joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4638a8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463961
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [0x49e428]
mov edx, dword [edx]
call fcn.00404b7c
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00463588
mov eax, dword [ebp - 4]
mov edx, dword [0x49e428]
mov edx, dword [edx]
call fcn.00404f44
je 0x463946
mov eax, dword [ebp - 4]
call fcn.0040a114
test al, al
je 0x463946
lea ecx, [ebp - 8]
mov edx, 0x463978
mov eax, dword [ebp - 4]
call fcn.0040a448
mov eax, dword [ebp - 8]
call fcn.0040a114
test al, al
je 0x463931
push 0x80
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
call fcn.0040a384
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a39c
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463968
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b4c
ret

Function at 0x463980
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
push ebp
push 0x463a1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [0x49e428]
mov edx, dword [edx]
call fcn.00404f44
je 0x463a04
mov eax, dword [ebp - 4]
call fcn.0040a114
test al, al
je 0x463a04
lea ecx, [ebp - 8]
mov edx, 0x463a34
mov eax, dword [ebp - 4]
call fcn.0040a448
mov eax, dword [ebp - 8]
call fcn.0040a114
test al, al
je 0x4639f9
push 0x80
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
call fcn.0040a384
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a39c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463a26
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b4c
ret
Function at 0x46eb60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ebba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49e140]
cmp byte [eax], 0
je 0x46eb8a
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x46eba4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404d60
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ebc1
lea eax, [ebp - 4]
call fcn.00404b28
ret

Function at 0x46ebc8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ec27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49e140]
cmp byte [eax], 0
je 0x46ebf6
push esi
push ebx
call sub.kernel32.dll_SetFileAttributesW
mov ebx, eax
jmp 0x46ec11
push esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404d60
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
call sub.kernel32.dll_SetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ec2e
lea eax, [ebp - 4]
call fcn.00404b28
ret

Function at 0x46eca8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ed20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49e140]
cmp byte [eax], 0
je 0x46ecd8
push esi
push ebx
call sub.kernel32.dll_MoveFileW
mov ebx, eax
jmp 0x46ed05
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404d60
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404d60
mov eax, dword [ebp - 8]
call fcn.00404ff8
push eax
call sub.kernel32.dll_MoveFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ed27
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b4c
ret
Function at 0x46ef70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00407fa4
cmp ax, 0xffff
jne 0x46ef91
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x46f01d
push eax
push edi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x46f01d
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x46efde
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x46efca
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x46f01d
cmp dword [ebp + 8], 0
jle 0x46f01d
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00429e30
mov esi, eax
test esi, esi
jle 0x46f014
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407fb8
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x46fb68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x46fbcc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404da8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409d64
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fbd3
lea eax, [ebp - 0xc]
call fcn.00404b28
ret

Function at 0x46fc30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x46fc8c
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x46fc5b
call fcn.0040f678
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402cdc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x46fc8c
call fcn.0040f678
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x47445c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4750e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x475169
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404dc0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040a510
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0040544c
mov eax, dword [ebp - 4]
call fcn.00475028
test al, al
je 0x475136
mov byte [ebp - 5], 1
jmp 0x475146
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475170
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404b4c
lea eax, [ebp - 0xc]
call fcn.00405284
ret

Function at 0x475570
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x475593
and ecx, ecx
jle 0x475593
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x475599]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x475583
pop edi
pop ebx
ret

Function at 0x475b74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x475bd1
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.00475ac4
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.00475a2c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x475b96
mov esp, ebp
pop ebp
ret

Function at 0x475c2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.00404df8
dec eax
test eax, eax
jl 0x475ca2
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.00404ff8
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.00475a2c
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x475c85
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00475ac4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.00475a2c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x475ca7
mov esp, ebp
pop ebp
ret
Function at 0x480cb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x480d79
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x113]
mov edx, 0x480d8c
call fcn.0040a83c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
xor edx, edx
call fcn.004055f4
je 0x480d20
lea eax, [ebp - 0x21c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
call fcn.00404dc0
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x108]
call fcn.0040a83c
jmp 0x480d31
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00405418
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480d80
lea eax, [ebp - 0x21c]
call fcn.00404b28
ret

Function at 0x484ca4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
push ebp
push 0x484d3f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x484d50
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x484ce1
mov edi, 0xb
jmp 0x484d29
push 4
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x484d05
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edi, 0xc
jmp 0x484d29
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x484d1a
mov edi, 0xd
jmp 0x484d1d
mov edi, dword [ebp - 0x1c]
push ebx
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484d46
lea eax, [ebp - 4]
call fcn.00404b28
ret

Function at 0x484d60
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x484dff
push 0xf01ff
mov eax, ebx
call fcn.00404ff8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x484dff
xor eax, eax
push ebp
push 0x484df8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x24], 4
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484dff
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484e08
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
call fcn.0045e13c
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x484eeb
xor eax, eax
push ebp
push 0x484ee4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, ebx
call fcn.00404ff8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp dword [ebp - 0xc], 0
je 0x484ecd
xor eax, eax
push ebp
push 0x484ec6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x484eaf
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x420
jne 0x484eaf
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484ecd
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484eeb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484ef4
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fe8
xor eax, eax
push ebp
push 0x484feb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x484fce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x484faa
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x484f87
mov eax, dword [0x49e390]
mov eax, dword [eax]
call fcn.0045a750
cmp dword [ebp - 0x28], 3
jne 0x484f98
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x484f6b
cmp dword [ebp - 0x28], 1
jne 0x484fa4
mov byte [ebp - 5], 1
jmp 0x484fae
mov byte [ebp - 5], 0
jmp 0x484fae
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484fd5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x485038
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
test esi, esi
je 0x4850fe
call fcn.0045e13c
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4850fe
push 0
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00404ff8
push eax
push 1
mov eax, dword [ebp + 8]
push eax
push 0x110
push 0xf01ff
mov eax, edi
call fcn.00404ff8
push eax
mov eax, ebx
call fcn.00404ff8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4850f7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
ja 0x4850c9
call fcn.004045e0
jmp 0x4850fe
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.0048510c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850fe
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x491b8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x491c0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00405188
push 0x104
mov eax, dword [ebx]
call fcn.00404ff8
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, eax
mov eax, ebx
call fcn.00405188
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.0040a510
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404b7c
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0040ec8c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491c15
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b4c
ret

Function at 0x491c1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
test dl, dl
je 0x491c31
add esp, 0xfffffff0
call fcn.004040cc
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x491cda
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [esi + 4], 0
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
xor eax, eax
mov dword [esi + 0x30], eax
lea eax, [ebp - 4]
call fcn.00491b8c
mov edx, dword [ebp - 4]
lea eax, [esi + 0x34]
mov ecx, 0x491d08
call fcn.00404e44
lea eax, [ebp - 8]
call fcn.00491b8c
push dword [ebp - 8]
push 0x491d08
push 0x491d28
lea eax, [esi + 0x38]
mov edx, 3
call fcn.00404eb8
mov eax, esi
call fcn.00491d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491ce1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b4c
ret
Function at 0x491d64
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
lea esi, [ebp - 8]
xor eax, eax
push ebp
push 0x491eb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx + 0x38]
call fcn.00404ff8
push eax
call sub.kernel32.dll_LoadLibraryA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
je 0x491ea8
push 0x491ec8
push edi
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491db6
mov eax, dword [esi]
mov dword [ebx + 0xc], eax
push 0x491edc
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491dd0
mov eax, dword [esi]
mov dword [ebx + 0x10], eax
push 0x491eec
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491dea
mov eax, dword [esi]
mov dword [ebx + 0x14], eax
push 0x491efc
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491e04
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
push 0x491f0c
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491e1e
mov eax, dword [esi]
mov dword [ebx + 0x1c], eax
push 0x491f20
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491e38
mov eax, dword [esi]
mov dword [ebx + 0x20], eax
push 0x491f30
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491e52
mov eax, dword [esi]
mov dword [ebx + 0x24], eax
push 0x491f40
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491e6c
mov eax, dword [esi]
mov dword [ebx + 0x28], eax
push 0x491f50
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491e86
mov eax, dword [esi]
mov dword [ebx + 0x2c], eax
push 0x491f64
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
cmp dword [esi], 0
je 0x491ea0
mov eax, dword [esi]
mov dword [ebx + 0x30], eax
mov byte [ebx + 4], 1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491ebd
ret

Function at 0x4920e4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040a9d4
add esp, 0x104
pop ebx
ret

Function at 0x4924b8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4924fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00492454
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492505
lea eax, [ebp - 4]
call fcn.00404b28
ret
Function at 0x492700
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
test esi, esi
jne 0x492726
test edi, 4
je 0x492726
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x492730
mov eax, esi
call fcn.00404ff8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004921e0
test al, al
jne 0x492745
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x492797
xor eax, eax
push ebp
push 0x492787
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ff8
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49278e
lea eax, [ebp - 0x14]
call fcn.0049221c
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4