joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fc90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44fcc3
push esi
call fcn.0045e030
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44fcbc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44fd49
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44fd32
mov eax, dword [esi + 8]
test eax, eax
je 0x44fce7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44fd2e
cmp eax, 2
je 0x44fd32
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44fcda
cmp eax, 3
je 0x44fd0d
cmp eax, 1
jne 0x44fcda
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44fcda
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44fcda
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044fd70
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44fd58
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044fd70
add esp, 4
pop esi
ret

Function at 0x4505e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x450601
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x450601
mov eax, dword [eax + 0x44]
test eax, eax
je 0x450601
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x47e18b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47e1c3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047c242
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047c21a
jmp 0x47e1cf
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47f879
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47f8bb
call fcn.00485335
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47f8bb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47f8b2
xor eax, eax
jmp 0x47f8c3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047f8c9
pop edi
pop esi
pop ebx
ret 4
Function at 0x485865
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x485893
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4858b1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004857cb
jmp 0x4858b1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4858b1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004857cb
test edi, edi
mov eax, edi
jne 0x48589b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x2df97e7d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4500c9e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
mov ecx, 0x4fa94024
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x2c846c58
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c004]
jne 0x401010
repz ret
jmp fcn.0040161b

Function at 0x407cd6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404e6b
and dword [ebp - 4], 0
cmp dword [0x41e184], 0
mov ebx, eax
jne 0x407d87
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407e38
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407e38
push eax
call fcn.00404df9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e184], eax
call esi
push eax
call fcn.00404df9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e188], eax
call esi
push eax
call fcn.00404df9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41e18c], eax
call esi
push eax
call fcn.00404df9
pop ecx
mov dword [0x41e194], eax
test eax, eax
je 0x407d87
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404df9
pop ecx
mov dword [0x41e190], eax
mov eax, dword [0x41e190]
cmp eax, ebx
je 0x407ddf
cmp dword [0x41e194], ebx
je 0x407ddf
push eax
call fcn.00404e74
push dword [0x41e194]
mov esi, eax
call fcn.00404e74
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407ddf
test edi, edi
je 0x407ddf
call esi
test eax, eax
je 0x407dd6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407dd6
test byte [ebp - 0xc], 1
jne 0x407ddf
or dword [ebp + 0x10], 0x200000
jmp 0x407e18
mov eax, dword [0x41e188]
cmp eax, ebx
je 0x407e18
push eax
call fcn.00404e74
pop ecx
test eax, eax
je 0x407e18
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407e18
mov eax, dword [0x41e18c]
cmp eax, ebx
je 0x407e18
push eax
call fcn.00404e74
pop ecx
test eax, eax
je 0x407e18
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e184]
call fcn.00404e74
pop ecx
test eax, eax
je 0x407e38
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407e3a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xed5844
Capabilities:
Encode data using xor

Disassembly:
jmp 0xed584e
pushal
call 0xed5854
pop ebp
sub ebp, 0x10
sub ebp, 0xad5844
jmp 0xed586a
mov eax, 0xad5844
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ba
mov edx, 0x853e8757
xor byte [eax], dl
inc eax
dec ecx
jne 0xed5881
jmp 0xed5894
add byte [eax], al
add ch, bh
das
jmp 0xed58fd
fcomp qword [edx + 0x576bdedc]
push edi
push edi
salc
xchg esi, eax
scasd eax, dword es:[edi]
push edi
push edi
push edi
push esp
lcall 0xed57, 0x575751ef
jg 0xed5903
push edi
push edi
mov al, byte [0xdc9f54b5]
salc
pop ebx
push edi
push edi
push edi
push esp
xchg edx, eax
pop es
fidiv dword [ebx]
jae 0xed586a
ficom word [ebx + 0x73]
aas
pop edi
xlatb
ja 0xed591e
aas
insd dword es:[edi], dx
invalid
aas
sar byte [edx + 0x12], 1
lds edi, [edi + 0x57575752]
mov esi, 0x57575779
fidiv dword [ebx]
jae 0xed588d
fidivr word [ebx + 0x73]
add ecx, dword [edx]
invalid
push ebp
aam 0x95
push ebx
push ds
pop eax
shl byte [ebx + 0xaa8a8a8], cl
xchg ebp, eax
pop ebx
push edi
invalid
jnp 0xed5993
fidiv dword [ebx]
jae 0xed58cf
ficomp word [ebx + 0x73]
mov edi, 0x57575752
mov esi, 0x57575510
fidiv dword [ebx]
jae 0xed58e0
fidivr word [ebx + 0x73]
fidivr dword [ebx]
jae 0xed5993
test al, 0x22
pop ebx
test al, 0x22
pop edi
mov edi, 0x57575725
fsub st(2), st(0)
pop edi
push edi
push edi
push edi
sahf
salc
movsd dword es:[edi], dword [esi]
dec ecx
mov edi, esi
mov bh, 0xd6
movsd dword es:[edi], dword [esi]
dec ecx
mov edi, esi
mov bh, 0x64
test esp, edx
mov edi, 0xd3581f52
sbb dword [edi + 0x57], edx
push edi
pop eax
fistp word [edi]
push edi
push edi
push edi
xor esp, ebx
dec ebx
outsb dx, byte [esi]
xlatb
lodsb al, byte [esi]
mov edi, 0x574dd358
push edi
push edi
xlatb
lodsb al, byte [esi]
mov esi, 0x5746d358
push edi
push edi
xor esi, edx
lodsb al, byte [esi]
test al, 0x72
pop eax
rol dword [edx + 0x57], cl
push edi
push edi
push ss
mov esi, 0xa8a8a89b
jle 0xed59b1
test al, 0x7e
sbb ebp, dword [esi + 0x56]
outsb dx, byte [esi]
push esi
aam 0x96
push edx
aam 0xbf
push ebx
mov esi, 0xa8a8a8ea
jle 0xed59a8
outsb dx, byte [esi]
push ebp
aam 0x96
xchg esi, eax
push ecx
aam 0xbd
push ebx
aam 0xbf
push edx
mov esi, 0xa8a8a8fc
or dl, byte [ebp - 0x23fda8a5]
cld
test al, 0xa8
test al, 0xa
xchg ebp, eax
pop ebx
push edi
add bl, ah
mov ebx, 0xdc020001
and bl, byte [ebx - 0x24]
sub bl, byte [edi - 0x55]
in eax, 0xd7
fst qword [ecx - 0x2a]
xchg ecx, eax
push esi
push edi
push edi
push edi
fist word [eax - 0x2a]
nop
push esi
push edi
push edi
push edi
in al, dx
push ebp
push edi
push edi
push edi
push ebp
test dword [eax - 0x2e], ebx
push edx
push edi
push edi
push edi
fld qword [ecx + 0x11]
inc ebp
test dword [eax - 0x2c], ebx
invalid
Function at 0x1001ed08
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001ed63
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001ed44
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001ed61
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
mov dword [eax], 1
jmp 0x1001ed39
jmp 0x1001ed9e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001ed9e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x22ea
push 0x24d3
push 0x18f2
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret

Function at 0x1001eda2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001edfd
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001edde
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001edfb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
mov dword [eax], 0xb82aec7f
jmp 0x1001edd3
jmp 0x1001ee2e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001ee2e
push 0x53a
push 0
push 0x25af
push 0x1a38
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x100243f8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002440d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10024417
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
pop ebp
ret
Function at 0x10029261
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029292
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1002928d
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10029390
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
jle 0x100292d3
mov dword [ebp - 8], 1
jmp 0x100292d7
and dword [ebp - 8], 0
cmp dword [ebp - 8], 9
jl 0x100292e6
mov dword [ebp - 0xc], 1
jmp 0x100292ea
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
sub eax, dword [ebp - 0xc]
cmp eax, 1
jl 0x10029300
mov dword [ebp - 0x10], 1
jmp 0x10029304
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jne 0x10029317
mov dword [ebp - 0x18], 1
jmp 0x1002931b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add eax, dword [ebp - 0x18]
jne 0x1002933e
mov eax, 0xda8afc1d
test eax, eax
jne 0x1002933e
and dword [ebp - 0x44], 0
jmp 0x10029345
mov dword [ebp - 0x44], 1
xor eax, eax
cmp eax, 1
ja 0x10029355
mov dword [ebp - 0x1c], 1
jmp 0x10029359
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp ecx, dword [eax]
jl 0x10029371
mov dword [ebp - 0x24], 1
jmp 0x10029375
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 1
ja 0x10029384
mov dword [ebp - 0x28], 1
jmp 0x10029388
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002aeb5
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1002aed5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x1002afc8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
xor eax, eax
add eax, 0xfffffc28
mov ecx, dword [ebp - 0x40]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.10016b9d
cmp esi, dword [eax]
jge 0x1002af5d
mov dword [ebp - 0x10], 1
jmp 0x1002af61
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 1
jl 0x1002af70
mov dword [ebp - 0x14], 1
jmp 0x1002af74
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x1002af87
mov dword [ebp - 0x18], 1
jmp 0x1002af8b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jg 0x1002af9e
mov dword [ebp - 0x20], 1
jmp 0x1002afa2
and dword [ebp - 0x20], 0
push 2
mov ecx, dword [ebp - 0x1c]
call fcn.10016b9d
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
jg 0x1002afbc
mov dword [ebp - 0x24], 1
jmp 0x1002afc0
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002ef6e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002ef86
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1002efbe
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1002f058
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002f0b3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002f094
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002f0b1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
mov dword [eax], 0x5b40194
jmp 0x1002f089
jmp 0x1002f0d8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x22ea
push 0x24d3
push 0x18f2
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x100309c6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100309ea
xor eax, eax
jmp 0x10030b4e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10030a08
xor eax, eax
jmp 0x10030b4e
push 0x5709
push 0x22b2
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002fbd6
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x10030a31
xor eax, eax
jmp 0x10030b4e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x7a2e
push 1
lea eax, [ebp - 0x24]
push eax
push 0x7572
lea eax, [ebp - 0x10]
push eax
call fcn.1002fc3f
add esp, 0x20
push 0x24f5
push 0
push dword [ebp + 8]
push 0x3a8f
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1002fcd3
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10030aa5
lea eax, [ebp - 4]
push eax
push 1
push 0x104
lea eax, [ebp - 0x14]
push eax
push 0x1c11
push 0x35ae
call fcn.1002fcd3
add esp, 0x18
push dword [ebp - 4]
call fcn.1002f181
pop ecx
test eax, eax
jne 0x10030ab9
xor eax, eax
jmp 0x10030b4e
push 0x76d4
push 0x450a
lea eax, [ebp - 4]
push eax
push 0x1c02
push 0x4852
push 0x5d1d
push 0x4915
push 0x3289
push 1
push 0x5638
push 0x3f94
call fcn.1003070d
add esp, 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10030b36
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10030b13
xor eax, eax
jmp 0x10030b4e
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10030b2c
xor eax, eax
jmp 0x10030b4e
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10030b47
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10030b4b
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret