joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4112be
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
xor edi, edi
push eax
push ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [esi + 0x1b]
push eax
lea ecx, [ebp + 8]
call fcn.00444e50
mov eax, dword [ebp + 8]
lea ecx, [esi + 0xb]
push ecx
push eax
push ebx
mov dword [ebp - 0x18], eax
mov word [eax], di
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 8]
push edi
push edi
push 0x31
mov word [eax + esi*2 + 0x14], di
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call esi
or dword [ebp - 0xc], 0xffffffff
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xb0
push ebx
call esi
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x10], edi
jge 0x41138a
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
movzx edx, word [ebp + 0x10]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x30]
push edi
push dword [0x4dbfb0]
push edx
push dword [ebp - 4]
push eax
push ecx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp + 0xc]
push edi
push 0x4c2db4
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 1
push dword [ebp - 0x14]
mov edi, eax
push 0x30
push edi
call esi
push dword [ebp - 0x18]
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0xb1
push edi
call esi
lea ecx, [ebp + 8]
call fcn.0043e679
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413f3b
Capabilities:
Check if file exists
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp ebx, edi
je 0x41403b
cmp dword [ebp + 8], 0xffffffff
jne 0x41403b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp eax, 2
jne 0x413f75
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x413f96
push ebx
call esi
cmp eax, 3
jne 0x413f94
lea eax, [ebx + 2]
push 0x4c3a08
push eax
call fcn.004adebd
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x413f96
xor eax, eax
cmp eax, edi
je 0x413ff0
mov ax, word [ebx]
mov esi, 0x4c39f8
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
mov ebx, 0x20000000
push ebx
push 3
push 0
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 3
mov word [ebp - 0x10], ax
push 0xc0000000
lea eax, [ebp - 0x18]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x41407b
push 0
push ebx
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x18]
push eax
call edi
xor edi, edi
jmp 0x41405e
push 0xc0000000
push ebx
call dword [0x4dc084]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41407d
push 0x80000000
push ebx
call dword [0x4dc084]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41407d
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
je 0x414033
sub eax, 0x56
je 0x414033
sub eax, 0x3a
je 0x414033
sub eax, 0x7a
je 0x414033
sub eax, 0x101b
push 9
pop eax
jmp 0x41410b
push 0xc0000000
push dword [ebp + 8]
call dword [0x4dc080]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41407d
push 0x80000000
push dword [ebp + 8]
call dword [0x4dc080]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41407d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
setne cl
inc ecx
mov eax, ecx
jmp 0x41410b
xor edi, edi
push esi
call fcn.00413977
test eax, eax
pop ecx
jne 0x414096
push 5
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x41410b
test byte [ebp + 0x10], 3
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
je 0x4140d7
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
lea eax, [ebp + 0xc]
push eax
push edi
push edi
push edi
push edi
push 0x90018
push esi
call ebx
test eax, eax
jne 0x4140c2
push 2
jmp 0x41408a
push edi
lea eax, [ebp + 0xc]
push eax
push edi
push edi
push edi
push edi
push 0x90020
push esi
call ebx
test eax, eax
je 0x4140be
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push 8
push eax
push 0x83722014
push esi
call ebx
cmp dword [ebp - 8], edi
je 0x414102
push 3
jmp 0x41408a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414110
Capabilities:
Check if file exists
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
xor eax, eax
cmp esi, ebx
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jne 0x414174
push 0xc0000000
push dword [ebp + 8]
call dword [0x4dc080]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414253
push 0x80000000
push dword [ebp + 8]
call dword [0x4dc080]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414253
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
setne cl
inc ecx
mov eax, ecx
jmp 0x4142f3
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 2
jne 0x41418e
xor eax, eax
cmp word [esi + 2], 0x3a
sete al
jmp 0x4141af
push esi
call edi
cmp eax, 3
jne 0x4141ad
lea eax, [esi + 2]
push 0x4c3a08
push eax
call fcn.004adebd
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x4141af
xor eax, eax
cmp eax, ebx
je 0x414208
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
mov esi, 0x4c39f8
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push 0x20000000
movsd dword es:[edi], dword [esi]
push 3
push ebx
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 3
mov word [ebp - 0x1c], ax
push 0xc0000000
lea eax, [ebp - 0x24]
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x414253
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0x80000000
lea eax, [ebp - 0x24]
push eax
call esi
jmp 0x414153
push 0xc0000000
push esi
call dword [0x4dc084]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414253
push 0x80000000
push esi
call dword [0x4dc084]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414253
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
je 0x41424b
sub eax, 0x56
je 0x41424b
sub eax, 0x3a
je 0x41424b
sub eax, 0x7a
je 0x41424b
sub eax, 0x101b
push 9
pop eax
jmp 0x4142f3
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0x7c0d0
push edi
mov dword [ebp - 0x34], 1
call esi
test eax, eax
jne 0x41428a
push 3
pop ebx
jmp 0x4142ea
push ebx
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x7405c
push edi
call esi
test eax, eax
je 0x4142bc
push ebx
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x4c]
push eax
push ebx
push ebx
push 0x70000
push edi
call esi
test eax, eax
jne 0x4142c0
push 2
jmp 0x414287
push ebx
push dword [ebp - 0x38]
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004adb00
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 8
lea eax, [ebp - 0x14]
push eax
push 0x900f0
push edi
mov dword [ebp - 0x10], edx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414cb6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, 0x4dcd58
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.00403ecc
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
pop ecx
push 0x5c
push dword [ebp + 8]
mov byte [ebp - 4], al
jmp 0x414d0e
push dword [ebp + 8]
and word [esi], 0
call fcn.004ad0f1
test eax, eax
pop ecx
jne 0x414d03
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], 0x5c
push 0x5c
add esi, 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x414ce8
cmp byte [ebp - 4], al
je 0x414d24
push dword [ebp - 8]
call fcn.00403edd
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x414e8f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x54]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*8]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004143bf
mov eax, dword [esi + 0x14]
xor ebx, ebx
add esp, 0xc
cmp word [eax + 6], bx
mov dword [ebp - 4], ebx
jbe 0x414f32
mov eax, dword [esi + 0x18]
add eax, ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x414f20
mov edx, dword [eax + 0x10]
test edx, edx
je 0x414f20
mov eax, dword [eax + 0x14]
add eax, dword [ebp + 0xc]
push edx
add edi, ecx
push eax
push edi
call fcn.004143bf
mov eax, dword [esi + 0x18]
add esp, 0xc
add eax, ebx
push 0x4c3b1c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x414f1d
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x18]
sub edi, eax
lea ecx, [ecx + ebx + 0xc]
lea edx, [edi + eax]
add dword [ecx], edx
mov ecx, dword [esi + 0x18]
lea ecx, [ecx + ebx + 0x14]
add edi, eax
add dword [ecx], edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
add ebx, 0x28
cmp dword [ebp - 4], eax
jl 0x414ec6
mov dword [esi + 0x10], edi
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [esi + 0x14], eax
add eax, 0xf8
pop edi
mov dword [esi + 0x18], eax
pop esi
pop ebx
leave
ret 8

Function at 0x415219
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004adaa0
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp + 8], 0
je 0x41524e
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
leave
ret
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
leave
ret
Function at 0x42a27b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x20a
lea ecx, [ebp - 4]
call fcn.00444e50
mov eax, dword [ebp - 4]
mov word [eax], 0x20
mov eax, dword [ebp - 4]
and word [eax + 2], 0
mov eax, dword [ebp - 4]
push 0x208
add eax, 2
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.System32OnShutdown.wcs
lea ecx, [ebp - 4]
call fcn.00444e9e
mov bl, byte [ebp + 0xc]
test bl, 0x20
mov esi, str.unknown
je 0x42a2d6
mov esi, 0x4c1924
test bl, 0x10
je 0x42a2e0
mov esi, str.reboot
test bl, 2
je 0x42a2ea
mov esi, 0x4c5c84
test bl, 4
je 0x42a2f4
mov esi, str.suspend
test bl, 8
je 0x42a2fe
mov esi, str.hiber
test bl, 0x40
je 0x42a308
mov esi, str.poweroff
test bl, bl
jns 0x42a311
mov esi, str.lock
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
lea ecx, [ebp - 4]
mov edi, eax
call fcn.00444e9e
push 0x4c1548
lea ecx, [ebp - 4]
call fcn.00444e9e
cmp dword [ebp + 8], 0
je 0x42a343
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00444e9e
push dword [ebp - 4]
mov esi, 0x4dc0f8
mov ecx, esi
call fcn.004221d9
push str._25INDATA
lea ecx, [ebp - 8]
call fcn.0044e66d
mov eax, dword [ebp - 4]
lea eax, [eax + edi*2]
push eax
lea ecx, [ebp - 8]
call fcn.00444e9e
test bl, 0x70
je 0x42a37d
push dword [ebp - 8]
mov ecx, esi
call fcn.004221d9
lea ecx, [ebp - 8]
call fcn.0043e679
lea ecx, [ebp - 4]
call fcn.0043e679
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002b89
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesEventLogApplication
push 0x80000002
call dword [0x1001004]
test eax, eax
jne 0x1002bc0
push str.MSSQLServerADHelper
push dword [ebp - 4]
call dword [0x1001050]
cmp dword [ebp - 4], 0
je 0x1002bcf
push dword [ebp - 4]
call dword [entry0]
leave
ret

Function at 0x1002ccb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
push 2
mov dword [ebp - 0x218], eax
xor eax, eax
pop ebx
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesEventLogApplication]
mov word [ebp + eax - 0x210], cx
add eax, ebx
test cx, cx
jne 0x1002cf8
lea edi, [ebp - 0x210]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x1002d16
mov esi, 0x1001334
mov eax, str.MSSQLServerADHelper
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x1002d2e
sub eax, edx
lea edi, [ebp - 0x210]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x1002d42
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [0x100100c]
mov edi, eax
test edi, edi
je 0x1002d8d
call dword [0x10010e4]
push eax
push 0x10012c8
jmp 0x1002e0f
mov eax, dword [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x1002d96
mov esi, dword [0x1001008]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x218]
push ebx
push 0
push str.EventMessageFile
push dword [ebp - 0x214]
call esi
mov edi, eax
test edi, edi
je 0x1002dd9
call dword [0x10010e4]
push eax
push 0x1001278
jmp 0x1002e0f
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.TypesSupported
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 7
call esi
mov edi, eax
test edi, edi
je 0x1002e16
call dword [0x10010e4]
push eax
push 0x1001230
call fcn.01002c5f
pop ecx
pop ecx
cmp dword [ebp - 0x214], 0
je 0x1002e2b
push dword [ebp - 0x214]
call dword [entry0]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b3a
leave
ret
Function at 0x10033b9
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe4c
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x208
push esi
lea eax, [ebp - 0xa34]
push eax
xor edi, edi
push edi
call dword [0x10010c8]
test eax, eax
jne 0x100341a
call dword [0x10010e4]
push eax
lea eax, [ebp - 0x624]
push 0x104
push eax
call fcn.01002e41
push eax
push 0x1001564
call dword [0x1001174]
add esp, 0x14
jmp 0x10035e9
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01002aa5
test eax, eax
jge 0x100343c
push 0x1001520
jmp 0x10035e2
lea eax, [ebp - 0x414]
push 0x5c
push eax
call dword [0x100115c]
cmp eax, edi
pop ecx
pop ecx
jne 0x100345b
push 0x10014b8
jmp 0x10035e2
push str.Resources_
mov word [eax], di
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01002c26
test eax, eax
jl 0x10035dd
cmp ebx, edi
jne 0x1003481
mov ebx, str.1033
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01002c26
test eax, eax
jl 0x10035dd
push 0x1001334
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01002c26
test eax, eax
jl 0x10035dd
push str.sqladevn90.rll
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01002c26
test eax, eax
jl 0x10035dd
push 0xf003f
push edi
push edi
call dword [0x100101c]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0xe4c], ebx
je 0x10035ba
cmp word [ebp - 0xa34], 0x22
mov eax, 0x10014a8
jne 0x10034fc
mov eax, 0x10014a0
lea ecx, [ebp - 0xa34]
push ecx
push eax
lea eax, [ebp - 0xe48]
push 0x20a
push eax
call fcn.01002bf8
add esp, 0x10
test eax, eax
jge 0x1003534
push 0x1001458
call dword [0x1001174]
pop ecx
push ebx
call dword [0x1001018]
jmp 0x10035e9
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xe48]
push eax
push 1
push 3
push 0x10
push 0xf01ff
mov esi, str.MSSQLServerADHelper
push esi
push esi
push ebx
call dword [0x1001014]
mov ebx, eax
cmp ebx, edi
mov edi, dword [0x1001018]
je 0x1003589
lea eax, [ebp - 0x414]
push eax
call fcn.01002ccb
test eax, eax
pop ecx
jne 0x1003584
push esi
push 0x1001438
call dword [0x1001174]
pop ecx
pop ecx
push ebx
call edi
jmp 0x10035b0
call dword [0x10010e4]
push eax
lea eax, [ebp - 0x624]
push 0x104
push eax
call fcn.01002e41
push eax
push 0x1001400
call dword [0x1001174]
add esp, 0x14
push dword [ebp - 0xe4c]
call edi
jmp 0x10035e9
call dword [0x10010e4]
push eax
lea eax, [ebp - 0x624]
push 0x104
push eax
call fcn.01002e41
push eax
push 0x10013c8
jmp 0x100340c
push 0x1001388
call dword [0x1001174]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b3a
leave
ret
Function at 0x10035fd
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x218], esi
call fcn.01002b89
push 0xf003f
push esi
push esi
call dword [0x100101c]
cmp eax, esi
mov dword [ebp - 0x21c], eax
je 0x1003770
push edi
push 0xf01ff
mov edi, str.MSSQLServerADHelper
push edi
push eax
call dword [0x100102c]
cmp eax, esi
mov dword [ebp - 0x214], eax
je 0x100373a
lea ecx, [ebp - 0x238]
push ecx
push 1
push eax
call dword [0x1001028]
test eax, eax
mov esi, dword [0x1001174]
je 0x10036ed
push ebx
push edi
push 0x1001678
call esi
mov ebx, dword [0x10010c4]
pop ecx
pop ecx
push 0x3e8
call ebx
jmp 0x10036bb
cmp dword [ebp - 0x218], 0x12c
jae 0x10036d2
cmp dword [ebp - 0x234], 3
jne 0x10036d2
push 0x1001674
call esi
mov dword [esp], 0x3e8
call ebx
inc dword [ebp - 0x218]
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x214]
call dword [0x1001024]
test eax, eax
jne 0x1003690
cmp dword [ebp - 0x234], 1
pop ebx
push edi
jne 0x10036e4
push 0x1001658
jmp 0x10036e9
push 0x100162c
call esi
pop ecx
pop ecx
push dword [ebp - 0x214]
call dword [0x1001020]
test eax, eax
je 0x1003709
push edi
push 0x1001610
call esi
pop ecx
pop ecx
jmp 0x100372c
call dword [0x10010e4]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.01002e41
push eax
push 0x10015d8
call esi
add esp, 0x14
push dword [ebp - 0x214]
call dword [0x1001018]
jmp 0x1003761
call dword [0x10010e4]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.01002e41
push eax
push 0x10015a4
call dword [0x1001174]
add esp, 0x14
push dword [ebp - 0x21c]
call dword [0x1001018]
pop edi
jmp 0x1003797
call dword [0x10010e4]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.01002e41
push eax
push 0x10013c8
call dword [0x1001174]
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01006b3a
leave
ret

Function at 0x1004072
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10040e8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10040e8
and word [edi], 0
push esi
push 1
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
add esi, 0x618
push esi
push 0x80000002
call dword [0x1001004]
mov esi, eax
test esi, esi
jne 0x10040e4
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push str.Service_Account
push dword [ebp + 8]
mov dword [ebp - 4], pe_nt_image_headers32
call dword [0x1001038]
push dword [ebp + 8]
mov esi, eax
call dword [entry0]
mov eax, esi
jmp 0x10040ed
mov eax, 0x80070057
pop edi
pop esi
leave
ret
Function at 0x10040f6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
je 0x100416f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100416f
push esi
push 1
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
add esi, 0x618
push esi
push 0x80000002
call dword [0x1001004]
mov esi, eax
test esi, esi
jne 0x100416b
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100413a
sub eax, edx
sar eax, 1
add eax, eax
push eax
push dword [ebp + 8]
push 1
push 0
push str.Service_Account
push dword [ebp - 4]
call dword [0x1001008]
push dword [ebp - 4]
mov esi, eax
call dword [entry0]
mov eax, esi
jmp 0x1004174
mov eax, 0x80070057
pop esi
leave
ret

Function at 0x1004323
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push 2
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
add esi, 0x618
push esi
push 0x80000002
call dword [0x1001004]
mov esi, eax
test esi, esi
jne 0x10043cc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push 0x100190c
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [0x1001038]
mov esi, eax
test esi, esi
jne 0x10043cc
test edi, edi
je 0x10043cc
lea eax, [ebp - 0x20c]
mov edx, edi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x10043be
cmp dword [ebp - 0x210], 0
je 0x10043e1
push dword [ebp - 0x210]
call dword [entry0]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01006b3a
leave
ret