail
call fcn.0042a070
add esp, 4
push str.ChangeServiceConfig_SUCCESS_n
call fcn.0042a0d0
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x420fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x25c], ecx
mov ecx, dword [ebp + 8]
call fcn.00403b30
movzx eax, al
test eax, eax
je 0x421023
push str.Not_specify_the_service_name_.
call fcn.0042a0d0
add esp, 4
push str.C:WINDOWS_system32
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.004013e0
push 0x439590
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.00401750
push 0x439594
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.004013e0
jmp 0x4210c7
lea ecx, [ebp - 0x258]
push ecx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x4210b6
push 0x4395a8
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x258]
push eax
mov ecx, 0x443448
call fcn.004013a0
push 0x4395b8
mov ecx, 0x443448
call fcn.00401750
push 0x4395bc
lea ecx, [ebp - 0x258]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x4395d0
mov ecx, 0x44342c
call fcn.004013a0
lea edx, [ebp - 0x258]
push edx
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.004013a0
push str.Get_path_successfully_where_the_service_in_.
call fcn.0042a0d0
add esp, 4
jmp 0x4210c7
push str.Get_path_fail_where_the_service_in_.
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x42113d
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.004014a0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jne 0x421112
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.004014a0
push eax
push str.Not_find_the_service_application_:__s__
call fcn.0042a070
add esp, 8
xor al, al
jmp 0x42113d
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x25c]
add ecx, 8
call fcn.004014a0
push eax
push str.Find_the_service_application_:__s__
call fcn.0042a0d0
add esp, 8
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret 4
Function at 0x421290
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
push 1
call fcn.004206e0
add esp, 4
mov eax, dword [ebp - 0x34]
cmp dword [eax], 0
jne 0x4212c9
push str.Couldnt_open_service_manager
call fcn.0042a070
add esp, 4
jmp 0x421488
mov ecx, dword [ebp - 0x34]
cmp dword [ecx + 4], 0
jne 0x421314
push 0xf01ff
mov ecx, 0x44342c
call fcn.004014a0
push eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x34]
cmp dword [edx + 4], 0
jne 0x421314
push str.Couldnt_open_service
call fcn.0042a070
add esp, 4
jmp 0x421488
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x20]
push eax
push 4
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x421467
cmp dword [ebp - 0x1c], 4
jne 0x4213ed
push str.Service_state_is_SERVICE_RUNNING.
call fcn.0042a0d0
add esp, 4
lea eax, [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x421390
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0x438fc0
call fcn.0042a070
add esp, 8
jmp 0x421488
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4213d0
push 0x438fe8
call fcn.0042a0d0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
jmp 0x421488
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
jmp 0x421488
cmp dword [ebp - 0x1c], 1
jne 0x421451
push str.Service_state_is_SERVICE_STOPPED.
call fcn.0042a0d0
add esp, 4
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x42143a
push str.Uninstall_service_successfully.
call fcn.0042a0d0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], ecx
jmp 0x421488
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], edx
jmp 0x421488
push str.Service_state_isnt_SERVICE_RUNNING_or_SERVICE_STOPPED_it_is_other_state_.we_dont_delete_it
call fcn.0042a0d0
add esp, 4
mov dword [ebp - 4], 1
jmp 0x421488
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
push str.Notify_SERVICE_CONTROL_INTERROGATE_failed.Error_Code:_d.
call fcn.0042a070
add esp, 8
mov ecx, dword [ebp - 0x34]
call fcn.004202a0
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x4214a0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x4214ee
push 0x10020
mov ecx, 0x44342c
call fcn.004014a0
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0
jne 0x4214ee
push 0x438c54
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x421568
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x421515
push 0x438c6c
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x421568
lea eax, [ebp - 4]
push eax
push 0x1000
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x421544
push str.QueryServiceConfig_failed.
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x421568
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.QueryServiceConfig_successfully.
call fcn.0042a0d0
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x421ac0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f71f
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x85], 0
mov ecx, 0x4434d0
call fcn.00403bd0
push 0x64
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.004097d0
add esp, 0xc
lea ecx, [ebp - 0x84]
push ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x84]
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0xa4]
call fcn.004012b0
mov dword [ebp - 4], 0
jmp 0x421b54
mov eax, dword [ebp - 0x10]
push eax
call fcn.00409690
add esp, 4
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x421bcf
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 5
jne 0x421bca
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa4]
call fcn.004013a0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004203a0
add esp, 4
movzx edx, al
test edx, edx
je 0x421bca
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x4434d0
call fcn.00403b50
mov byte [ebp - 0x85], 1
lea ecx, [ebp - 0xa4]
call fcn.004014a0
push eax
push str.Find_New_Driver_Path:_s_______
call fcn.0042a0d0
add esp, 8
jmp 0x421b3e
mov cl, byte [ebp - 0x85]
mov byte [ebp - 0xa9], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.00401360
mov al, byte [ebp - 0xa9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret
Function at 0x421c10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f752
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x4434b8
call fcn.00403bd0
push 0x64
push 0
lea eax, [ebp - 0x8c]
push eax
call fcn.004097d0
add esp, 0xc
lea ecx, [ebp - 0x8c]
push ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x8c]
mov dword [ebp - 0x14], edx
jmp 0x421c96
mov eax, dword [ebp - 0x14]
push eax
call fcn.00409690
add esp, 4
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x421cfc
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0xac]
call fcn.004012e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.004014a0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 5
jne 0x421ce8
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x4434b8
call fcn.00403b50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.00401360
jmp 0x421c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret
Function at 0x423350
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f839
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 4], 0
call fcn.00424aa0
test eax, eax
jne 0x4233b5
mov dword [ebp - 0x15c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401360
mov eax, dword [ebp - 0x15c]
jmp 0x42354d
push 0x43ae20
call fcn.0042a0d0
add esp, 4
mov dword [ebp - 0x13c], 0
lea ecx, [ebp - 0x138]
call fcn.004012b0
mov byte [ebp - 4], 1
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.004097d0
add esp, 0xc
lea ecx, [ebp - 0x138]
push ecx
call fcn.00427030
add esp, 4
test eax, eax
je 0x423510
push str.DCSHelper.exe
lea ecx, [ebp - 0x138]
call fcn.004013e0
lea ecx, [ebp - 0x138]
call fcn.004014a0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x423510
lea ecx, [ebp - 0x158]
call fcn.004012b0
mov byte [ebp - 4], 2
push 0x43ae34
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x178]
push eax
call fcn.00403570
add esp, 0xc
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a4], ecx
mov byte [ebp - 4], 3
lea edx, [ebp + 8]
push edx
mov eax, dword [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x194]
push ecx
call fcn.00403600
add esp, 0xc
mov dword [ebp - 0x1a8], eax
mov edx, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x158]
call fcn.00401380
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x194]
call fcn.00401360
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x178]
call fcn.00401360
push 1
lea ecx, [ebp - 0x158]
call fcn.004014a0
push eax
lea ecx, [ebp - 0x138]
call fcn.004014a0
push eax
call fcn.004267f0
add esp, 0xc
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x158]
call fcn.00401360
push 0x43ae38
call fcn.0042a0d0
add esp, 4
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x198], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401360
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x425440
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e491
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 0x22c
lea eax, [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x260]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x470], eax
xor edx, edx
mov word [ebp - 0x46c], dx
push 0x206
push 0
lea eax, [ebp - 0x46a]
push eax
call fcn.004097d0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x46c]
push edx
call fcn.00409b27
add esp, 8
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004015f0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x470], 0
je 0x4255b3
push 0x104
push 0
lea ecx, [ebp - 0x46c]
push ecx
call fcn.004097d0
add esp, 0xc
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x46c]
push eax
call fcn.00409b27
add esp, 8
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x48c]
call fcn.004015f0
lea ecx, [ebp - 0x48c]
call fcn.004016b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004016b0
push eax
call fcn.00416151
add esp, 8
test eax, eax
jne 0x42558a
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x490], 1
lea ecx, [ebp - 0x48c]
call fcn.00401670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401670
mov eax, dword [ebp - 0x490]
jmp 0x4255df
lea eax, [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x260]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x470], eax
lea ecx, [ebp - 0x48c]
call fcn.00401670
jmp 0x4254e5
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x494], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401670
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret