joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410eeb
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
lea eax, [ebp - 0x204]
push eax
push 0x4dca7c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x410f7d
cmp dword [ebp - 0x20c], 5
jne 0x410f54
push 0x2010000
call fcn.0040648e
add esp, 4
push 0
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x41106e
push 0x2002007
call fcn.0040648e
add esp, 4
push 0x10007
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x41106e
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesHaspCheck
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x200
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Aladdin_TestX.ttt
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffff
jne 0x41104b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 5
jne 0x411027
push 0x2010000
call fcn.0040648e
add esp, 4
push 0
call fcn.004064f2
add esp, 4
jmp 0x411041
push 0x2002007
call fcn.0040648e
add esp, 4
push 0x10007
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x41106e
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x200]
push eax
call fcn.0040820a
add esp, 4
xor eax, eax
jmp 0x41106e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41160d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x4dcb78
push 0x42d5c0
call fcn.0041d13c
add esp, 8
push str.PcmciaDataBaseAladdin_Knowledge_Systems_Ltd.PC_CardHASP_V1.1
push 0x42d5c0
call fcn.0041d138
add esp, 8
push 0x42d5b4
push 0x42d5c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411663
xor eax, eax
jmp 0x4116d4
push 0x4dcbdc
push 0x42cf50
call fcn.0041d13c
add esp, 8
push 7
push 0x4dcbe4
push 1
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4116c1
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4116d4
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4116d4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4116fd
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x200
lea eax, [ebp - 0x20c]
mov dword [ebp - 8], eax
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dcc40
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcc4c
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcc54
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x42d3b0
call fcn.0040820a
add esp, 4
test eax, eax
je 0x41177b
xor eax, eax
jmp 0x41181c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x4117b9
cmp dword [ebp - 0xc], 3
je 0x4117b9
cmp dword [ebp - 0xc], 5
jne 0x4117af
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x41181c
mov eax, dword [ebp + 8]
push eax
call fcn.0041d0c4
add esp, 4
test eax, eax
je 0x411815
mov eax, dword [ebp + 8]
push eax
call fcn.0040820a
add esp, 4
test eax, eax
jne 0x411815
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x411815
cmp dword [ebp - 0xc], 5
jne 0x41180b
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x41181c
xor eax, eax
jmp 0x41181c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411821
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dcc5c
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcc60
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcc68
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x42d3b0
call fcn.0040820a
add esp, 4
test eax, eax
jne 0x4118b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x4118b9
cmp dword [ebp - 4], 5
jne 0x4118af
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4118c0
xor eax, eax
jmp 0x4118c0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4118c5
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dcc70
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcc74
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x42d3b0
call fcn.0040820a
add esp, 4
test eax, eax
jne 0x41194b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x41194b
cmp dword [ebp - 4], 5
jne 0x411941
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x411952
xor eax, eax
jmp 0x411952
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411957
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x200
lea eax, [ebp - 0x20c]
mov dword [ebp - 8], eax
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Drivers_
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcc8c
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x42d3b0
call fcn.0040820a
add esp, 4
test eax, eax
je 0x4119c3
xor eax, eax
jmp 0x411a64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x411a01
cmp dword [ebp - 0xc], 3
je 0x411a01
cmp dword [ebp - 0xc], 5
jne 0x4119f7
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x411a64
mov eax, dword [ebp + 8]
push eax
call fcn.0041d0c4
add esp, 4
test eax, eax
je 0x411a5d
mov eax, dword [ebp + 8]
push eax
call fcn.0040820a
add esp, 4
test eax, eax
jne 0x411a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x411a5d
cmp dword [ebp - 0xc], 5
jne 0x411a53
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x411a64
xor eax, eax
jmp 0x411a64
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411a69
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dcc9c
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dcca0
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x42d3b0
call fcn.0040820a
add esp, 4
test eax, eax
jne 0x411aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x411aef
cmp dword [ebp - 4], 5
jne 0x411ae5
push 0x4000b
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x411af6
xor eax, eax
jmp 0x411af6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4129f0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dce44
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dce48
push 0x42d3b0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 8], 0
je 0x412af2
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.0041d13c
add esp, 8
push 0x4dce54
lea eax, [ebp - 0x34c]
push eax
call fcn.0041d138
add esp, 8
push str.haspdos.sys
lea eax, [ebp - 0x34c]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x412af2
push 0
push 0x42d3b0
lea eax, [ebp - 0x34c]
push eax
call fcn.00408230
add esp, 0xc
test eax, eax
jne 0x412ade
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412bc7
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x412bc7
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x42cd30], eax
cmp dword [0x42cd30], 0xffffffff
jne 0x412b38
push 0x40003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412bc7
push 0
lea eax, [ebp - 4]
push eax
push 0x17f
push 0x4dbe58
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x412b84
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412bc7
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x412bc0
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412bc7
xor eax, eax
jmp 0x412bc7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412e13
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dce84
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x4dce90
push 0x42d3b0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 8], 0
je 0x412f01
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.0041d13c
add esp, 8
push 0x4dce9c
lea eax, [ebp - 0x34c]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x412f01
push 0
push 0x42d3b0
lea eax, [ebp - 0x34c]
push eax
call fcn.00408230
add esp, 0xc
test eax, eax
jne 0x412eed
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412fd7
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x412fd7
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x42cd30], eax
cmp dword [0x42cd30], 0xffffffff
jne 0x412f47
push 0x40003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412fd7
push 0
lea eax, [ebp - 4]
push eax
call fcn.004081a1
push eax
push 0x43ad88
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x412f94
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412fd7
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x412fd0
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40005
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x412fd7
xor eax, eax
jmp 0x412fd7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412fdc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
test byte [ebp + 0xc], 1
je 0x413155
push 0x200
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dcea8
lea eax, [ebp - 0x21c]
push eax
call fcn.0041d138
add esp, 8
push 0x4dceac
lea eax, [ebp - 0x21c]
push eax
call fcn.0041d138
add esp, 8
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4130da
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4dceb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4130da
push str.GetVDDVersion
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4130d0
call dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 8], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0xc0000000
push str..hasp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x41314c
push 0
lea eax, [ebp - 0x10]
push eax
push 8
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 8]
push eax
push 0x9c402800
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41313d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413155
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
test byte [ebp + 0xc], 2
je 0x41318d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0041b782
mov eax, dword [ebp - 0x220]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
and eax, 0xffff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
push 0x200
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers
lea eax, [ebp - 0x21c]
push eax
call fcn.0041d138
add esp, 8
push 0x4dceec
lea eax, [ebp - 0x21c]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x21c]
push eax
call fcn.004195ae
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0xffffffff
jne 0x4131f3
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
xor eax, eax
jmp 0x4131fa
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4131ff
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov dword [ebp - 4], 0x200
push 0x4dcef8
mov eax, dword [ebp + 8]
push eax
call fcn.0041d13c
add esp, 8
push 0x4dcefc
push 0x42d5c0
call fcn.0041d13c
add esp, 8
cmp dword [ebp + 0xc], 2
jne 0x413256
push 0x4dcf20
push 0x42d5c0
call fcn.0041d138
add esp, 8
jmp 0x413268
push 0x4dcf28
push 0x42d5c0
call fcn.0041d138
add esp, 8
push 0x42d5b4
push 0xf003f
push 0
push 0x42d5c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x4132ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4132b3
mov eax, 0xffffffff
jmp 0x413460
xor eax, eax
jmp 0x413460
push 0x4dcf34
push 0x42cf50
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x413314
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x413460
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x41333c
mov eax, 0xffffffff
jmp 0x413460
push 0x4dcf40
lea eax, [ebp - 0x208]
push eax
call fcn.0041d3d4
add esp, 8
test eax, eax
je 0x4133c6
push str.SystemRoot_
call fcn.0041d0c4
add esp, 4
lea eax, [ebp + eax - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041d13c
add esp, 8
push 0x200
push 0x42d3b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dcf60
push 0x42d3b0
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x208]
push eax
push 0x42d3b0
call fcn.0041d138
add esp, 8
push 0x42d3b0
lea eax, [ebp - 0x208]
push eax
call fcn.0041d13c
add esp, 8
push 0x4dcf64
lea eax, [ebp - 0x208]
push eax
call fcn.0041d3d4
add esp, 8
test eax, eax
je 0x413406
push 0x4dcf6c
call fcn.0041d0c4
add esp, 4
lea eax, [ebp + eax - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041d13c
add esp, 8
push 0x4dcf74
lea eax, [ebp - 0x208]
push eax
call fcn.0041d3d4
add esp, 8
test eax, eax
je 0x413446
push 0x4dcf84
call fcn.0041d0c4
add esp, 4
lea eax, [ebp + eax - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0041d13c
add esp, 8
xor eax, eax
jmp 0x413460
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413465
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push 0x42d5c0
call fcn.0041d13c
add esp, 8
cmp dword [ebp + 8], 2
jne 0x4134a1
push 0x4dcfb8
push 0x42d5c0
call fcn.0041d138
add esp, 8
jmp 0x4134b3
push 0x4dcfc0
push 0x42d5c0
call fcn.0041d138
add esp, 8
push 0x42d5b4
push 0x42d5c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4134ec
push 0x10007
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x413592
push 0x4dcfcc
push 0x42d5c0
call fcn.0041d13c
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041d0c4
add esp, 4
inc eax
push eax
mov eax, dword [ebp + 0xc]
push eax
push 2
push 0
push 0x42d5c0
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41355b
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x413592
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41358b
push 0x10002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x413592
xor eax, eax
jmp 0x413592
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41380e
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4dd03c
lea eax, [ebp - 0x204]
push eax
call fcn.0041d138
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0041d138
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x413902
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.0041d13c
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xffffffff
je 0x413902
push 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.00408230
add esp, 0xc
test eax, eax
jne 0x4138ee
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, dword [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 0xffffffff
jmp 0x4139c2
mov eax, dword [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4139c2
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x42cd30], eax
cmp dword [0x42cd30], 0xffffffff
jne 0x41394a
push 0x40003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4139c2
push 0
lea eax, [ebp - 0x54c]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41398b
push 0x40004
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4139c2
mov eax, dword [0x42cd30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4139bb
push 0x40005
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4139c2
xor eax, eax
jmp 0x4139c2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4139c7
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [0x43acf4], 0
je 0x413a66
push 0x200
push 0x42d1b0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str...inf
push 0x42d1b0
call fcn.0041d138
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x42d1b0
call fcn.0041d138
add esp, 8
push 0x42d1b0
call fcn.0040820a
add esp, 4
test eax, eax
jne 0x413a66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x413a66
cmp dword [ebp - 4], 5
jne 0x413a4f
push 0x4000b
call fcn.004064f2
add esp, 4
push 0x200401d
call fcn.0040648e
add esp, 4
mov eax, 0xffffffff
jmp 0x413a6d
xor eax, eax
jmp 0x413a6d
pop edi
pop esi
pop ebx
leave
ret