joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19cc4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x19d43
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 4]
inc edx
lea eax, [ebp - 8]
call fcn.00014008
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00013ea4
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x19d16
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00014008
jmp 0x19d23
lea eax, [ebp - 8]
mov edx, 0x19d58
call fcn.00013aec
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00013aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x19d4a
lea eax, [ebp - 8]
call fcn.00013a54
ret

Function at 0x19d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00013e98
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x19d89
test al, 0x10
jne 0x19d8d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x1a60c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1a6e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x1a6f8
call fcn.00013aa8
xor edx, edx
push ebp
push 0x1a6b3
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00014008
push 0x3ff
mov eax, dword [ebp - 8]
call fcn.00013e98
push eax
push 0x1a704
call sub.kernel32.dll_GetEnvironmentVariableA
cmp eax, 3
jl 0x1a677
cmp eax, 0x3ff
jl 0x1a68a
push 0x3ff
mov eax, dword [ebp - 8]
call fcn.00013e98
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jle 0x1a6a9
cmp eax, 0x3ff
jge 0x1a6a9
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00014008
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00013aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1a6ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1a6e7
lea eax, [ebp - 8]
call fcn.00013a54
ret
Function at 0x1abc8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x1ac87
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov eax, 0x400
call fcn.000126e0
mov ebx, eax
mov edx, 0x1ac98
mov eax, ebx
call fcn.00018e60
push 0x3ff
push ebx
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
call fcn.00018e28
test eax, eax
jbe 0x1ac65
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00013c0c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0001902c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x1aca4
call fcn.00013d20
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 2]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00013e98
lea ecx, [ebp - 4]
lea edx, [ebp - 6]
call fcn.000196d8
movzx eax, word [ebp - 6]
shl eax, 0x10
movzx edx, word [ebp - 4]
add eax, edx
mov esi, eax
mov eax, ebx
call fcn.000126f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ac8e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00013a78
ret

Function at 0x1acd8
Capabilities:
Delete registry value

Disassembly:
push ecx
xor eax, eax
mov dword [esp], eax
push esp
mov eax, dword [0x6f18c]
add eax, 0xf003f
push eax
push 0
push 0x1ad54
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [esp], 0
je 0x1ad41
test eax, eax
jne 0x1ad41
push 0x1ad8c
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x1ad9c
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x1adb0
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x1adc0
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
cmp dword [esp], 0
je 0x1ad50
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edx
ret
Function at 0x1ae74
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x1af9b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00014084
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x400
call fcn.000126e0
mov ebx, eax
mov edx, 0x400
mov eax, ebx
call fcn.000175a4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x1afac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x1af4c
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x3ff
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1aff0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x1af4c
cmp dword [ebp - 0x10], 1
jne 0x1af4c
lea eax, [ebp - 4]
mov edx, ebx
call fcn.000141dc
mov eax, dword [ebp - 4]
call fcn.0001bb64
test al, al
jne 0x1af4c
mov eax, 0x800
call fcn.000126e0
mov edi, eax
push 0x3ff
push edi
push 0x1b010
call sub.kernel32.dll_GetEnvironmentVariableW
cmp eax, 3
jbe 0x1af45
lea eax, [ebp - 4]
mov edx, edi
call fcn.000141dc
mov eax, edi
call fcn.000126f8
mov eax, dword [ebp - 4]
call fcn.0001bb64
test al, al
jne 0x1af60
lea eax, [ebp - 4]
call fcn.000192cc
cmp dword [ebp - 0xc], 0
je 0x1af6f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.000126f8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.000140c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1afa2
lea eax, [ebp - 4]
call fcn.00014084
ret

Function at 0x1bb64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00014684
xor eax, eax
push ebp
push 0x1bbb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.000142b4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1bb99
test al, 0x10
jne 0x1bb9d
xor ebx, ebx
jmp 0x1bb9f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1bbbc
lea eax, [ebp - 4]
call fcn.00014084
ret

Function at 0x1bbc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00014684
xor eax, eax
push ebp
push 0x1bc15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.000142b4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1bbf9
test al, 0x10
je 0x1bbfd
xor ebx, ebx
jmp 0x1bbff
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1bc1c
lea eax, [ebp - 4]
call fcn.00014084
ret
Function at 0x22f80
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x230cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x230a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x22fd7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6f700], 0
je 0x22fcd
mov eax, dword [0x6f700]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x22fe1
xor eax, eax
mov dword [0x6f700], eax
xor eax, eax
push ebp
push 0x23014
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6f6f8], 0
je 0x2300a
mov eax, dword [0x6f6f8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2301e
xor eax, eax
mov dword [0x6f6f8], eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00018ef8
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x230e4
call fcn.00013d20
mov eax, dword [ebp - 8]
call fcn.00013e98
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x6f6f8], eax
cmp dword [0x6f6f8], 0
je 0x23097
push 0
push 0
push 0
push 4
mov eax, dword [0x6f6f8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x6f700], eax
cmp dword [0x6f700], 0
jne 0x23097
mov eax, dword [0x6f6f8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x6f6f8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x230b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x230d4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00013a78
ret

Function at 0x23204
Capabilities:
Delete registry value

Disassembly:
push ebx
push ecx
push esp
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x23270
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
cmp dword [esp], 0
je 0x2325c
push 0x232b0
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x232c0
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x232cc
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov ebx, eax
cmp dword [esp], 0
je 0x2326b
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x232d8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [0x6f714]
call fcn.000126e0
mov edx, dword [ebp + 8]
mov dword [edx - 0x1c], eax
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [0x6f714]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
push eax
call sub.kernel32.dll_ReadFile_1
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x24], eax
lea edx, [ebp - 4]
mov eax, 0x6f700
mov ecx, 4
call fcn.000127f8
add dword [ebp - 4], 0x138
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp eax, dword [0x6f714]
jne 0x233f8
mov eax, dword [0x72944]
add eax, 0x107884
add eax, 0x400
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
push 0
mov eax, dword [0x6f714]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp + 8]
lea edx, [eax - 8]
mov eax, dword [ebp - 4]
call fcn.0002206c
mov edx, dword [ebp + 8]
mov dword [edx - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x28], 0
jne 0x233f8
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
xor ecx, ecx
mov edx, 0x10
call fcn.000129f0
cmp dword [0x72940], 7
jne 0x233cd
lea ecx, [ebp - 0x14]
mov edx, dword [0x72944]
add edx, 0x107884
mov eax, dword [ebp - 4]
call fcn.000187ec
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x14]
lea edi, [eax - 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edx, 0x72930
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
mov ecx, 0x10
call fcn.00018e40
test al, al
je 0x233f8
mov bl, 1
mov eax, 0x6f6e8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x2c]
call fcn.000140c0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
mov edx, dword [0x6f714]
call fcn.000126f8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x243e8
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013e88
xor eax, eax
push ebp
push 0x24543
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov edx, 0x2455c
call fcn.00013d20
mov eax, dword [ebp - 0x24]
call fcn.0002438c
push 0
call sub.kernel32.dll_SetLastError
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x2444f
push 0
call sub.kernel32.dll_SetLastError
call fcn.00024368
mov ebx, eax
test esi, esi
je 0x244f2
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00013e98
push eax
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x2447f
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x2448a
call fcn.00024368
mov ebx, eax
test edi, edi
je 0x244d6
mov eax, 0x24578
call fcn.0002438c
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x244af
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x244ba
call fcn.00024368
mov ebx, eax
push edi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x244cb
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x244d6
call fcn.00024368
mov ebx, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x244e7
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x244f2
call fcn.00024368
mov ebx, eax
mov esi, ebx
push 0
call sub.kernel32.dll_SetLastError
mov eax, ebx
cdq
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00018ef8
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x2458c
call fcn.00013d20
mov eax, dword [ebp - 0x28]
call fcn.0002438c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2454a
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00013a78
lea eax, [ebp - 4]
call fcn.00013a54
ret
Function at 0x24754
Capabilities:
Delete file
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x24952
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00013c0c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x2496c
call fcn.00013d20
mov eax, dword [ebp - 0xc]
call fcn.0002438c
or ebx, 0xffffffff
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 4]
mov edx, esi
call fcn.00013c0c
mov eax, dword [ebp - 4]
call fcn.00013cd4
cmp eax, 2
jl 0x24819
mov eax, dword [ebp - 4]
cmp byte [eax], 0x22
jne 0x247cd
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00013f1c
mov eax, dword [ebp - 4]
call fcn.00013cd4
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x22
jne 0x247f6
mov eax, dword [ebp - 4]
call fcn.00013cd4
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00013f1c
mov eax, dword [ebp - 4]
call fcn.00013e98
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x24811
call fcn.00024368
mov ebx, eax
jmp 0x24813
xor ebx, ebx
push ebx
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x24988
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x24888
push 0x249cc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x24865
mov eax, 0x249e8
call fcn.0002438c
call fcn.00024368
push 0x24a14
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x24897
mov eax, 0x24a2c
call fcn.0002438c
call fcn.00024368
jmp 0x24897
mov eax, 0x24a60
call fcn.0002438c
call fcn.00024368
cmp dword [ebp - 8], 0
je 0x248a6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x24a8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x24900
lea eax, [ebp - 0x14]
call fcn.00024284
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
je 0x2490f
mov eax, 0x24acc
call fcn.0002438c
call fcn.00024368
jmp 0x2490f
mov eax, 0x24b00
call fcn.0002438c
call fcn.00024368
cmp dword [ebp - 8], 0
je 0x2491e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0
call sub.kernel32.dll_SetLastError
mov eax, 0x24b34
call fcn.0002438c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x24959
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00013a78
lea eax, [ebp - 4]
call fcn.00013a54
ret
Function at 0x24b4c
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013e88
xor eax, eax
push ebp
push 0x24d0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00013c0c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x24d28
call fcn.00013d20
mov eax, dword [ebp - 0x14]
call fcn.0002438c
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, 0x5000
call fcn.000126e0
mov edi, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x24bcf
push 0
call sub.kernel32.dll_SetLastError
call fcn.00024368
mov ebx, eax
test esi, esi
je 0x24cb5
mov eax, 0x24d54
call fcn.0002438c
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00013e98
push eax
push esi
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x24c0c
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x24c17
call fcn.00024368
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x24c99
lea eax, [ebp - 0xc]
push eax
push 0xa
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
jne 0x24c6f
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x24c6f
mov eax, 0x24d6c
call fcn.0002438c
add dword [ebp - 0xc], 0x64
cmp dword [ebp - 0xc], 0x5000
ja 0x24c6f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x24c6f
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x24c7a
call fcn.00024368
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x24c8e
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x24c99
call fcn.00024368
mov ebx, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x24caa
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x24cb5
call fcn.00024368
mov ebx, eax
test ebx, ebx
jne 0x24cc6
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 8]
call fcn.00018e60
jmp 0x24cd3
mov edx, 0x24d78
mov eax, dword [ebp - 8]
call fcn.00018e60
mov eax, edi
call fcn.000126f8
push 0
call sub.kernel32.dll_SetLastError
mov eax, 0x24d84
call fcn.0002438c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x24d15
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00013a78
lea eax, [ebp - 4]
call fcn.00013a54
ret

Function at 0x2639c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00013e98
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret
Function at 0x26e44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x26e7d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00013b3c
jmp 0x26e86
mov eax, ebx
mov edx, esi
call fcn.00013aa8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x26e90
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x26eb1
mov al, byte [esp]
jmp 0x26eb3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x331cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00017588
cmp ax, 0xffff
jne 0x331ed
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x3326e
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x3326e
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x33234
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x33227
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x3326e
cmp dword [ebp + 8], 0
jle 0x3326e
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00032ac8
mov esi, eax
test esi, esi
jle 0x33265
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0001759c
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x34100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x3415c
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x3412b
call fcn.00036ba4
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.000127f8
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x3415c
call fcn.00036ba4
add esp, 0x14
pop edi
pop esi
pop ebx
ret