joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490d60
Capabilities:
Get disk information via ioctl
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x454
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x450], eax
mov eax, dword [esp + 0x460]
push str.Floppy
push eax
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x45c]
setne cl
sub eax, 2
je 0x490dc5
sub eax, 1
je 0x490dd0
sub eax, 2
je 0x490dbc
xor eax, eax
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.004e0148
add esp, 0x454
ret
mov dword [esp], 0x522c6c
jmp 0x490dd7
mov dword [esp], 0x522c7c
test cl, cl
jne 0x490dd7
mov dword [esp], 0x522c5c
mov eax, dword [esp]
push edi
push 0x12
push 0
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x490e07
xor eax, eax
pop edi
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.004e0148
add esp, 0x454
ret
push ebx
push ebp
push 0x3ff
xor ebp, ebp
lea ecx, [esp + 0x61]
push ebp
push ecx
mov byte [esp + 0x68], 0
call sub.MSVCR90.dll_memset
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
add esp, 0xc
push esi
lea ebx, [ebx]
xor eax, eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
push ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
push eax
push 0
mov esi, 0x1c
push edi
mov dword [esp + 0x3c], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x490f5d
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
lea edx, [esp + 0x38]
push edx
push edi
mov dword [esp + 0x2c], 0
call ebx
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x490f48
cmp ecx, 0x400
ja 0x490f48
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x44]
push eax
lea edx, [esp + 0x18]
push edx
push ecx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x38]
push ecx
push edi
mov dword [esp + 0x78], 5
mov dword [esp + 0x5c], esi
call ebx
test eax, eax
je 0x490f48
push 0
push 0
push 3
push 0
push 3
push 0
lea edx, [esp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x490f48
push 0
lea eax, [esp + 0x1c]
push eax
push 0xc
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x2d1080
push esi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x490f41
mov edx, dword [esp + 0x468]
cmp edx, dword [esp + 0x20]
je 0x490f7f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
inc ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0x1f4
jl 0x490e30
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
mov ecx, dword [esp + 0x460]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.004e0148
add esp, 0x454
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [esp + 0x58]
jmp 0x490f66
Function at 0x491b30
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x19010
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x1900c], eax
mov eax, dword [esp + 0x19024]
push ebx
mov ebx, dword [esp + 0x19020]
push ebp
mov ebp, dword [esp + 0x1901c]
push esi
mov esi, dword [esp + 0x1902c]
push edi
mov edi, dword [esp + 0x19028]
push eax
push 0
push esi
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], eax
call sub.MSVCR90.dll_memset
push 1
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x491bcb
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x491be2
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
or eax, 0xffffffff
jmp 0x491d1b
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
cmp byte [0x103a972], 0
je 0x491c7a
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._tc_Env
push edi
call ebp
test eax, eax
jne 0x491c23
push str.TC_INSTALL
push edi
call ebp
test eax, eax
je 0x491c7a
push str.tC_Sweep
push ebx
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
je 0x491c7a
push 0x18fff
lea eax, [esp + 0x21]
push 0
push eax
mov byte [esp + 0x28], 0
call sub.MSVCR90.dll_memset
lea ecx, [esp + 0x28]
push ecx
push esi
push 0x101e7d8
push 0
call fcn.004915e0
lea eax, [esp + 0x38]
mov edx, esi
mov ecx, eax
add esp, 0x1c
sub edx, ecx
jmp 0x491c70
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x491c70
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491c80
sub eax, edx
cmp eax, 2
jbe 0x491ce2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491c93
sub eax, edx
cmp byte [eax + esi - 1], 0xa
jne 0x491cb5
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491ca8
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491cc0
sub eax, edx
cmp byte [eax + esi - 1], 0xd
jne 0x491ce2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491cd5
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491ce7
sub eax, edx
mov edx, eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491cf7
mov ecx, dword [esp + 0x19034]
sub ecx, edx
push ecx
sub eax, edi
add eax, esi
push 0
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x1901c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e0148
add esp, 0x19010
ret
Function at 0x491d40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x28]
mov eax, 4
push 1
push str.SeBackupPrivilege
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
call fcn.004913e0
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
add esp, 8
lea eax, [esp + 0x28]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x491d99
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
push edi
mov edi, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x491de2
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
cmp byte [0x103a972], 0
je 0x491e82
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._tc_Env
push ebx
call esi
test eax, eax
jne 0x491e23
push str.TC_INSTALL
push ebx
call esi
test eax, eax
je 0x491e82
mov eax, edi
xor bl, bl
xor esi, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491e30
sub eax, edx
je 0x491e62
push ebp
mov ebp, dword [sym.imp.MSVCR90.dll_toupper]
movsx edx, byte [esi + edi]
push edx
call ebp
add bl, al
mov eax, edi
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491e54
sub eax, edx
cmp esi, eax
jb 0x491e42
pop ebp
movsx ecx, bl
and ecx, 0x8000001f
jns 0x491e72
dec ecx
or ecx, 0xffffffe0
inc ecx
mov eax, dword [esp + 0xc]
pop edi
and ecx, 0x1f
pop esi
rol eax, cl
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x491e90
Capabilities:
Set registry value

Disassembly:
mov eax, 0x19008
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x19004], eax
push ebx
mov ebx, dword [esp + 0x1901c]
push ebp
mov ebp, dword [esp + 0x1901c]
push esi
mov esi, dword [esp + 0x1901c]
push edi
mov edi, dword [esp + 0x1901c]
push 1
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x491ef5
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp byte [0x103a972], 0
je 0x491f72
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._tc_Env
push esi
call edi
test eax, eax
jne 0x491f1c
push str.TC_INSTALL
push esi
call edi
test eax, eax
je 0x491f72
push str.tC_Sweep
push ebp
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
je 0x491f72
push 0x18fff
lea edx, [esp + 0x19]
push 0
push edx
mov byte [esp + 0x20], 0
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x20]
push eax
push ebx
push 0x101e7d8
push 1
call fcn.004915e0
lea eax, [esp + 0x30]
add esp, 0x1c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491f61
sub eax, edx
push eax
lea ecx, [esp + 0x18]
push ecx
jmp 0x491f82
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491f77
sub eax, edx
push eax
push ebx
mov edx, dword [esp + 0x18]
push 1
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x491fb5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
or eax, 0xffffffff
jmp 0x491fd1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x19014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e0148
add esp, 0x19008
ret
Function at 0x491ff0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
cmp byte [0x103a972], 0
mov eax, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], eax
je 0x492092
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._tc_Env
push ebp
call esi
test eax, eax
jne 0x492031
push str.TC_INSTALL
push ebp
call esi
test eax, eax
je 0x492092
push ebx
mov eax, edi
xor bl, bl
xor esi, esi
lea edx, [eax + 1]
jmp 0x492040
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x492040
sub eax, edx
je 0x492074
mov ebp, dword [sym.imp.MSVCR90.dll_toupper]
movsx ecx, byte [esi + edi]
push ecx
call ebp
add bl, al
mov eax, edi
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x492063
sub eax, edx
cmp esi, eax
jb 0x492051
mov ebp, dword [esp + 0x20]
movsx ecx, bl
and ecx, 0x8000001f
jns 0x492084
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, dword [esp + 0x10]
and ecx, 0x1f
ror edx, cl
pop ebx
mov dword [esp + 0xc], edx
push 1
push str.SeBackupPrivilege
call fcn.004913e0
mov esi, dword [esp + 0x20]
add esp, 8
lea eax, [esp + 0x24]
push eax
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4920c3
lea ecx, [esp + 0x24]
push ecx
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x24]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
test eax, eax
je 0x492102
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
or eax, 0xffffffff
add esp, 8
ret
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
xor eax, eax
add esp, 8
ret
Function at 0x493e40
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x414
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [str..X:]
mov cx, word [0x508e74]
mov dl, byte [0x508e76]
push 0x1f9
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1b]
push 0
push eax
mov word [esp + 0x20], cx
mov byte [esp + 0x22], dl
call sub.MSVCR90.dll_memset
push 0x1ff
lea ecx, [esp + 0x221]
push 0
push ecx
mov byte [esp + 0x228], 0
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x430]
lea edx, [esp + 0x28]
add esp, 0x18
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x493eb0
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x493ec1
push esi
push 0
push 0
push 3
push 0
push 3
sub eax, edx
push bind
lea edx, [esp + 0x2c]
push edx
mov byte [esp + eax + 0x2f], cl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x493f5f
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0x200
lea ecx, [esp + 0x224]
push ecx
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x2d1400
push esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
je 0x493f5f
cmp dword [esp + 4], 0
jle 0x493f5f
cmp byte [esp + 0x22c], 7
jne 0x493f5f
mov al, 1
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004e0148
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
xor al, al
call fcn.004e0148
add esp, 0x414
ret
Function at 0x4947b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0
push 0
push 0x40000
mov byte [ecx + 0xf0], 1
call sub.mfc90.dll_Ordinal_4516
cmp dword [0x103b100], 0
je 0x494816
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10d7cd8]
cmp eax, 0x2710
jae 0x4947f9
call esi
sub eax, dword [0x10d7cd8]
je 0x4947f9
mov ecx, dword [0x103b100]
call fcn.00416b80
mov ecx, dword [0x103b100]
push 5
call sub.mfc90.dll_Ordinal_6584
mov eax, dword [0x103b100]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
ret

Function at 0x494820
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 4], 0
push esi
mov esi, ecx
je 0x494897
cmp dword [0x103b100], 0
je 0x494897
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x10d7cd8]
cmp eax, 0x2710
jae 0x49485e
call edi
sub eax, dword [0x10d7cd8]
je 0x49485e
mov ecx, dword [0x103b100]
call fcn.00416b80
mov ecx, dword [0x103b100]
push 0xd
call sub.mfc90.dll_Ordinal_6584
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
pop edi
test eax, eax
je 0x494887
mov ecx, dword [0x103b100]
push 9
call sub.mfc90.dll_Ordinal_6584
mov ecx, dword [0x103b100]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, esi
call fcn.004947b0
pop esi
ret 4

Function at 0x4948b0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x3c
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x38], eax
mov cx, word [0x508e74]
mov eax, dword [str..X:]
mov dl, byte [0x508e76]
push esi
push 0
push 0
push 3
push 0
push 3
mov word [esp + 0x4c], cx
mov dword [esp + 0x48], eax
mov al, byte [esp + 0x58]
push 0
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0x56], dl
mov byte [esp + 0x54], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x494916
xor al, al
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004e0148
add esp, 0x3c
ret
push edi
push 0
lea edx, [esp + 0xc]
push edx
push 0x20
lea eax, [esp + 0x18]
push eax
push 0xc
lea ecx, [esp + 0x40]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0
mov dword [esp + 0x30], 0x20
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x40]
mov edx, edi
neg edx
sbb dl, dl
and dl, byte [esp + 0x24]
pop edi
pop esi
xor ecx, esp
mov al, dl
call fcn.004e0148
add esp, 0x3c
ret
Function at 0x494aa0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x4f0dbb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x494b23
lea eax, [esp + 0x10]
push eax
call fcn.00491540
mov dword [esp + 0x20], edi
mov ecx, dword [eax]
mov edx, dword [esp + 0x28]
push ecx
push edx
push str.OpenSCManager_failed___s____s_
push 8
call fcn.0043d500
add esp, 0x14
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ebx, dword [esp + 0x24]
push 2
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x494b88
lea eax, [esp + 0x10]
push eax
call fcn.00491540
mov dword [esp + 0x20], 1
mov ecx, dword [eax]
push ecx
push ebx
push str.OpenService_failed___s____s_
push 8
call fcn.0043d500
add esp, 0x14
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0
push 0
push 0
xor edx, edx
cmp byte [esp + 0x34], dl
push 0
push 0
push 0
sete dl
push 0
push 0xffffffffffffffff
add edx, 3
push edx
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x494be9
lea eax, [esp + 0x10]
push eax
call fcn.00491540
mov dword [esp + 0x20], 2
mov ecx, dword [eax]
push ecx
push ebx
push str.ChangeServiceConfig_failed___s____s_
push 8
call fcn.0043d500
add esp, 0x14
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x494cc0
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push eax
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x494d03
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 4], 0x103
jne 0x494cfc
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x494d10
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0xa08
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0xa04], eax
push ebx
push esi
mov esi, dword [esp + 0xa14]
push edi
push esi
xor ebx, ebx
push ebx
push 0x410
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
jne 0x494d72
push esi
push str.Already__the_process_is_Killed__d_
push 8
call fcn.0043d500
add esp, 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0xa04]
xor ecx, esp
call fcn.004e0148
add esp, 0xa08
ret
push ebp
push 0x800
lea eax, [esp + 0x18]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x800
lea edx, [esp + 0x1c]
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x494e00
push 0x1ff
lea eax, [esp + 0x819]
push ebx
push eax
mov byte [esp + 0x820], bl
call sub.MSVCR90.dll_memset
mov ebp, dword [esp + 0x1c]
shr ebp, 2
add esp, 0xc
xor esi, esi
cmp ebp, ebx
jbe 0x494e00
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
nop
mov edx, dword [esp + esi*4 + 0x14]
push 0x200
lea ecx, [esp + 0x818]
push ecx
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
push str.tc_ad.dll
lea eax, [esp + 0x818]
push eax
call ebx
test eax, eax
jne 0x494e22
inc esi
cmp esi, ebp
jb 0x494dd0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xa14]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e0148
add esp, 0xa08
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x494e09

Function at 0x495040
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4e9ab9
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x140], esi
push 0x124
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x18], esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4950c0
mov dword [esp + 0x140], eax
lea ecx, [esp + 0x148]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor eax, eax
jmp 0x495127
lea ecx, [esp + 0xc]
push ecx
push edi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x495106
jmp 0x4950e0
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x14c]
call dword [sym.imp.mfc90.dll_Ordinal_1607]
test eax, eax
jne 0x4950f7
inc esi
lea eax, [esp + 0xc]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4950e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x140], 0xffffffff
lea ecx, [esp + 0x148]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.004e0148
add esp, 0x138
ret
Function at 0x495710
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x14]
push str._USB
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne case.0x495808.2
cmp byte [esi], 0x5c
jne 0x495764
push 0x502f14
push esi
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
jne 0x495764
mov eax, 0x20
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004e0148
add esp, 0xc
ret
movzx eax, byte [esi]
push eax
call fcn.004948b0
add esp, 4
cmp al, 7
je case.0x495808.2
mov al, byte [esi]
cmp al, 0x41
jl 0x495782
cmp al, 0x5a
jle 0x495792
cmp al, 0x61
jl 0x49584e
cmp al, 0x7a
jg 0x49584e
cmp byte [esi + 1], 0x3a
jne 0x4957ae
cmp dword [0x10dbcf8], 0
je 0x4957ae
push esi
call fcn.00494250
add esp, 4
test al, al
jne case.0x495808.2
movsx ecx, byte [esi]
push ecx
lea edx, [esp + 8]
push str._c:_
push edx
mov byte [esp + 0x10], 0
mov dword [esp + 0x11], 0
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [0x103a97c], 0x88
mov esi, eax
jne 0x495800
push esi
lea ecx, [esp + 8]
push ecx
push str.GetDrvType___s___d_
push 8
call fcn.0043d500
add esp, 0x10
lea eax, [esi - 1]
cmp eax, 4
ja case.0x495808.1
jmp dword [eax*4 + 0x49587c]
mov eax, 0x10
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004e0148
add esp, 0xc
ret
mov eax, 0x40
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004e0148
add esp, 0xc
ret
mov eax, 0x80
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004e0148
add esp, 0xc
ret
cmp dword [0x103a97c], 0x88
jne case.0x495808.1
push str.GetDrvType_0
push 8
call fcn.0043d500
add esp, 8
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004e0148
add esp, 0xc
ret