joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d3557
xor edx, edx
cmp edx, str.TrashClean
je 0x4d3557
xor eax, eax
cmp eax, str.EnableLowDisk
je 0x4d3557
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.TrashClean
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d3526
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.EnableLowDisk
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d3640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp eax, 1
jae 0x4d3655
mov eax, 1
jmp 0x4d365f
cmp eax, 0x63
jbe 0x4d365f
mov eax, 0x63
mov dword [ebp - 8], eax
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4d370f
xor ecx, ecx
cmp ecx, str.TrashClean
je 0x4d370f
xor edx, edx
cmp edx, str.LowDiskSize
je 0x4d370f
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.TrashClean
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d36eb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.LowDiskSize
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret
Function at 0x4d37c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d3887
xor edx, edx
cmp edx, str.TrashClean
je 0x4d3887
xor eax, eax
cmp eax, str.EnableCanSaveDisk
je 0x4d3887
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.TrashClean
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d3856
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.EnableCanSaveDisk
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d3970
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp eax, 1
jae 0x4d3985
mov eax, 1
jmp 0x4d398f
cmp eax, 0x63
jbe 0x4d398f
mov eax, 0x63
mov dword [ebp - 8], eax
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4d3a3f
xor ecx, ecx
cmp ecx, str.TrashClean
je 0x4d3a3f
xor edx, edx
cmp edx, str.CanSaveDiskSize
je 0x4d3a3f
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.TrashClean
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d3a1b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.CanSaveDiskSize
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret
Function at 0x4d3b20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.SOFTWARE360Safe
je 0x4d3bdb
xor edx, edx
cmp edx, 0x56bf0c
je 0x4d3bdb
xor eax, eax
cmp eax, 0x56bf08
je 0x4d3bdb
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push 0x56bf0c
push str.SOFTWARE360Safe
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d3bb7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0x56bf08
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret

Function at 0x4d3cb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp byte [ebp + 8], al
sete al
xor ecx, ecx
inc eax
mov dword [ebp - 0xc], eax
cmp ecx, str.SOFTWARE360Safe
je 0x4d3d70
xor edx, edx
cmp edx, str.safemon
je 0x4d3d70
xor eax, eax
cmp eax, str.Ccymon
je 0x4d3d70
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 4]
push edx
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d3d4c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push str.Ccymon
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 8]
call fcn.00443d90
mov eax, dword [ebp + 8]
push eax
call fcn.004c0be0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4d7070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
push ebx
mov eax, 1
push esi
mov dword [ebp - 8], eax
cmp ecx, str.SOFTWARE360Safe
je 0x4d711e
xor edx, edx
cmp edx, str.safemon
je 0x4d711e
cmp ecx, str.FilelessAtkAccess
je 0x4d711e
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.safemon
push str.SOFTWARE360Safe
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push str.FilelessAtkAccess
push edx
mov esi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov bl, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4d710f
cmp dword [ebp - 0xc], esi
je 0x4d7111
xor bl, bl
lea ecx, [ebp - 4]
call fcn.00443d90
mov eax, dword [ebp - 8]
jmp 0x4d7120
xor bl, bl
movzx esi, bl
cmp eax, 1
jne 0x4d7158
lea eax, [ebp - 0xc]
push 0
push eax
mov dword [ebp - 0xc], 0
call fcn.004d6940
add esp, 8
test eax, eax
je 0x4d7158
cmp eax, 0xfe
jne 0x4d7155
test dword [ebp - 0xc], 0x100
jne 0x4d7155
xor eax, eax
jmp 0x4d7158
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4d7161
mov dword [ecx], esi
xor ecx, ecx
cmp eax, 1
sete cl
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8530
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
xor ecx, ecx
xor eax, eax
jmp 0x4d8550
movsx edx, byte [eax + 0x56c5c8]
dec edx
cmp edx, ecx
je 0x4d8564
inc eax
cmp eax, 0x20
jl 0x4d8550
jmp 0x4d8568
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jl 0x4d8545
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x23]
mov dword [ebp - 0x28], 0x56c3c8
lea ecx, [ecx]
xor esi, esi
mov dword [ebp - 0x2c], eax
mov eax, esi
sar eax, 1
mov ecx, esi
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, esi
and ecx, 0x20
or eax, ecx
mov ecx, dword [ebp - 0x28]
movsx eax, byte [ecx + eax]
xor edx, edx
test al, 8
je 0x4d85bc
movsx edx, byte [edi - 1]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
test al, 4
je 0x4d85d3
movsx ebx, byte [edi]
mov ecx, 0x1f
sub ecx, ebx
mov ebx, 1
shl ebx, cl
or edx, ebx
test al, 2
je 0x4d85eb
movsx ebx, byte [edi + 1]
mov ecx, 0x1f
sub ecx, ebx
mov ebx, 1
shl ebx, cl
or edx, ebx
test al, 1
je 0x4d8603
movsx eax, byte [edi + 2]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov dword [eax + ecx], edx
inc esi
add eax, 4
cmp esi, 0x40
mov dword [ebp - 0x2c], eax
jl 0x4d8585
mov ecx, dword [ebp - 0x28]
add ecx, 0x40
add edi, 4
cmp ecx, 0x56c5c8
mov dword [ebp - 0x28], ecx
jl 0x4d8580
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4d87f0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x800
mov esi, ecx
call fcn.0051e9bc
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4d8887
mov ecx, esi
call fcn.004d8530
cmp dword [ebp + 8], 1
je 0x4d8887
push 0x800
call fcn.0051e9bc
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x4d883d
mov eax, dword [esi]
push eax
call fcn.0051e865
add esp, 4
or eax, 0xffffffff
pop esi
pop ebp
ret 4
push 0x56c2d0
push eax
mov ecx, esi
call fcn.004d83c0
push 0x800
call fcn.0051e9bc
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x4d887a
mov ecx, dword [esi]
push ecx
call fcn.0051e865
mov edx, dword [esi + 4]
push edx
call fcn.0051e865
add esp, 8
or eax, 0xffffffff
pop esi
pop ebp
ret 4
push 0x56c310
push eax
mov ecx, esi
call fcn.004d83c0
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4d8f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4d8f30
xor al, al
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d8f4d
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
sete al
pop esi
pop ebp
ret
shr al, 4
and al, 1
pop esi
pop ebp
ret
Function at 0x4d91e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0051d250
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4d9237
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push str.ntdll.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4d9227
push str.RtlGetVersion
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4d92f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0051d250
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4d9ad0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4d9ae9
mov al, 1
pop esi
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov eax, dword [esi]
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d9b17
shr eax, 4
test al, 1
je 0x4d9b17
mov eax, dword [esi]
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4d9b20
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4d9b49
call edi
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4d9b5a
mov eax, dword [esi]
push eax
test bl, bl
jne 0x4d9b50
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4d9b5a
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4d9b49
cmp byte [ebp + 0xc], 0
je 0x4d9b80
cmp byte [ebp + 0x10], 1
jne 0x4d9b73
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d9b49
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebx
xor al, al
pop esi
pop ebp
ret
Function at 0x4d9b90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d9bb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
sete al
pop ebp
ret
shr eax, 4
not al
and al, 1
pop ebp
ret

Function at 0x4da0a0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x4da0f1
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x24
lea edx, [ebp - 0x2c]
push edx
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x4da0fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x28], 1
jne 0x4da0f1
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4da125
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call fcn.004d9110
test al, al
je 0x4da0f1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
cmp dword [ebp - 0x28], 2
mov edx, dword [ebp - 0x18]
mov edi, eax
mov dword [ebp - 4], edx
jne 0x4da1e0
mov eax, 0xcccccccd
mul dword [ebp - 0x14]
shr edx, 3
cmp edx, 0x3e8
jae 0x4da16e
mov edx, 0x3e8
jmp 0x4da17b
cmp edx, 0x2710
jbe 0x4da17b
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push 0x24
lea edx, [ebp - 0x2c]
push edx
push 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4da1d5
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x18], eax
jbe 0x4da1b6
call ebx
mov ecx, dword [ebp - 0x18]
mov edi, eax
mov dword [ebp - 4], ecx
jmp 0x4da1bf
call ebx
sub eax, edi
cmp eax, dword [ebp - 0x14]
ja 0x4da1e0
cmp dword [ebp - 0x28], 2
je 0x4da154
cmp dword [ebp - 0x28], 4
pop edi
pop ebx
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx], eax
cmp dword [ebp - 0x28], 4
pop edi
pop ebx
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4da1f0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebx]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4da22a
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
xor esi, esi
jmp 0x4da240
mov eax, dword [ebx]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4da264
cmp dword [ebp - 0x18], 3
jne 0x4da264
push 0x3e8
call edi
inc esi
cmp esi, 0xa
jb 0x4da240
cmp dword [ebp - 0x18], 1
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4da3d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
push esi
je 0x4da408
cmp dword [eax + 0x18], 8
jb 0x4da3e8
mov esi, dword [eax + 4]
jmp 0x4da3eb
lea esi, [eax + 4]
test esi, esi
je 0x4da408
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4da40d
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x4da411
xor eax, eax
pop esi
pop ebp
ret
test al, 0x10
je 0x4da408
mov eax, 1
pop esi
pop ebp
ret

Function at 0x4dad20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x4dada1
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, 0x104
or ecx, edx
jge 0x4dad4f
push 0x104
mov ecx, esi
call fcn.0043a120
mov eax, dword [esi]
push edi
push eax
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4dad7c
push ecx
push eax
call fcn.0051f6df
add esp, 8
test eax, eax
jl 0x4dada8
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x4dada8
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
test edi, edi
mov word [ecx + eax*2], dx
pop edi
jne 0x4dad9a
mov al, 1
pop esi
pop ebp
ret 4
mov ecx, esi
call fcn.004392b0
xor al, al
pop esi
pop ebp
ret 4
push 0x80070057
call fcn.00414840
int3
Function at 0x4dc1d0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x24c
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x254], 0
call fcn.0051d250
add esp, 0xc
push esi
push 0x560120
lea ecx, [ebp - 0x28c]
push edi
push ecx
call fcn.0045e100
add esp, 0xc
push eax
lea edx, [ebp - 0x2a8]
push edx
call fcn.0045e190
mov esi, 8
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x4dc241
mov eax, dword [eax + 4]
jmp 0x4dc244
add eax, 4
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp dword [ebp - 0x290], esi
jb 0x4dc26b
mov edx, dword [ebp - 0x2a4]
push edx
call fcn.0051d230
add esp, 4
xor eax, eax
mov dword [ebp - 0x290], 7
mov dword [ebp - 0x294], 0
mov word [ebp - 0x2a4], ax
cmp dword [ebp - 0x274], esi
jb 0x4dc29f
mov ecx, dword [ebp - 0x288]
push ecx
call fcn.0051d230
add esp, 4
xor edx, edx
mov dword [ebp - 0x274], 7
mov dword [ebp - 0x278], 0
mov word [ebp - 0x288], dx
cmp ebx, 0xffffffff
jne 0x4dc2d4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x228]
push eax
push 0x560120
lea ecx, [ebp - 0x2c4]
push edi
push ecx
call fcn.0045e100
add esp, 0xc
push eax
lea edx, [ebp - 0x270]
push edx
call fcn.0045e100
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x4dc30a
mov eax, dword [eax + 4]
jmp 0x4dc30d
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x258], esi
jb 0x4dc32b
mov eax, dword [ebp - 0x26c]
push eax
call fcn.0051d230
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x258], 7
mov dword [ebp - 0x25c], 0
mov word [ebp - 0x26c], cx
cmp dword [ebp - 0x2ac], esi
jb 0x4dc35f
mov edx, dword [ebp - 0x2c0]
push edx
call fcn.0051d230
add esp, 4
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4dc2d4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4dfb50
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.004dd8c0
test eax, eax
je 0x4dfbab
cmp dword [esi + 0x38], 0
je 0x4dfbab
push ebx
push edi
lea edi, [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
test ebx, ebx
pop ebx
je 0x4dfbab
cmp dword [esi + 0x28], 0
jne 0x4dfbab
push 0
push 0
push esi
push 0x4df570
push 0
push 0
mov dword [esi + 0x50], 0
call fcn.005247af
add esp, 0x18
mov dword [esi + 0x28], eax
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret