joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007b41
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor ebx, ebx
push 0xfffffffffffffff6
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x1007ce7
cmp edi, ebx
je 0x1007ce7
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [ebp - 0x14]
and eax, 0xfffffff9
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp dword [ebp + 0xc], 2
jb 0x1007cbb
cmp dword [ebp + 0x10], ebx
je 0x1007cbb
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
push 0
cmp eax, 2
lea eax, [ebp - 0x10]
push eax
push 1
je 0x1007c17
lea eax, [ebp - 1]
push eax
push edi
call esi
test eax, eax
je 0x1007ca2
cmp dword [ebp - 0x10], 0
jne 0x1007bdb
mov dword [ebp - 8], 0xa
jmp 0x1007c22
push 1
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 1]
push eax
push 0
call dword [sym.imp.msvcrt.dll__getmbcp]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1007bfd
and dword [ebp - 8], eax
push 0xd
pop eax
cmp ax, word [ebp - 8]
jne 0x1007c22
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push edi
call esi
jmp 0x1007c22
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov ecx, dword [ebp - 8]
movzx eax, cx
sub eax, 8
je 0x1007c76
dec eax
dec eax
je 0x1007c96
sub eax, 3
je 0x1007c96
sub eax, 0xe
je 0x1007c54
mov eax, dword [ebp + 0xc]
dec eax
cmp ebx, eax
jae 0x1007ba4
mov eax, dword [ebp + 8]
mov word [eax + ebx*2], cx
inc ebx
jmp 0x1007ba4
test ebx, ebx
jbe 0x1007ba4
push 8
push 8
push 0x1001808
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0xc
dec ebx
jne 0x1007c5c
jmp 0x1007ba4
test ebx, ebx
jbe 0x1007ba4
cmp ebx, dword [ebp + 0xc]
jae 0x1007ba4
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx + ebx*2], ax
dec ebx
jmp 0x1007ba4
push 0x10017a4
call fcn.0100d8d4
jmp 0x1007cc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007cb6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0xc], eax
jmp 0x1007cc2
mov dword [ebp - 0xc], 0x80070057
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
pop esi
cmp ebx, dword [ebp + 0xc]
jb 0x1007cd9
mov eax, 0x8007007a
jmp 0x1007cfb
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx + ebx*2], ax
mov eax, dword [ebp - 0xc]
jmp 0x1007cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1007cfb
and eax, 0xffff
or eax, 0x80070000
pop edi
pop ebx
leave
ret 0xc
Function at 0x100b067
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1010400
call fcn.0100b2a4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1014020
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100ae7c
cmp eax, esi
jne 0x100ae6f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100ae7f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100ae56
xor esi, esi
inc esi
mov eax, dword [0x101401c]
cmp eax, esi
jne 0x100ae92
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100aecd
mov eax, dword [0x101401c]
test eax, eax
jne 0x100aec7
mov dword [0x101401c], esi
push 0x10013c0
push 0x10013b4
call fcn.0100add3
pop ecx
pop ecx
test eax, eax
je 0x100aecd
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100af97
mov dword [0x1013c9c], esi
mov eax, dword [0x101401c]
cmp eax, esi
jne 0x100aef1
push 0x10013b0
push 0x1001294
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101401c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100aefe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1014024], ebx
je 0x100af1f
push 0x1014024
call fcn.0100b219
pop ecx
test eax, eax
je 0x100af1f
push ebx
push 2
push ebx
call dword [0x1014024]
push dword [0x1013c84]
push dword [0x1013c88]
push dword [0x1013c80]
call fcn.0100a440
add esp, 0xc
mov dword [0x1013c98], eax
cmp dword [0x1013c8c], ebx
jne 0x100af7d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1013c9c], ebx
jne 0x100af8b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1013c98]
call fcn.0100b2e9
ret
call fcn.0100b3f1
jmp 0x100ae34
Function at 0x100bde3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push 0
push dword [ebp + 0x10]
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100be23
mov dword [ebp + 8], 0x8007000e
jmp 0x100beb5
push ebx
push esi
push edi
mov esi, 0x104
push esi
push eax
push dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
jbe 0x100be41
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
ja 0x100be6f
call ebx
test eax, eax
je 0x100be63
jle 0x100be68
and eax, edi
or eax, esi
jmp 0x100be68
mov eax, 0x80004005
mov dword [ebp + 8], eax
test eax, eax
jl 0x100bea0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jbe 0x100be8a
and dword [ebp + 8], 0
jmp 0x100bea0
call ebx
test eax, eax
je 0x100be98
jle 0x100be9d
and eax, edi
or eax, esi
jmp 0x100be9d
mov eax, 0x80004005
mov dword [ebp + 8], eax
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov eax, dword [ebp + 8]
leave
ret 0xc
Function at 0x100d642
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push 0xfffffffffffffff5
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x100d78b
cmp ebx, edi
je 0x100d78b
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0100d5ba
mov esi, eax
test esi, esi
jl 0x100d7b9
push ebx
call fcn.0100e813
test eax, eax
je 0x100d6ce
push dword [ebp - 4]
push dword [ebp + 0xc]
push ebx
call fcn.0100d480
test eax, eax
je 0x100d6aa
xor esi, esi
jmp 0x100d7b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100d6c2
jle 0x100d6c7
and eax, 0xffff
or eax, 0x80070000
jmp 0x100d6c7
mov eax, 0x80004005
mov esi, eax
jmp 0x100d7b9
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push 2
pop ecx
inc eax
mul ecx
push edx
push eax
call fcn.0100bd83
mov esi, eax
test esi, esi
jl 0x100d7b9
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100d70e
mov esi, 0x8007000e
jmp 0x100d7a5
push edi
push dword [ebp + 0xc]
mov byte [edi], 0
call dword [sym.imp.USER32.dll_CharToOemW]
mov ebx, 0x80070000
test eax, eax
jne 0x100d744
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100d739
jle 0x100d73e
and eax, 0xffff
or eax, ebx
jmp 0x100d73e
mov eax, 0x80004005
mov esi, eax
test eax, eax
jl 0x100d7a5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push edi
call fcn.0100d4ef
mov esi, eax
test esi, esi
jl 0x100d7a5
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100d7a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x100d784
jle 0x100d7a3
and eax, 0xffff
or eax, ebx
jmp 0x100d7a3
mov eax, 0x80004005
jmp 0x100d7a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100d6c7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test edi, edi
je 0x100d7b9
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x100ddea
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x3a
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x100de3f
mov dword [ebp - 0x1c], 0x8007000e
jmp 0x100df24
push esi
push 8
push ebx
push 0x1e
xor eax, eax
mov esi, 0x400
push esi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x100de72
push ebx
push 8
lea eax, [ebp - 0x14]
push eax
call fcn.01007d23
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x100df13
push dword [ebp - 0x18]
push esi
push ebx
call fcn.01007d23
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x100df13
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
lea eax, [ebp - 0x14]
push eax
push ebx
call esi
and dword [ebp - 0x18], 0
pop ecx
pop ecx
lea edi, [ebp - 0x2c]
test eax, eax
je 0x100dec5
push edi
push eax
call fcn.0100db8a
inc dword [ebp - 0x18]
add edi, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x100df13
lea eax, [ebp - 0x14]
push eax
push 0
call esi
cmp dword [ebp - 0x18], 3
pop ecx
pop ecx
jb 0x100de9d
mov eax, dword [ebp - 0x18]
dec eax
je 0x100df08
dec eax
je 0x100def3
dec eax
je 0x100deda
mov dword [ebp - 0x1c], 0x80070057
jmp 0x100df13
mov cx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x64], cx
mov cx, word [ebp - 0x28]
mov word [eax + 0x66], cx
mov cx, word [ebp - 0x24]
jmp 0x100df02
mov cx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x66], cx
mov cx, word [ebp - 0x28]
mov word [eax + 0x68], cx
jmp 0x100df13
mov ax, word [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov word [ecx + 0x68], ax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100b081
leave
ret 8
Function at 0x100ed33
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1014008], edi
jne 0x100ee4f
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x100ed9a
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1014008], edi
pop esi
je 0x100ee22
dec eax
jne 0x100ee4f
cmp dword [ebp - 0x11c], 5
jne 0x100ee0f
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x100ee03
dec eax
je 0x100edf0
dec eax
je 0x100edd6
mov dword [0x1014008], 0x14
jmp 0x100ee4f
cmp word [ebp - 0xc], 1
jb 0x100ede7
mov dword [0x1014008], 0x10
or dword [0x1014008], 4
jmp 0x100ee4f
cmp word [ebp - 0xc], 2
jb 0x100ede7
mov dword [0x1014008], 8
jmp 0x100ede7
mov dword [0x1014008], 4
jmp 0x100ee4f
cmp dword [ebp - 0x11c], 4
ja 0x100ee61
mov dword [0x1014008], 2
cmp dword [ebp - 0x11c], 4
jne 0x100ee4f
cmp dword [ebp - 0x118], edi
je 0x100ee45
cmp dword [ebp - 0x118], 0xa
je 0x100ee45
cmp dword [ebp - 0x118], 0x5a
jne 0x100ee4f
mov dword [0x1014008], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1014008]
xor ecx, ebp
pop edi
call fcn.0100b081
leave
ret
mov dword [0x1014008], 0x20
jmp 0x100ee4f

Function at 0x100ee72
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100eec6
push 3
lea eax, [ebp - 0x44]
push 0x1002378
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0100b081
leave
ret

Function at 0x100eedb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1013b58]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x101400c]
jne 0x100ef76
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x10022a8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ef75
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1002360
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x100ef75
push 3
push dword [esi*8 + 0x10020f8]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x100ef67
inc esi
cmp esi, 0x1c
jb 0x100ef46
jmp 0x100ef75
mov ax, word [esi*8 + 0x10020fc]
mov word [0x101400c], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x101400c]
xor ecx, ebp
call fcn.0100b081
leave
ret
Function at 0x401936
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
cmp eax, 0x3e8
jae 0x401976
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x800]
push eax
call sub.MSVCRT.dll_swprintf
add esp, 0xc
lea ecx, [ebp - 0x800]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret

Function at 0x401a6b
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push str.SYSTEMCurrentControlSetServicesEventLogApplication
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_wcscpy
add esp, 8
push 0x40b488
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
push str.MSSQLServerADHelper
lea edx, [ebp - 0x218]
push edx
call sub.MSVCRT.dll_wcscat
add esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401af6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b48c
call fcn.00401936
add esp, 8
jmp 0x401b91
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 2
push 0
push str.EventMessageFile
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401b3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_set_the_event_message_file.
call fcn.00401936
add esp, 8
jmp 0x401b8f
mov dword [ebp - 0xc], 7
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.TypesSupported
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_set_the_supported_types.
call fcn.00401936
add esp, 8
cmp dword [ebp - 4], 0
je 0x401b8a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x401b93
jmp 0x401b7a
jmp 0x401b7a
mov esp, ebp
pop ebp
ret

Function at 0x401b97
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesEventLogApplication
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401bc3
jmp 0x401be4
push str.MSSQLServerADHelper
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 4], 0
je 0x401be2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401be6
jmp 0x401bd2
mov esp, ebp
pop ebp
ret
Function at 0x401e84
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov dword [ebp - 0x234], 0
call fcn.00401b97
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x402017
push 0xf01ff
push str.MSSQLServerADHelper
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401fe2
lea ecx, [ebp - 0x1c]
push ecx
push 1
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401f8b
push str.MSSQLServerADHelper
push str.Stopping__s.
call sub.MSVCRT.dll_wprintf
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401f5f
cmp dword [ebp - 0x234], 0x12c
jae 0x401f5f
cmp dword [ebp - 0x18], 3
jne 0x401f5b
push 0x40b6dc
call sub.MSVCRT.dll_wprintf
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x234]
add edx, 1
mov dword [ebp - 0x234], edx
jmp 0x401f5d
jmp 0x401f5f
jmp 0x401f0e
cmp dword [ebp - 0x18], 1
jne 0x401f79
push str.MSSQLServerADHelper
push 0x40b6e0
call sub.MSVCRT.dll_wprintf
add esp, 8
jmp 0x401f8b
push str.MSSQLServerADHelper
push str._n_s_failed_to_stop._n
call sub.MSVCRT.dll_wprintf
add esp, 8
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x401fad
push str.MSSQLServerADHelper
push str._s_removed._n
call sub.MSVCRT.dll_wprintf
add esp, 8
jmp 0x401fd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea ecx, [ebp - 0x230]
push ecx
call fcn.00402044
add esp, 0xc
push eax
push str.DeleteService_failed____s_n
call sub.MSVCRT.dll_wprintf
add esp, 8
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40200b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea eax, [ebp - 0x230]
push eax
call fcn.00402044
add esp, 0xc
push eax
push str.OpenService_failed____s_n
call sub.MSVCRT.dll_wprintf
add esp, 8
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402040
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea edx, [ebp - 0x230]
push edx
call fcn.00402044
add esp, 0xc
push eax
push str.OpenSCManager_failed____s_n
call sub.MSVCRT.dll_wprintf
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x403675
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [0x40f2a8], 3
mov eax, dword [ebp + 8]
add eax, 0xa28
mov dword [0x40f2b0], eax
mov dword [0x40f170], 3
mov ecx, dword [ebp + 0xc]
add ecx, 0x10c
mov dword [0x40f178], ecx
mov dword [0x40ef00], 3
mov edx, dword [ebp + 0xc]
add edx, 0x210c
mov dword [0x40ef08], edx
mov dword [0x40f3c8], 3
mov eax, dword [ebp + 0xc]
add eax, 0x2214
mov dword [0x40f3d0], eax
mov dword [0x40ef78], 0xa
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x231c]
mov eax, dword [ecx + 0x2320]
mov dword [0x40ef80], edx
mov dword [0x40ef84], eax
mov dword [0x40f2f0], 3
mov ecx, dword [ebp + 0xc]
add ecx, 0x2324
mov dword [0x40f2f8], ecx
mov dword [0x40efa8], 3
mov edx, dword [ebp + 0xc]
add edx, 0x242c
mov dword [0x40efb0], edx
mov dword [0x40f038], 3
mov eax, dword [ebp + 0xc]
add eax, 0x2534
mov dword [0x40f040], eax
mov dword [0x40f080], 3
mov dword [0x40f098], 3
mov dword [0x40f0b0], 3
mov dword [0x40f0c8], 3
mov dword [0x40f0e0], 3
mov dword [0x40f088], 0x40bca8
mov dword [0x40f0a0], 0x40bcb8
mov dword [0x40f0b8], 0x40bcc8
mov dword [0x40f0d0], 0x40bcd8
mov dword [0x40f0e8], 0x40bce8
mov dword [0x40f3b0], 0xa
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x263c]
mov eax, dword [ecx + 0x2640]
mov dword [0x40f3b8], edx
mov dword [0x40f3bc], eax
mov dword [0x40f020], 3
mov ecx, dword [ebp + 0xc]
add ecx, 0x2644
mov dword [0x40f028], ecx
mov dword [0x40f1b8], 3
mov dword [0x40f1d0], 3
mov dword [0x40f1e8], 3
mov dword [0x40f200], 3
mov dword [0x40f218], 3
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0x208
push 0x40bcf8
mov edx, dword [ebp + 8]
add edx, 0x10f8
push edx
call sub.MSVCRT.dll_wcscpy
add esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x403872
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
add eax, 0x10f8
push eax
call sub.MSVCRT.dll_wcscat
add esp, 8
jmp 0x40388e
mov ecx, dword [ebp + 8]
add ecx, 0x820
push ecx
mov edx, dword [ebp + 8]
add edx, 0x10f8
push edx
call sub.MSVCRT.dll_wcscat
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0x10f8
mov dword [0x40f1c0], eax
push 0x40bcfc
mov ecx, dword [ebp + 8]
add ecx, 0x1300
push ecx
call sub.MSVCRT.dll_wcscpy
add esp, 8
push 0x40bd00
mov edx, dword [ebp + 8]
add edx, 0x820
push edx
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
je 0x4038e8
mov eax, dword [ebp + 8]
add eax, 0x820
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1300
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
mov edx, dword [ebp + 8]
add edx, 0x1300
mov dword [0x40f1d8], edx
mov dword [0x40f1f0], 0x40bd18
mov dword [0x40f208], 0x40bd28
mov dword [0x40f220], 0x40bd38
mov eax, 1
mov esp, ebp
pop ebp
ret