joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bc50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
push edi
mov dword [ebp - 0x460], ecx
push eax
xor eax, eax
xor eax, eax
nop
xor eax, eax
nop
nop
xor eax, eax
nop
je 0x1000bc74
sub al, 0x2d
pop eax
pop eax
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x454], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x453]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x454]
push edx
push str._s.
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x350], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x350]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000bd11
xor eax, eax
jmp 0x1000be63
mov dword [ebp - 4], 0
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 4], 0
jne 0x1000be54
push 0x10014508
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
and eax, eax
je 0x1000be18
push 0x10014504
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
and eax, eax
je 0x1000be18
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x454]
push eax
push str._s_s
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x350]
and edx, 0x10
or edx, edx
je 0x1000bdd7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x460]
call fcn.1000bc50
test eax, eax
jne 0x1000bdd5
xor eax, eax
jmp 0x1000be63
jmp 0x1000be18
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x330]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x334]
mov dword [ebp - 0x458], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x45c]
mov edx, dword [eax + 4]
adc edx, dword [ebp - 0x458]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea ecx, [ebp - 0x350]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000be4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000be41
mov dword [ebp - 4], 1
jmp 0x1000be4f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1000be63
jmp 0x1000bd31
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000be70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000be8e
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 5
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c800
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000c81e
sub al, 0x2d
pop eax
pop eax
mov ecx, dword [ebp - 0x10]
call fcn.1000d9d0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000c83c
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b69
jmp 0x1000c891
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000c86e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edx, dword [ebp - 0xc]
push edx
push 0x1000c6a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c990
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
push edi
mov dword [ebp - 0x344], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000c9b4
sub al, 0x2d
pop eax
pop eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000c9d9
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
jmp 0x1000cbcd
mov dword [ebp - 0x338], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x334]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x338], 0x128
lea ecx, [ebp - 0x338]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000ca2c
mov eax, dword [ebp - 0x344]
mov dword [eax + 4], 0x1b59
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cbcd
call fcn.10009e80
mov ecx, dword [ebp - 0x344]
call fcn.1000d9d0
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
jne 0x1000ca5d
mov edx, dword [ebp - 0x344]
mov dword [edx + 4], 0x1b69
jmp 0x1000cbcd
mov dword [ebp - 0x210], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x210], edx
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x1000cad9
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.10009de0
add esp, 8
mov dword [ebp - 0x33c], 0
push 0
lea edx, [ebp - 0x33c]
push edx
push 0x20c
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x338]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1000cbb6
mov ecx, 0x83
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x31c]
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x1000cb8f
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call fcn.10009de0
add esp, 8
push 0
lea eax, [ebp - 0x33c]
push eax
push 0x20c
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000cb05
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cbe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000cbfe
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [ebp - 4], eax
call fcn.10009e80
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000cc3d
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b6a
jmp 0x1000cc6d
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1000cc63
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b6a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cc6d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000cc80
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000cc9e
sub al, 0x2d
pop eax
pop eax
call fcn.10009e80
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000cccb
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b5c
jmp 0x1000cd76
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
push 0xf01ff
mov eax, dword [ebp - 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000cd09
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b5b
jmp 0x1000cd76
mov ecx, dword [ebp - 8]
add ecx, 0x218
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x1000cd58
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b5b
jmp 0x1000cd76
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cd80
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000cd9e
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.10009e80
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000cdd4
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], 0x1b5b
jmp 0x1000ce9d
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000ce09
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
mov dword [eax + 4], 0x1b5b
jmp 0x1000ce9d
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x400]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1000ce47
sub dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0
je 0x1000ce5a
jmp 0x1000ce6d
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
jmp 0x1000ce6d
lea edx, [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000ce7f
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], 0
jmp 0x1000ce89
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], 0x1b5b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ceb0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000cece
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.10009e80
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000cf01
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0x1b5d
jmp 0x1000cf64
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000cf33
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x1b5d
jmp 0x1000cf64
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
jne 0x1000cf64
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0x1b5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d1c0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000d1de
sub al, 0x2d
pop eax
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d203
jmp 0x1000d32b
mov dword [ebp - 8], 0
push 0x2000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov ecx, 0x800
xor eax, eax
mov edi, dword [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x2000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1000d30f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x448
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x648
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0xc48
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
push ecx
push str.SYSTEMCoNtrolSet001Services_s
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x1048
push eax
push str.Description
mov ecx, dword [ebp - 0x10]
push ecx
push reloc.WS2_32.dll_bind
call fcn.10009cf0
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
je 0x1000d35e
nop
nop
nop
sub al, 0x2d
pop eax
pop eax
mov ecx, dword [ebp - 0xc]
call fcn.1000d9d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000d37c
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x1b69
jmp 0x1000d3c5
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000d3bb
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0x1b69
jmp 0x1000d3c5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d3d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000d3ee
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d433
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d48e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1200]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xa00
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1204]
push edx
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x800
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d484
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b67
jmp 0x1000d48e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d4a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000d4be
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d503
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d540
mov ecx, dword [ebp - 0xc]
add ecx, 0x800
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d536
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b64
jmp 0x1000d540
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d550
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000d56e
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d5b3
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d5eb
push 0x100145d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d5e1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b64
jmp 0x1000d5eb
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d9d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000d9ee
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 8]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 8]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000da30
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000da4e
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push bind
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000db00
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
je 0x1000dae7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.10005110
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1000db38
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret