joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef920
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi]
xor ebx, ebx
call dword [eax + 8]
mov ebp, eax
cmp ebp, 1
mov dword [esp + 0x10], ebp
jl 0x4efa4f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.004ef8f0
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [esp + 0x1c], eax
cmp ebp, ecx
jl 0x4efa02
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
fild qword [esp + 0x14]
mov dword [esp + 0x24], ecx
fstp dword [esp + 0x14]
fild qword [esp + 0x20]
fstp dword [esp + 0x2c]
fild dword [esp + 0x10]
fstp dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
fild qword [esp + 0x20]
fsub dword [esp + 0x14]
fdiv dword [esp + 0x2c]
fmul dword [esp + 0x10]
call fcn.004a59d0
mov edi, eax
cmp ebx, edi
je 0x4ef9fc
cmp edi, ebp
jg 0x4ef9fc
test edi, edi
jle 0x4ef9fc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4ef9f0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4ef9f0
mov eax, dword [eax]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 4]
inc dword [esp + 0x30]
cmp edi, ebp
mov ebx, edi
jle 0x4ef9a0
cmp edi, ebp
je 0x4efa12
mov eax, dword [esi]
push ebp
mov ecx, esi
call dword [eax + 4]
inc dword [esp + 0x30]
fild dword [esp + 0x30]
fstp dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], 0
sub eax, ecx
mov dword [esp + 0x20], eax
fild qword [esp + 0x20]
fmul dword [0x514a38]
fdivr dword [esp + 0x30]
call fcn.004a59d0
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x34], eax
call dword [edx + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4f5600
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x100
lea eax, [esp]
push 0xff
push eax
call sub.WSOCK32.dll_gethostname
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x108]
call fcn.004fcee6
lea edx, [esp]
push edx
call sub.WSOCK32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call sub.WSOCK32.dll_inet_ntoa
mov ecx, dword [esp + 0x108]
push eax
call fcn.004fcee6
add esp, 0x100
ret

Function at 0x4f6364
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4f6384
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a8967
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4f63a7
test byte [esp + 8], 2
je 0x4f63a7
call fcn.004a89da
mov dword [eax], 0xd
call fcn.004a89e3
mov dword [eax], 5
jmp 0x4f6380
xor eax, eax
ret

Function at 0x4fff6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4fffac
call fcn.0050731a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4fffac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4fffa3
xor eax, eax
jmp 0x4fffb4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004fffba
pop edi
pop esi
pop ebx
ret 4
Function at 0x502a34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x50b2e0
call fcn.004a6b00
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0050731a
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x502a73
call fcn.0050731a
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x502a81
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x502a8f
or eax, 0xffffffff
jmp 0x502b77
mov ecx, esi
call fcn.005029aa
mov dword [ebp - 0x14], eax
call fcn.004fe4fd
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x502ac6
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x502ac6
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.004fe4b1
push dword [ebp - 0x14]
call fcn.004fdffe
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0050277b
cmp eax, edi
je 0x502b39
test byte [esi + 0x24], 0x10
je 0x502b07
push 4
mov ecx, esi
pop ebx
call fcn.00500b0d
test ah, 1
je 0x502aff
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.005000bc
cmp dword [esi + 0x1c], edi
je 0x502b39
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00500b41
jmp 0x502b39
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x502b4d
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x502b66
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x502b66
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.005029e4
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x505724
Capabilities:
Create http request

Disassembly:
mov eax, 0x508e98
call fcn.004a6b00
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x50575c
call fcn.0050731a
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x505781
push eax
push dword [esi + 4]
call fcn.00506364
jmp 0x50578d
push esi
push eax
mov ecx, 0x53efa0
call fcn.0050579e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x505a4f
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x508ef7
call fcn.004a6b00
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005020b7
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x52c668]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.004fcee6
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004fcee6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0xb74058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xb741a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb7407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7406a
add dl, dl
jne 0xb74089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb740dc
xor eax, eax
add dl, dl
jne 0xb74096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7417d
add dl, dl
jne 0xb740a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb740b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb740bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb740c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb740d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb74075
mov eax, 1
add dl, dl
jne 0xb740ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb740f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb740e1
sub eax, ebx
mov ebx, 1
jne 0xb74128
mov ecx, 1
add dl, dl
jne 0xb7410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb74119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb74105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb74075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb7413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb7414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb74136
cmp eax, 0x7d00
jae 0xb7416d
cmp eax, 0x500
jb 0xb74168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb74075
cmp eax, 0x7f
ja 0xb74170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb74075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb7419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb74075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10012156
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080ad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001218f
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1001218d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10012206
push 2
lea ecx, [ebp - 0x2c]
call fcn.10016765
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], 0x95364446
mov dword [ebp - 0x14], 0
jmp 0x100121bb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100121d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.100167d2
mov dword [eax], 0xfffffff7
jmp 0x100121b4
mov dword [ebp - 0x18], 0
jmp 0x100121e4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x100121fa
mov dword [ebp - 0x1c], 0xfffffffd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x100121dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100167cd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10012214
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012232
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1001224a
push 0
push 0x216f
push 0
push 0
push 0x1176
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1001bb5d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001bb91
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.100167d2
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1001bbb5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001bbb5
push 0
push 0x216f
push 0
push 0
push 0x1176
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x1001bbb9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001bbd1
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001bc1c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001bbff
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001bc1c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167d2
mov dword [eax], 0xd364bfa3
jmp 0x1001bbf4
mov esp, ebp
pop ebp
ret
Function at 0x1001bc93
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001bcc4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1001bcbf
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001be55
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001bd0a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffffd
je 0x1001be55
mov dword [ebp - 8], 0
mov dword [ebp - 0x58], 0xec0dcee0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1001bdba
cmp dword [ebp - 8], 0xffffffff
ja 0x1001bd3f
mov dword [ebp - 0x10], 1
jmp 0x1001bd43
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 1
jle 0x1001bd52
mov dword [ebp - 0x14], 1
jmp 0x1001bd56
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jle 0x1001bd67
mov dword [ebp - 0x18], 1
jmp 0x1001bd6b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x1001bd87
mov eax, 0x8716
test eax, eax
je 0x1001bd87
mov dword [ebp - 0x1c], 1
jmp 0x1001bd8b
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c], eax
jne 0x1001bd9c
mov dword [ebp - 0x20], 1
jmp 0x1001bda0
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x1001bdb1
mov eax, 0xaf86f25d
test eax, eax
je 0x1001bdba
mov dword [ebp - 0xc], 1
jmp 0x1001bdbe
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0x9953e80c
jbe 0x1001bdd8
mov dword [ebp - 0x24], 1
jmp 0x1001bddc
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
cmp dword [eax], 1
ja 0x1001bdfa
mov dword [ebp - 0x50], 1
jmp 0x1001bdfe
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 8], 0
jne 0x1001be20
cmp dword [ebp - 8], 0
jne 0x1001be20
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0
jne 0x1001be20
and dword [ebp - 0x2c], 0
jmp 0x1001be27
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2c], eax
jne 0x1001be43
cmp dword [ebp - 8], 0
jne 0x1001be43
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
jne 0x1001be43
and dword [ebp - 0x34], 0
jmp 0x1001be4a
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
jmp 0x1001bcff
mov esp, ebp
pop ebp
ret
Function at 0x10026ff1
Capabilities:
Create thread
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10027018
push 0
push 0x216f
push 0
push 0
push 0x1176
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10027038
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10027038
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret
Function at 0x10028bf2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028c23
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10028c1e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10028db4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10028c69
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffffd
je 0x10028db4
mov dword [ebp - 8], 0
mov dword [ebp - 0x58], 0xec0dcee0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10028d19
cmp dword [ebp - 8], 0xffffffff
ja 0x10028c9e
mov dword [ebp - 0x10], 1
jmp 0x10028ca2
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 1
jle 0x10028cb1
mov dword [ebp - 0x14], 1
jmp 0x10028cb5
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jle 0x10028cc6
mov dword [ebp - 0x18], 1
jmp 0x10028cca
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x10028ce6
mov eax, 0x8716
test eax, eax
je 0x10028ce6
mov dword [ebp - 0x1c], 1
jmp 0x10028cea
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c], eax
jne 0x10028cfb
mov dword [ebp - 0x20], 1
jmp 0x10028cff
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x10028d10
mov eax, 0xaf86f25d
test eax, eax
je 0x10028d19
mov dword [ebp - 0xc], 1
jmp 0x10028d1d
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0x9953e80c
jbe 0x10028d37
mov dword [ebp - 0x24], 1
jmp 0x10028d3b
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
cmp dword [eax], 1
ja 0x10028d59
mov dword [ebp - 0x50], 1
jmp 0x10028d5d
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 8], 0
jne 0x10028d7f
cmp dword [ebp - 8], 0
jne 0x10028d7f
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0
jne 0x10028d7f
and dword [ebp - 0x2c], 0
jmp 0x10028d86
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2c], eax
jne 0x10028da2
cmp dword [ebp - 8], 0
jne 0x10028da2
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
jne 0x10028da2
and dword [ebp - 0x34], 0
jmp 0x10028da9
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
jmp 0x10028c5e
mov esp, ebp
pop ebp
ret
Function at 0x10029da6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029df7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x10029e10
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029e10
push 0x2169
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x1002c652
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002c66a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002c6b5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002c698
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002c6b5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167d2
mov dword [eax], 0x633933b8
jmp 0x1002c68d
mov esp, ebp
pop ebp
ret
Function at 0x1002e3cb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x7330
push 1
lea eax, [ebp - 0x10]
push eax
push 0x4b8d
call fcn.1002e15c
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002e405
xor eax, eax
jmp 0x1002e532
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002e423
xor eax, eax
jmp 0x1002e532
push 1
push dword [ebp - 8]
push 0x1bd2
lea eax, [ebp - 0xc]
push eax
call fcn.1002d93f
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002e446
xor eax, eax
jmp 0x1002e532
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002e1da
add esp, 0x18
push 0
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10026429
add esp, 0x10
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x2a04
call fcn.1002e271
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x1002e4af
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x543f
push 1
call fcn.1002e300
add esp, 0x10
push dword [ebp - 4]
call fcn.1002d81d
pop ecx
test eax, eax
jne 0x1002e4c0
xor eax, eax
jmp 0x1002e532
push 0x3c0a
push 0x6683
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002e36c
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002e51a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002e4f7
xor eax, eax
jmp 0x1002e532
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002e510
xor eax, eax
jmp 0x1002e532
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002e52b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002e52f
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1003fb42
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003fb6a
push 0
push 0x216f
push 0
push 0
push 0x1176
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1003fbc2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003fb8c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffffd
jge 0x1003fbc2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003fbc0
push 0
push 0xdb2
push 0x14c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x1003fb81
mov esp, ebp
pop ebp
ret