joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c7e
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, str.VETUP32.DLL
push edi
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jae 0x403cbf
add edi, 8
push esi
push str._s_ERROR_INVALID_LIBRARY
push edi
call fcn.0040becd
add esp, 0xc
push 0x40
push 0x425048
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call fcn.0040be8d
push str.VNW9XUninstall32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403cdb
push dword [esp + 0x14]
push dword [esp + 0x14]
call eax
jmp 0x403ce5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret 8

Function at 0x403ceb
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, str.VETUP32.DLL
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jae 0x403d2c
add esi, 8
push edi
push str._s_ERROR_INVALID_LIBRARY
push esi
call fcn.0040becd
add esp, 0xc
push 0x40
push 0x425048
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call fcn.0040be8d
push str.VNW9XInstallTcpip32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403d40
call eax
jmp 0x403d4a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x403d4e
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, str.VETUP32.DLL
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jae 0x403d8f
add esi, 8
push edi
push str._s_ERROR_INVALID_LIBRARY
push esi
call fcn.0040becd
add esp, 0xc
push 0x40
push 0x425048
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call fcn.0040be8d
push str.VNW9XInstallSnmp32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403da3
call eax
jmp 0x403dad
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x403db1
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, str.VETUP32.DLL
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jae 0x403df2
add esi, 8
push edi
push str._s_ERROR_INVALID_LIBRARY
push esi
call fcn.0040becd
add esp, 0xc
push 0x40
push 0x425048
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call fcn.0040be8d
push str.VNW9XDetectTcpip32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403e06
call eax
jmp 0x403e10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x403e14
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, str.VETUP32.DLL
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jae 0x403e55
add esi, 8
push edi
push str._s_ERROR_INVALID_LIBRARY
push esi
call fcn.0040becd
add esp, 0xc
push 0x40
push 0x425048
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call fcn.0040be8d
push str.VNW9XDetectSnmp32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403e69
call eax
jmp 0x403e73
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x403e77
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, str.VETUP32.DLL
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, 0x20
jae 0x403eb8
add esi, 8
push edi
push str._s_ERROR_INVALID_LIBRARY
push esi
call fcn.0040becd
add esp, 0xc
push 0x40
push 0x425048
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call fcn.0040be8d
push str.VNW9XVerifyDeviceClass32
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403ed0
push dword [esp + 0x10]
call eax
jmp 0x403eda
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret 4

Function at 0x403ee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
mov edi, 0x80
lea eax, [ebp - 0x80]
push edi
push eax
call esi
lea eax, [ebp - 0x80]
push str.INFDRVDATA.BIN
push eax
call fcn.0040bb40
lea eax, [ebp - 0x80]
push eax
call fcn.0040c145
add esp, 0xc
lea eax, [ebp - 0x80]
push edi
push eax
call esi
lea eax, [ebp - 0x80]
push str.INFDRVIDX.BIN
push eax
call fcn.0040bb40
lea eax, [ebp - 0x80]
push eax
call fcn.0040c145
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x40425b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, 0x104
xor ebx, ebx
push edi
mov esi, 0x42a45c
push ebx
push esi
mov dword [ebp - 8], edi
call fcn.0040ba40
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4042b1
lea eax, [ebp - 8]
push eax
push esi
push ebx
push ebx
push str.SourcePath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0040c0a0
cmp byte [eax + 0x42a45b], 0x5c
pop ecx
je 0x4042d7
push 0x42503c
push esi
call fcn.0040bb40
pop ecx
pop ecx
push esi
call fcn.0040c0a0
test eax, eax
pop ecx
je 0x404313
push edi
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.0040ba40
add esp, 0xc
lea eax, [ebp - 0x10c]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x404313
lea eax, [ebp - 0x10c]
push eax
call fcn.0040a0c5
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x40431a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x42868c]
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call fcn.0040bb30
lea eax, [ebp - 0x104]
push 0x42503c
push eax
call fcn.0040c250
and byte [eax], 0
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop edi
leave
ret 4
Function at 0x4050e6
Capabilities:
Terminate process

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, ecx
push str.__CWinNT4::dwNT4SourcePathVerify__
call fcn.004013fd
cmp byte [0x4265e4], 0
pop ecx
je 0x4051e2
push str.Tcpip
mov ecx, edi
call fcn.00404e0d
test eax, eax
jne 0x4051e2
mov ecx, edi
call fcn.004051fa
mov esi, 0x42a45c
push esi
push str.CWinNT4.dwNT4SourcePathVerify_:__s
call fcn.004013fd
cmp byte [0x42a149], 0
pop ecx
pop ecx
jne 0x405148
push esi
mov ecx, edi
call fcn.00405277
mov ebp, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call ebp
mov ebx, 0x40000
mov dword [esp + 0x10], eax
push ebx
push str.TELNET.EXE
push esi
call fcn.00409fb5
add esp, 0xc
test eax, eax
jne 0x405181
push ebx
push str.REGEDIT.EXE
push esi
call fcn.00409fb5
add esp, 0xc
test eax, eax
je 0x4051dc
push esi
lea ecx, [edi + 0x4b0]
call fcn.00415d4f
mov eax, dword [edi + 0x314]
lea ecx, [edi + 0x314]
call dword [eax + 0xb8]
cmp eax, 1
je 0x4051dc
lea eax, [esp + 0x14]
push 0x104
push eax
push 0xc371
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40
lea eax, [esp + 0x18]
push 0x425048
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x10]
call ebp
push 1
call fcn.0040be8d
push dword [esp + 0x10]
call ebp
push 0x425e3c
call fcn.004013fd
pop ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret

Function at 0x4051fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, 0x104
push esi
push eax
mov esi, 0x42a45c
push 0
push esi
mov dword [ebp - 8], eax
call fcn.0040ba40
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40524c
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.SourcePath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0040c0a0
cmp byte [eax + 0x42a45b], 0x5c
pop ecx
je 0x405272
push 0x42503c
push esi
call fcn.0040bb40
pop ecx
pop ecx
xor eax, eax
pop esi
leave
ret

Function at 0x405277
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x42868c]
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call fcn.0040bb30
lea eax, [ebp - 0x104]
push 0x42503c
push eax
call fcn.0040c250
and byte [eax], 0
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop edi
leave
ret 4
Function at 0x405fe4
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push esi
push edi
xor esi, esi
push str.__vUpdate64
mov dword [ebp - 4], esi
call fcn.004013fd
lea eax, [ebp - 0x364]
mov dword [esp], 0x30c
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.VNUpdateDriverForPlugAndPlayDevices64
push str.VETUP64.DLL
lea eax, [ebp - 0x364]
push str.rundll32.exe
push eax
lea eax, [ebp - 0x364]
push str._s_s__s__s
push eax
call fcn.0040becd
push dword [ebp + 0xc]
lea eax, [ebp - 0x364]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x364]
push str._s____s____s_
push eax
call fcn.0040becd
mov edi, 0x42a150
lea eax, [ebp - 0x364]
push edi
push eax
push str.vUpdate64____s____s
call fcn.004013fd
push 0x44
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040ba40
add esp, 0x44
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], 0x44
push 0x10
push esi
push eax
call fcn.0040ba40
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x364]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4060c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Fail_CreateProcess_:_u
call fcn.004013fd
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push 0x4264e8
call fcn.004013fd
pop ecx
pop edi
pop esi
leave
ret 8
Function at 0x40618b
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push esi
push edi
xor esi, esi
push str.__vRemove64
mov dword [ebp - 4], esi
call fcn.004013fd
lea eax, [ebp - 0x364]
mov dword [esp], 0x30c
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.VNRemove64
push str.VETUP64.DLL
lea eax, [ebp - 0x364]
push str.rundll32.exe
push eax
lea eax, [ebp - 0x364]
push str._s_s__s__s
push eax
call fcn.0040becd
push dword [ebp + 8]
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x364]
push str._s____s_
push eax
call fcn.0040becd
mov edi, 0x42a150
lea eax, [ebp - 0x364]
push edi
push eax
push str.vRemove64____s____s
call fcn.004013fd
push 0x44
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040ba40
add esp, 0x40
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], 0x44
push 0x10
push esi
push eax
call fcn.0040ba40
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x364]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40626a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Fail_CreateProcess_:_u
call fcn.004013fd
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push 0x426598
call fcn.004013fd
pop ecx
pop edi
pop esi
leave
ret 4
Function at 0x407a90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.0040ba40
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x407ae5
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
push eax
call esi
test eax, eax
je 0x407bab
mov eax, dword [ebp - 0x8c]
dec eax
je 0x407b3c
dec eax
jne 0x407bab
cmp dword [ebp - 0x98], 4
ja 0x407b05
mov byte [0x42a141], 1
cmp dword [ebp - 0x98], 5
jne 0x407b31
cmp dword [ebp - 0x94], 0
je 0x407b23
mov byte [0x42a143], 1
jmp 0x407ba6
cmp dword [ebp - 0x98], 5
mov byte [0x42a142], 1
jbe 0x407ba6
mov byte [0x42a144], 1
jmp 0x407ba6
cmp dword [ebp - 0x98], 4
jne 0x407bab
cmp dword [ebp - 0x94], 0
je 0x407b84
cmp dword [ebp - 0x94], 0xa
je 0x407b69
cmp dword [ebp - 0x94], 0x5a
jne 0x407bab
mov byte [0x42a140], 1
jmp 0x407ba6
cmp byte [ebp - 0x87], 0x41
jne 0x407b7b
mov byte [0x42a13f], 1
jmp 0x407ba6
mov byte [0x42a13e], 1
jmp 0x407ba6
cmp byte [ebp - 0x87], 0x43
je 0x407b9f
cmp byte [ebp - 0x87], 0x42
je 0x407b9f
mov byte [0x42a13c], 1
jmp 0x407ba6
mov byte [0x42a13d], 1
push 1
pop eax
jmp 0x407bad
xor eax, eax
pop esi
leave
ret
Function at 0x4082b9
Capabilities:
Enumerate files on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov al, byte [0x42868c]
push esi
push edi
mov esi, ecx
push 0x1f
mov byte [ebp - 0x80], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.__bSearchInf:__s
stosb byte es:[edi], al
call fcn.004013fd
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.0040bb30
lea eax, [ebp - 0x100]
push 0x42666c
push eax
call fcn.0040bb40
lea eax, [ebp - 0x100]
push eax
push str.bSearchInf:_search__s
call fcn.004013fd
add esp, 0x20
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4083de
lea eax, [ebp - 0x214]
push eax
push str.bSearchInf:_check__s
call fcn.004013fd
pop ecx
lea eax, [ebp - 0x214]
pop ecx
push 4
push str.fni.
push eax
call fcn.0040ca30
pop ecx
push eax
call fcn.0040c8b9
add esp, 0xc
test eax, eax
jne 0x4083c8
lea eax, [ebp - 0x214]
push eax
call fcn.0040ca30
pop ecx
push eax
mov ecx, esi
push dword [ebp + 8]
call fcn.0040845f
test eax, eax
je 0x4083c8
lea eax, [ebp - 0x80]
push eax
call fcn.0040c0a0
test eax, eax
pop ecx
jne 0x4083bf
lea eax, [ebp - 0x214]
push eax
push str.bSearchInf:_found__s
call fcn.004013fd
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040bb30
add esp, 0x10
jmp 0x4083c8
cmp byte [0x4265e6], 0
jne 0x40841c
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40833b
lea eax, [ebp - 0x80]
push eax
call fcn.0040c0a0
test eax, eax
pop ecx
je 0x40844c
lea eax, [ebp - 0x80]
mov esi, 0x42a560
push eax
push esi
call fcn.0040bb30
lea eax, [ebp - 0x80]
push eax
push 0x42a768
call fcn.0040bb30
push esi
push str.__bSearchInf:_found__s__return_TRUE
call fcn.004013fd
add esp, 0x18
push 1
pop eax
jmp 0x408459
add esi, 0xc0
push 0x104
push esi
push 0xc359
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40
push 0x425048
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040be8d
push str.__bSearchInf:_return_FALSE
call fcn.004013fd
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x4090ac
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov al, byte [0x42868c]
push edi
push 0x40
mov byte [ebp - 0x208], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
push 0x42a254
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x410]
push eax
call fcn.0040bb30
lea eax, [ebp - 0x410]
push 0x42a560
push eax
call fcn.0040bb40
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004098b4
lea eax, [ebp - 0x208]
push eax
call fcn.0040c0a0
add esp, 0x1c
test eax, eax
pop edi
je 0x409225
push ebx
push esi
mov esi, 0x104
lea eax, [ebp - 0x30c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ebx, ebx
push esi
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0040ba40
add esp, 0xc
cmp byte [0x42a13c], bl
jne 0x40916e
cmp byte [0x42a13d], bl
jne 0x40916e
cmp byte [0x42a13e], bl
jne 0x40916e
cmp byte [0x42a13f], bl
jne 0x40916e
cmp byte [0x42a140], bl
je 0x409190
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push str._s_s
push eax
call fcn.0040becd
add esp, 0x10
cmp byte [0x42a141], bl
mov esi, str._sdrivers_s
je 0x4091bb
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0040becd
add esp, 0x10
cmp byte [0x42a142], bl
jne 0x4091d3
cmp byte [0x42a143], bl
jne 0x4091d3
cmp byte [0x42a144], bl
je 0x4091f1
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0040becd
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push str.vDeleteDriverFile__s
call fcn.004013fd
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebx
leave
ret
Function at 0x40973d
Capabilities:
Get common file path

Disassembly:
mov eax, 0x41e0d0
call fcn.0040b998
sub esp, 0x174
mov al, byte [0x42868c]
push ebx
push esi
push edi
push 0x40
mov byte [ebp - 0x180], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x17f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x7c]
stosb byte es:[edi], al
call fcn.00401000
xor ebx, ebx
push str.__vDeleteFileFromLocal
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.004013fd
lea eax, [ebp - 0x180]
mov dword [esp], 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [0x42a14e], bl
je 0x4097e1
mov esi, 0x42a86c
push esi
call fcn.0040c0a0
test eax, eax
pop ecx
je 0x4097e1
push ebx
push ebx
push esi
push 0x42a768
lea eax, [ebp - 0x180]
push str._vnDrvBas_
push eax
lea eax, [ebp - 0x180]
push str._s_s_s_s_c_c
push eax
call fcn.0040becd
add esp, 0x20
jmp 0x409808
push ebx
push ebx
push 0x42a768
lea eax, [ebp - 0x180]
push str._vnDrvBas_
push eax
lea eax, [ebp - 0x180]
push str._s_s_s_c_c
push eax
call fcn.0040becd
add esp, 0x1c
lea eax, [ebp - 0x180]
push eax
call fcn.0040c0a0
cmp byte [ebp + eax - 0x181], 0x5c
pop ecx
jne 0x409833
lea eax, [ebp - 0x180]
push eax
call fcn.0040c0a0
pop ecx
mov byte [ebp + eax - 0x181], bl
push 0x414
push ebx
push 3
lea ecx, [ebp - 0x7c]
call fcn.0040110a
lea eax, [ebp - 0x180]
lea ecx, [ebp - 0x7c]
push eax
call fcn.00401090
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040112c
cmp eax, ebx
jne 0x409886
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.FAIL_SHFileOperation_FO_DELETE_:__d_:__u_:__s
call fcn.004013fd
add esp, 0x10
lea ecx, [ebp - 0x7c]
call fcn.00401127
push 0x427048
call fcn.004013fd
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.0040104b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x409e7f
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push str.__vRebootSystem
call fcn.004013fd
xor ebx, ebx
pop ecx
cmp byte [0x42a13c], bl
jne 0x409f45
cmp byte [0x42a13d], bl
jne 0x409f45
cmp byte [0x42a13e], bl
jne 0x409f45
cmp byte [0x42a13f], bl
jne 0x409f45
cmp byte [0x42a140], bl
jne 0x409f45
cmp byte [0x42a141], bl
jne 0x409eeb
cmp byte [0x42a142], bl
jne 0x409eeb
cmp byte [0x42a143], bl
jne 0x409eeb
cmp byte [0x42a144], bl
je 0x409f4e
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push eax
push str.ExitWindowsEx:__d
call fcn.004013fd
pop ecx
pop ecx
jmp 0x409f4e
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0x427170
call fcn.004013fd
pop ecx
pop ebx
leave
ret