joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f5f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403675
and dword [ebp - 4], 0
cmp dword [0x41da48], 0
mov ebx, eax
jne 0x40500e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4050bf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4050bf
push eax
call fcn.00403606
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41da48], eax
call esi
push eax
call fcn.00403606
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41da4c], eax
call esi
push eax
call fcn.00403606
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41da50], eax
call esi
push eax
call fcn.00403606
pop ecx
mov dword [0x41da58], eax
test eax, eax
je 0x40500e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403606
pop ecx
mov dword [0x41da54], eax
mov eax, dword [0x41da54]
cmp eax, ebx
je 0x405066
cmp dword [0x41da58], ebx
je 0x405066
push eax
call fcn.0040367e
push dword [0x41da58]
mov esi, eax
call fcn.0040367e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405066
test edi, edi
je 0x405066
call esi
test eax, eax
je 0x40505d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40505d
test byte [ebp - 0xc], 1
jne 0x405066
or dword [ebp + 0x10], 0x200000
jmp 0x40509f
mov eax, dword [0x41da4c]
cmp eax, ebx
je 0x40509f
push eax
call fcn.0040367e
pop ecx
test eax, eax
je 0x40509f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40509f
mov eax, dword [0x41da50]
cmp eax, ebx
je 0x40509f
push eax
call fcn.0040367e
pop ecx
test eax, eax
je 0x40509f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41da48]
call fcn.0040367e
pop ecx
test eax, eax
je 0x4050bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4050c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408927
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004052a5
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp byte [ebp - 4], 0
je 0x408957
mov ecx, dword [ebp - 8]
and dword [ecx + 0x70], 0xfffffffd
leave
ret
Function at 0x40bdef
Capabilities:
Get geographical location

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004038f7
mov ebp, dword [esp + 0x14]
mov esi, eax
xor ebx, ebx
add esi, 0x9c
cmp ebp, ebx
jne 0x40be16
or dword [esi + 8], 0x104
jmp 0x40bec7
lea eax, [ebp + 0x40]
lea edi, [esi + 4]
mov dword [esi], ebp
mov dword [edi], eax
cmp eax, ebx
je 0x40be38
cmp byte [eax], bl
je 0x40be38
push edi
push 0x16
push 0x41a458
call fcn.0040b808
add esp, 0xc
mov eax, dword [esi]
mov dword [esi + 8], ebx
cmp eax, ebx
je 0x40be8c
cmp byte [eax], bl
je 0x40be8c
mov eax, dword [edi]
cmp eax, ebx
je 0x40be56
cmp byte [eax], bl
je 0x40be56
call fcn.0040bd4c
jmp 0x40be5b
call fcn.0040bdb3
cmp dword [esi + 8], ebx
jne 0x40bedc
push esi
push 0x40
push 0x41a250
call fcn.0040b808
add esp, 0xc
test eax, eax
je 0x40bed3
mov edi, dword [edi]
cmp edi, ebx
je 0x40be85
cmp byte [edi], bl
je 0x40be85
call fcn.0040bd4c
jmp 0x40bed3
call fcn.0040bdb3
jmp 0x40bed3
mov edi, dword [edi]
cmp edi, ebx
je 0x40bec0
cmp byte [edi], bl
je 0x40bec0
push edi
call fcn.00401ae0
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x40b989
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x40bed3
mov dword [esi + 8], ebx
jmp 0x40bed3
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], ebx
je 0x40bfc8
mov ecx, ebp
sub ebp, 0xffffff80
neg ecx
sbb ecx, ecx
and ecx, ebp
mov edi, esi
call fcn.0040b87c
mov ebx, eax
test ebx, ebx
je 0x40bfc8
cmp ebx, 0xfde8
je 0x40bfc8
cmp ebx, 0xfde9
je 0x40bfc8
movzx eax, bx
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x40bfc8
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x40bfc8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40bf50
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], bx
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40bfc3
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x40bf8d
push str.Norwegian_Nynorsk
push 0x40
push edi
call fcn.004051ea
add esp, 0xc
test eax, eax
je 0x40bf9e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00404206
add esp, 0x14
jmp 0x40bf9e
push 0x40
push edi
push 0x1001
push dword [esi + 0x18]
call ebp
test eax, eax
je 0x40bfc8
push 0x40
lea eax, [edi + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call ebp
test eax, eax
je 0x40bfc8
push 0xa
push 0x10
sub edi, 0xffffff80
push edi
push ebx
call fcn.0041041a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x40bfca
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret
Function at 0x401a3b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42bbd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x438db4]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov ecx, dword [0x438db4]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], ecx
mov edx, dword [0x438db4]
mov dword [esi + 0xc], edx
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 2
call fcn.0041fde6
mov eax, dword [0x438db4]
mov dword [esi + 0x24], eax
mov ecx, dword [0x438db4]
mov dword [esi + 0x28], ecx
mov edx, dword [0x438db4]
mov dword [esi + 0x2c], edx
mov eax, dword [0x438db4]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0x42d678
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov ecx, dword [0x438db4]
mov dword [esi + 0x80], ecx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x20], 9
mov dword [esi], 0x42d674
call fcn.00401bf0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x401af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42bc4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x42d674
lea ecx, [edi + 0x80]
mov dword [esp + 0x1c], 8
call fcn.00420763
lea ebx, [edi + 0x34]
mov dword [esp + 0x10], ebx
mov dword [ebx], 0x42d678
mov esi, dword [ebx + 4]
mov byte [esp + 0x1c], 9
test esi, esi
je 0x401b6c
mov eax, dword [ebx + 8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x401b60
push ebp
lea ebp, [eax + 1]
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx]
add esi, 0x10
dec ebp
jne 0x401b51
pop ebp
mov ebx, dword [ebx + 4]
push ebx
call fcn.00420c28
add esp, 4
lea ecx, [edi + 0x30]
mov byte [esp + 0x1c], 6
call fcn.00420763
lea ecx, [edi + 0x2c]
mov byte [esp + 0x1c], 5
call fcn.00420763
lea ecx, [edi + 0x28]
mov byte [esp + 0x1c], 4
call fcn.00420763
lea ecx, [edi + 0x24]
mov byte [esp + 0x1c], 3
call fcn.00420763
lea ecx, [edi + 0x10]
mov byte [esp + 0x1c], 2
call fcn.0041fe19
lea ecx, [edi + 0xc]
mov byte [esp + 0x1c], 1
call fcn.00420763
lea ecx, [edi + 8]
mov byte [esp + 0x1c], 0
call fcn.00420763
lea ecx, [edi + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00420763
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x403020
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.00410360
mov byte [eax], bl
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jne 0x40307b
mov byte [esp + 0x12], bl
mov edi, str.PPSPInputs.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
and ecx, 3
push 1
push str.Display
rep movsb byte es:[edi], byte [esi]
push str.DisplayError
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
mov dword [ebp + 0xc0], eax
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x4032e6
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x403345
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call edi
test eax, eax
jne 0x403345
mov eax, dword [0x43acf0]
test eax, eax
je 0x40333a
push 0
push 0
push str.Error_In_Getting_OS_Version_Information_
call fcn.004278e1
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret
mov ecx, dword [esp + 0x18]
mov eax, 1
cmp ecx, 2
jne 0x40336f
mov ecx, dword [esp + 0xc]
cmp ecx, 5
jne 0x403399
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], 0
pop edi
pop esi
add esp, 0x9c
ret
cmp ecx, eax
jne 0x4033a4
cmp dword [esp + 0xc], 4
jne 0x4033a4
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x4033a4
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
pop edi
pop esi
add esp, 0x9c
ret
cmp ecx, 6
jne 0x4033a4
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x403760
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
push esi
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esi + 4]
test eax, eax
jne 0x403851
lea ecx, [esp + 0x108]
push edi
push ecx
lea edx, [esp + 0xc]
push str._sMosusbsr.sys
push edx
call fcn.004103cb
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0xc
lea eax, [esp + 8]
push 0x80
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
push ecx
call edi
lea edx, [esp + 0x10c]
lea eax, [esp + 8]
push edx
push str._sMosusrpt.vxd
push eax
call fcn.004103cb
add esp, 0xc
lea ecx, [esp + 8]
push 0x80
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
lea eax, [esp + 0x10c]
lea ecx, [esp + 8]
push eax
push str._sMosuprpt.vxd
push ecx
call fcn.004103cb
add esp, 0xc
lea edx, [esp + 8]
push 0x80
push edx
call esi
lea eax, [esp + 8]
push eax
call edi
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push str._sMcsenum.vxd
push edx
call fcn.004103cb
add esp, 0xc
lea eax, [esp + 8]
push 0x80
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
pop edi
pop esi
add esp, 0x208
ret
lea edx, [esp + 0x108]
lea eax, [esp + 4]
push edx
push str._sdriversMosUPort.sys
push eax
call fcn.004103cb
add esp, 0xc
lea ecx, [esp + 4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
add esp, 0x208
ret
Function at 0x403fa0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42bfbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x54]
call fcn.00401000
push esi
push 0x4041b0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x190], 0
call fcn.004019b0
mov eax, dword [0x438db4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x188], 3
call fcn.004016b0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x7c]
push 0x104
push eax
mov byte [esp + 0x190], 4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.inf
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.004208ec
push str..inf
lea ecx, [esp + 0x14]
push str._s
push ecx
call fcn.0041fabb
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x58]
add esp, 0xc
or al, 0x10
mov edi, 0x927
mov esi, 1
or edx, edi
or al, 0x20
push str.mosuport.sys
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0x20], eax
call fcn.004208ec
lea ecx, [esp + 0x54]
call fcn.00401990
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x58]
call fcn.00401110
lea ecx, [esp + 0x54]
call fcn.004019d0
lea eax, [esp + 0x7c]
lea ecx, [esp + 0xc]
push eax
call fcn.004208ec
push str..inf
lea ecx, [esp + 0x14]
push str._s
push ecx
call fcn.0041fabb
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x58]
add esp, 0xc
or al, 0x10
or esi, edi
or al, 0x20
push str.MOSUPRPT.vxd
lea ecx, [esp + 0x18]
mov dword [esp + 0x50], esi
mov dword [esp + 0x20], eax
call fcn.004208ec
lea ecx, [esp + 0x54]
call fcn.00401990
lea edx, [esp + 0xc]
lea ecx, [esp + 0x54]
push edx
call fcn.00401110
lea ecx, [esp + 0x54]
call fcn.004019d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x188], 6
call fcn.00420763
lea ecx, [esp + 0x10]
mov byte [esp + 0x188], 5
call fcn.00420763
lea ecx, [esp + 0xc]
mov byte [esp + 0x188], 0
call fcn.00420763
lea ecx, [esp + 0x54]
mov dword [esp + 0x188], 0xffffffff
call fcn.00401050
mov ecx, dword [esp + 0x180]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x180
ret
Function at 0x404280
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x30c
lea eax, [esp + 0x104]
push esi
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x20c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esi + 4]
test eax, eax
jne 0x4042f3
lea edx, [esp + 0x108]
lea eax, [esp + 4]
push edx
push str._sSystemMosUsbPrintConfig.exe
push eax
call fcn.004103cb
add esp, 0xc
lea ecx, [esp + 4]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
add esp, 0x30c
ret
push ebx
lea eax, [esp + 0x210]
push edi
push eax
lea ecx, [esp + 0x10]
push str._sdriversMosUPort.sys
push ecx
call fcn.004103cb
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0xc
lea edx, [esp + 0xc]
push 0x80
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push str._sinfMosUPort.inf
push edx
call fcn.004103cb
add esp, 0xc
lea eax, [esp + 0xc]
push 0x80
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0x110]
lea eax, [esp + 0xc]
push edx
push str._sinfMosUPort.PNF
push eax
call fcn.004103cb
add esp, 0xc
lea ecx, [esp + 0xc]
push 0x80
push ecx
call edi
lea edx, [esp + 0xc]
push edx
call ebx
push str.SystemCurrentControlSetEnumCMC
mov ecx, esi
call fcn.00405dc0
push str.SystemCurrentControlSetEnumCMC
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00405f20
push str.SystemCurrentControlSetServicesMosPort
mov ecx, esi
call fcn.00405dc0
push str.SystemCurrentControlSetServicesMosPort
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00405f20
push str.SystemCurrentControlSetServicesMosPort.Sys
mov ecx, esi
call fcn.00405dc0
push str.SystemCurrentControlSetServicesMosPort.Sys
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.00405f20
pop edi
pop ebx
pop esi
add esp, 0x30c
ret
Function at 0x404f40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x58
mov eax, dword [ecx + 4]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
je 0x4050cb
push str.SystemCurrentControlSetControlCOM_Name_Arbiter
call fcn.00405dc0
lea eax, [esp + 0xc]
push eax
push 0xf003f
push ebx
push str.SystemCurrentControlSetControlCOM_Name_Arbiter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4050cb
mov ecx, 8
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push ebx
mov edi, 0x20
push str.ComDB
push ecx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x404fe3
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x58
ret
cmp dword [esp + 0x14], 3
jne 0x4050c0
cmp dword [esp + 0x10], ebx
je 0x4050c0
lea eax, [esp + 0x10]
push ebp
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.ComDB_Merge
push eax
mov dword [esp + 0x2c], edi
call esi
mov ebx, 1
lea esi, [ebx - 1]
lea edi, [ebx - 1]
shr esi, 3
and edi, 7
mov al, byte [esp + esi + 0x28]
lea ebp, [esp + esi + 0x28]
test al, al
je 0x405079
mov edx, 1
mov ecx, edi
shl edx, cl
test dl, al
mov dword [esp + 0x24], edx
je 0x405079
mov ecx, dword [esp + 0x20]
push ebx
call fcn.00405fc0
test eax, eax
je 0x405079
mov cl, byte [esp + 0x24]
mov al, byte [esp + esi + 0x48]
test cl, al
jne 0x405079
mov al, byte [ebp]
mov dl, 1
mov ecx, edi
mov dword [esp + 0x1c], 1
shl dl, cl
not dl
and al, dl
mov byte [ebp], al
inc ebx
cmp ebx, 0x100
jbe 0x40501e
mov eax, dword [esp + 0x1c]
pop ebp
test eax, eax
je 0x4050ae
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x24]
push 0x20
push eax
push 3
push 0
push str.ComDB
push ecx
mov dword [esp + 0x28], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x58
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x58
ret
Function at 0x4059e0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4059f8
mov esi, str.EnumUSB
jmp 0x405a05
mov esi, str.SystemCurrentControlSetEnumUSB
mov ecx, ebx
push esi
call fcn.00405dc0
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b29
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
mov esi, 1
call edi
test eax, eax
jne 0x405b14
push 0x11
lea eax, [esp + 0x18]
push str.Vid_9710Pid_7705
push eax
call fcn.00410469
add esp, 0xc
test eax, eax
je 0x405adb
push 0x11
lea ecx, [esp + 0x18]
push str.Vid_9710Pid_7710
push ecx
call fcn.00410469
add esp, 0xc
test eax, eax
je 0x405adb
push 0x11
lea edx, [esp + 0x18]
push str.Vid_9710Pid_7715
push edx
call fcn.00410469
add esp, 0xc
test eax, eax
je 0x405adb
push 0x11
lea eax, [esp + 0x18]
push str.Vid_9710Pid_7720
push eax
call fcn.00410469
add esp, 0xc
test eax, eax
je 0x405adb
push 0x11
lea ecx, [esp + 0x18]
push str.Vid_9710Pid_7717
push ecx
call fcn.00410469
add esp, 0xc
test eax, eax
je 0x405adb
push 0x11
lea edx, [esp + 0x18]
push str.Vid_9710Pid_7719
push edx
call fcn.00410469
add esp, 0xc
test eax, eax
jne 0x405af7
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, ebx
call fcn.00405f20
test eax, eax
je 0x405af7
sub esi, 2
jns 0x405af7
xor esi, esi
lea edx, [esp + 0x14]
mov eax, esi
push 0x104
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
inc esi
call edi
test eax, eax
je 0x405a4b
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, 2
je 0x405b72
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [0x43acf0]
test eax, eax
je 0x405b67
mov eax, dword [esp + 0xc]
push 0x40
push str.Registry_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebx
add esp, 0x10c
ret