joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4240ad
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x424155
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42413e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jbe 0x42413c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jbe 0x42413c
push 1
push 1
push dword [ebp - 0x20]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x7da7
call fcn.00423fce
add esp, 0x18
jmp 0x424116
jmp 0x424153
push 0x1220
push 0x124
push 0x911
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x42417e
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x424171
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x42417e
push 0x81c
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov esp, ebp
pop ebp
ret
Function at 0x424737
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42475c
push 0xcc4
push 1
push 0x6043
call fcn.004247d5
add esp, 0xc
jmp 0x4247d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4247c1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.0041261e
mov esi, eax
push 3
mov ecx, dword [ebp - 0x28]
call fcn.0041261e
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x4247d0
push 0x89f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42ace7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42ad31
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42ad1b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42ad19
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x42ad2f
push 0
push 0xe77
push 0
push 0x14b6
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x42ad7d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42ad69
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42ad67
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x42ad7d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x42ad7d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esp, ebp
pop ebp
ret

Function at 0x42af37
Capabilities:
Query environment variable
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42af88
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42af72
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42af70
push 0x89f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x42af86
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x42af86
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x42afa9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push 0x20b5
call fcn.00424b51
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x432563
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
inc edi
mov esi, ecx
mov dword [ebp - 8], edi
xor ecx, ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], 0xa3191b49
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, 0xb051
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
inc edx
neg edx
cmp edx, dword [ebp - 0xc]
je 0x4325ce
mov dword [ebp - 0x10], edi
jmp 0x43262d
mov dword [ebp - 8], 0xfffffffe
lea ecx, [ebp - 0x1c]
push edi
call fcn.0041257d
mov dword [ebp - 0xc], ebx
jmp 0x4325f3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [eax + ecx*4], 0x68451f1e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4325e3
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov dword [ebp - 8], ebx
jmp 0x43261f
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x43261c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x2c
je 0x43260c
lea ecx, [ebp - 0x1c]
call fcn.004129c0
mov eax, dword [esi]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434239
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x434255
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret

Function at 0x4361a2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43620f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4361d7
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x43620d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul esi, dword [eax], 0xa
mov ecx, dword [ebp - 0x1c]
call fcn.004015d8
movsx eax, byte [eax]
lea eax, [esi + eax - 0x30]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x43622b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
call fcn.00435d9e
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437762
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4377e3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x437796
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4377e1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4377c4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x4377e1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.0041261e
mov dword [eax], 0x4ad8a0f8
jmp 0x4377b9
jmp 0x4377ff
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00437494
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x437b97
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x437bc3
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
call fcn.00437c3a
add esp, 0xc
jmp 0x437c36
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x437c2c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x437c0d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x437c2a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.0041261e
mov dword [eax], 0x4142b919
jmp 0x437c02
jmp 0x437c36
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x438159
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x438176
push 0x707b
push 1
call fcn.004381aa
pop ecx
pop ecx
jmp 0x4381a6
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x438190
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4381a6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4381a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esp, ebp
pop ebp
ret
Function at 0x438fcd
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4390cd
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x439083
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x439047
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 5
jle 0x439081
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x439065
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jl 0x43907f
push 1
mov ecx, dword [ebp - 0x30]
call fcn.0041261e
mov dword [eax], 0x1f29c70a
jmp 0x43905a
jmp 0x43903c
jmp 0x4390cb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4390b1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x4390cb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.0041261e
or dword [eax], 0xffffffff
jmp 0x4390a6
jmp 0x43913d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x439135
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x439117
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x439133
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.0041261e
or dword [eax], 0xffffffff
jmp 0x43910c
jmp 0x43913d
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret
Function at 0x44aa75
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44ab8a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44aab3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44ab88
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.0041261e
cmp dword [eax], 0x2491
jge 0x44aae6
mov dword [ebp - 0x10], 1
jmp 0x44aaea
and dword [ebp - 0x10], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.0041261e
mov esi, eax
push 0
mov ecx, dword [ebp - 4]
call fcn.0041261e
mov eax, dword [eax]
sub eax, 0xd783
cmp dword [esi], eax
jge 0x44ab14
mov dword [ebp - 8], 1
jmp 0x44ab18
and dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.0041261e
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
jle 0x44ab32
mov dword [ebp - 0xc], 1
jmp 0x44ab36
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xfbb6
jge 0x44ab48
mov dword [ebp - 0x14], 1
jmp 0x44ab4c
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x14]
cmp eax, 0x3ec3
je 0x44ab63
mov dword [ebp - 0x18], 1
jmp 0x44ab67
and dword [ebp - 0x18], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.0041261e
mov esi, dword [eax]
add esi, dword [ebp - 0x18]
push 0
mov ecx, dword [ebp - 4]
call fcn.0041261e
imul esi, dword [eax]
mov eax, dword [ebp - 0x30]
mov dword [eax], esi
jmp 0x44abb5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x34]
push 0x2c17
push 0x54f1
push 0
push dword [ebp - 0x38]
push 0xc15
call fcn.0044a88b
add esp, 0x18
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44abda
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44ac4d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44ac42
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
call fcn.00450222
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x44ac48
call dword [sym.imp.GDI32.dll_GdiFlush]
jmp 0x44ad07
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x40], 0x2971c1e
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0xc], 0xf75d
mov dword [ebp - 8], 0
jmp 0x44ac8d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x44aca0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0
jmp 0x44ac86
mov dword [ebp - 8], 0
jmp 0x44acb0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x44acc3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x58], 0xac54c975
jmp 0x44aca9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44acf4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1cc8
push 0x7d9
push 0x6fc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
push dword [ebp - 0x38]
push 0
call fcn.00435d78
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4617a2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x461827
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4617d7
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x461822
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x461805
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x461822
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0041261e
mov dword [eax], 6
jmp 0x4617fa
jmp 0x461926
push 1
lea ecx, [ebp - 0x38]
call fcn.0041257d
mov dword [ebp - 8], 0
jmp 0x461841
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x46185a
push dword [ebp - 8]
lea ecx, [ebp - 0x38]
call fcn.0041261e
mov dword [eax], 1
jmp 0x46183a
push 0
lea ecx, [ebp - 0x38]
call fcn.0041261e
and dword [eax], 0
jmp 0x461881
push 0
lea ecx, [ebp - 0x38]
call fcn.0041261e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x38]
call fcn.0041261e
cmp dword [eax], 0x12
jle 0x4618c3
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x48]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x48], eax
jmp 0x461869
push 0
lea ecx, [ebp - 0x38]
call fcn.0041261e
mov eax, 0x149cec79
test eax, eax
jb 0x4618df
mov dword [ebp - 0x10], 1
jmp 0x4618e3
and dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x38]
call fcn.0041261e
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jne 0x4618fd
mov dword [ebp - 0x14], 1
jmp 0x461901
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x14]
add esi, 0x247adf1a
push 0
lea ecx, [ebp - 0x38]
call fcn.0041261e
mov dword [eax], esi
lea ecx, [ebp - 0x38]
call fcn.00412619
push 0
call fcn.00460fc8
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4626ec
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x462745
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x462725
push 0
push 0xea9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x462743
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x462743
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x462798
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x462781
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x46277f
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x462798
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret