joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418019
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x42a5a2
call fcn.0041e7dc
mov eax, 0x1030
call fcn.0041ec00
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x1048], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x64ab18
push 0x80000001
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xf
pop edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [esp + 0x1048], ebx
xor ebp, ebp
inc ebp
mov dword [esp + 0x1c], ebp
test eax, eax
jne 0x41810f
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x1068]
mov dword [esp + 0x24], 0x1000
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x3c], bl
test eax, eax
jne 0x418105
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 2
ja 0x418105
push ecx
lea eax, [esp + 0x40]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004024bb
mov dword [esp + 0x1048], ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00410bde
mov byte [esp + 0x1048], bl
lea ecx, [esp + 0x20]
call fcn.00402161
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1040]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41a879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [0x64a120]
push edi
test edx, edx
je 0x41a8a3
lea eax, [edx - 1]
shr eax, 2
inc eax
imul ecx, ecx, 0x4848c0c0
xor ecx, esi
sub edx, 4
dec eax
jne 0x41a895
mov eax, dword [ebp + 8]
shr edx, 2
lea edi, [eax + edx*4]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x41a8d4
dec edx
shr edx, 2
inc edx
imul ecx, ecx, 0x4848c0c0
xor ecx, esi
mov eax, ecx
not eax
xor dword [edi], eax
lea edi, [edi + 4]
dec edx
je 0x41a8d4
mov esi, dword [0x64a120]
jmp 0x41a8b8
pop edi
pop esi
pop ebp
ret
Function at 0x4261b3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x649b10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.0041b16e]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041f77e
mov dword [ebp - 0x14], eax
cmp dword [0x64fb78], edi
jne 0x4262a4
push 0x800
push edi
push 0x42d298
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x426231
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x426384
push 0x42d298
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x426384
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x426384
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x64fb78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x64fb7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x64fb80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x64fb88], eax
test eax, eax
je 0x4262a1
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x64fb84], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4262c9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4262bc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4262de
push 4
pop eax
jmp 0x426386
cmp dword [ebp - 0x14], edi
je 0x4262de
push dword [0x64fb78]
call dword [fcn.0041b172]
push 3
jmp 0x4262c3
mov eax, dword [0x64fb84]
mov ebx, dword [fcn.0041b172]
cmp eax, esi
je 0x42633c
cmp dword [0x64fb88], esi
je 0x42633c
push eax
call ebx
push dword [0x64fb88]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42633c
test eax, eax
je 0x42633c
call ecx
test eax, eax
je 0x426331
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x426331
test byte [ebp - 8], 1
jne 0x42633c
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x42636c
mov eax, dword [0x64fb7c]
cmp eax, esi
je 0x426369
push eax
call ebx
test eax, eax
je 0x426369
call eax
mov edi, eax
test edi, edi
je 0x426369
mov eax, dword [0x64fb80]
cmp eax, esi
je 0x426369
push eax
call ebx
test eax, eax
je 0x426369
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x64fb78]
call ebx
test eax, eax
je 0x426384
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x426386
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f4df
leave
ret
Function at 0x100036f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10003749
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003749
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000373a
cmp esi, edx
jae 0x10003749
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10003728
cmp esi, edx
jae 0x10003749
cmp word [esi], 0
je 0x10003749
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10004380
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
jne 0x100043aa
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push dword [ebp + 8]
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x100043b1
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0xc]
push eax
call fcn.10006a50
int3
Function at 0x1002dc00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4200
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x1002dcdb
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x1002dcdb
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x1002dc90
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.10005291
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1002dd0b
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1002dd22
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x1002dd44
cmp eax, esi
jne 0x1002dd2a
mov dword [ecx], edi
jmp 0x1002dd44
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1002dd44
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1002e4e0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002e160
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013d0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], eax
mov dword [eax], 1
je 0x1002e294
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push 0x10
mov dword [ebp - 0x208], ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1b7
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1d4
mov ebx, esi
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1ef
mov ebx, esi
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10143cdc]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10144758]
cmp eax, dword [ecx + 4]
jg 0x1002e2a6
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x1014473c]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x10144744]
and esi, dword [0x10144750]
mov edi, dword [ecx + esi*8]
mov eax, edi
nop
cmp edi, edx
jne 0x1002e268
mov ecx, edx
jmp 0x1002e26e
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e291
cmp dword [eax + 8], ebx
je 0x1002e281
mov eax, dword [eax]
mov ecx, dword [0x10144744]
jmp 0x1002e260
cmp eax, edx
je 0x1002e291
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 0x20
push 0x10144758
call fcn.1000507a
add esp, 4
cmp dword [0x10144758], 0xffffffff
jne 0x1002e210
mov ecx, 0x80
mov dword [0x10144738], 0
mov esi, 0x100ff040
mov dword [0x1014473c], 0
lea edi, [ebp - 0x204]
mov dword [0x10144740], 0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, 0x1014473c
call fcn.1002e4b0
push 8
mov ecx, 0x10144738
mov dword [0x1014473c], eax
mov dword [0x10144744], 0
mov dword [0x10144748], 0
mov dword [0x1014474c], 0
mov dword [0x10144738], 0x3f800000
call fcn.1002e580
lea edi, [ebp - 0x204]
jmp 0x1002e340
mov eax, dword [0x1014473c]
mov ecx, 0x1014473c
push edi
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x20c], eax
call fcn.1002db60
mov edx, dword [0x10144740]
mov ecx, 0x15555554
sub ecx, edx
mov dword [ebp - 0x210], eax
cmp ecx, 1
jb 0x1002e3d0
mov ecx, dword [ebp - 0x210]
inc edx
mov dword [0x10144740], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
mov ecx, 0x10144738
mov eax, dword [0x1014473c]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1002dc00
add edi, 4
lea eax, [ebp - 4]
cmp edi, eax
jne 0x1002e340
push 0x100f22d0
call fcn.100055de
push 0x10144758
call fcn.10005030
add esp, 8
jmp 0x1002e210
push str.list_T__too_long
call fcn.100be607
int3
Function at 0x1002e840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1002e8b3
cmp eax, edi
jne 0x1002e8ab
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1002e8bb
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1002e8bb
cmp eax, edi
jne 0x1002e8be
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.10005291
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10031790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0xc], ebx
jb 0x100317af
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100317d1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100317c0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebp - 0x14], eax
cmp edx, ebx
jne 0x100317fb
mov eax, ebx
jmp 0x100317ff
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x100318ab
cmp dword [edi + 0x14], 0x10
lea ecx, [esi + 8]
mov edx, edi
jb 0x10031814
mov edx, dword [edi]
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x1003181f
mov ecx, dword [ecx]
cmp edi, dword [ebp - 0xc]
jne 0x10031880
sub edi, 4
jb 0x10031841
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10031846
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10031830
cmp edi, 0xfffffffc
je 0x1003187a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10031873
cmp edi, 0xfffffffd
je 0x1003187a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10031873
cmp edi, 0xfffffffe
je 0x1003187a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10031873
cmp edi, 0xffffffff
je 0x1003187a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1003187a
sbb eax, eax
or eax, 1
jmp 0x1003187c
xor eax, eax
test eax, eax
je 0x10031890
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x100317f3
mov edi, dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, dword [ebp - 8]
push eax
push edi
call fcn.10032240
test al, al
mov ecx, ebx
cmove ecx, esi
mov eax, ecx
jmp 0x100318af
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x1003190f
mov esi, dword [ebx]
lea eax, [ebp - 1]
mov ebx, dword [ebp - 8]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x100ff25c
push edi
push esi
lea ecx, [ebx + 4]
call fcn.100304e0
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10031921
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.100305d0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.100be607
int3
Function at 0x10031930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1003194c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10031968
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10031957
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100319a1
cmp eax, edi
jne 0x10031999
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100319a9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100319a9
cmp eax, edi
jne 0x100319a9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10031d50
push 0x24
push edi
call fcn.10005291
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10038b40
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e504c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10143cdc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1014479c]
mov dword [ebp - 0x1c], ecx
cmp eax, dword [ecx + 4]
jg 0x10038bc2
cmp byte [0x10144798], 0
mov ecx, str.FALSE
mov eax, str.TRUE
cmove eax, ecx
push eax
push str.isThisWindowsServiceContext___s
push 0
call fcn.10045440
mov al, byte [0x10144798]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1014479c
call fcn.1000507a
add esp, 4
cmp dword [0x1014479c], 0xffffffff
jne 0x10038b87
xor esi, esi
mov dword [ebp - 4], 0
push str.Entering_DetectIfService__
push esi
mov byte [ebp - 0xd], 0
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call fcn.10045430
add esp, 8
push 4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x10038c16
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10038cda
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 1
push 0x3b
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x10038c3b
test esi, esi
jne 0x10038c62
jmp 0x10038c3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x10038cda
add edi, dword [ebp - 0x14]
push esi
call fcn.1000e7ac
push edi
call fcn.1001161f
add esp, 8
mov esi, eax
jmp 0x10038c16
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x10144794]
cmp eax, dword [ecx + 4]
jle 0x10038ca2
push 0x10144794
call fcn.1000507a
add esp, 4
cmp dword [0x10144794], 0xffffffff
jne 0x10038ca2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x10144794
mov dword [0x10144790], eax
call fcn.10005030
add esp, 4
jmp 0x10038ca2
mov edi, dword [ebp - 0x18]
xor eax, eax
test edi, edi
je 0x10038cda
lea ecx, [esi + 0x24]
jmp 0x10038cb0
mov edx, dword [ecx]
cmp dword [0x10144790], edx
je 0x10038cc4
inc eax
add ecx, 0x2c
cmp eax, edi
jb 0x10038cb0
jmp 0x10038cda
push edx
push str.Service_PID__u_matches_ADAL_PID._ADAL_is_running_within_a_service_context.
push 0
mov byte [ebp - 0xd], 1
call fcn.10045440
add esp, 0xc
jmp 0x10038cda
push str.No_service_PID_found_matching_the_ADAL_PID__so_ADAL_is_NOT_running_within_a_service_context
push 0
call fcn.10045430
add esp, 8
test ebx, ebx
je 0x10038cf6
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10038cf6
test esi, esi
je 0x10038d05
push esi
call fcn.1000e7ac
add esp, 4
jmp 0x10038d05
mov al, byte [ebp - 0xd]
push 0x1014479c
mov byte [0x10144798], al
mov dword [ebp - 4], 0xffffffff
call fcn.10005030
add esp, 4
jmp 0x10038b87
Function at 0x10047ab0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.10002710
mov edi, eax
test edi, edi
je 0x10047c8c
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 2
call fcn.10002710
mov ebx, eax
test ebx, ebx
je 0x10047c96
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x100f4524]
mov ecx, ebx
call edi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov byte [ebp - 4], 3
jge 0x10047b5a
push 0x104
lea ecx, [ebp - 0x14]
call fcn.10003450
mov esi, dword [ebp - 0x14]
cmp dword [esi - 8], 0x104
jl 0x10047ca0
push 0x104
xor eax, eax
mov dword [esi - 0xc], 0x104
push esi
mov word [esi + 0x208], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10047caa
cmp eax, 0x103
jbe 0x10047ba6
push eax
push eax
lea ecx, [ebp - 0x14]
call fcn.10047ce0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [ebp - 0x14]
lea ebx, [esi - 0x10]
test esi, esi
jne 0x10047bb1
xor eax, eax
jmp 0x10047bc5
push dword [ebx + 8]
push esi
call fcn.1001174c
add esp, 8
test eax, eax
js 0x10047ca0
cmp eax, dword [ebx + 8]
jg 0x10047ca0
push dword [ebp + 8]
mov dword [ebx + 4], eax
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10036f80
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.1002ee20
mov ecx, dword [ebp - 0x1c]
or edi, 0xffffffff
add ecx, 0xfffffff0
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x10047c23
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
or edi, 0xffffffff
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, edi
setne byte [ebp - 0xd]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10047c59
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
or edi, 0xffffffff
lock xadd dword [ebx + 0xc], edi
dec edi
test edi, edi
jg 0x10047c77
mov edi, dword [ebx]
push ebx
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002de0
push 0x80004005
call fcn.10002de0
push 0x80070057
call fcn.10002de0
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.10048470
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x28]
push eax
call fcn.10006a50
int3