joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18028232
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov bl, cl
push edi
mov byte [ebp - 0x31], bl
call fcn.18026170
test al, al
je 0x1802825d
mov eax, 0x80004005
jmp 0x18028406
xor edi, edi
mov dword [ebp - 0x28], 0x181944d0
lea edx, [ebp - 0x28]
mov dword [ebp - 0x24], edi
mov cl, bl
call fcn.18027d0b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], edi
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
call fcn.1801548d
mov dword [ebp - 0x20], 0x1819440c
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x200
call fcn.1801f60c
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
test bl, bl
jne 0x180282a9
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push edi
push ecx
push 0xf003f
push ecx
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.18019dc8
mov ebx, eax
test ebx, ebx
js 0x180283c6
push edi
push edi
push edi
push edi
push 0x1819d728
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180282e2
mov ebx, edi
jmp 0x180283c6
mov dword [ebp - 8], edi
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
lea ecx, [ebp - 8]
call fcn.1800e9b8
mov esi, dword [ebp - 8]
test eax, eax
js 0x180283b8
xor ebx, ebx
lea ecx, [ebp - 0x20]
inc ebx
push ebx
push esi
push 0x1819d728
call fcn.1801a6b2
test eax, eax
js 0x180283b8
mov ecx, 0x181c71e0
call fcn.180262d2
lea ecx, [ebp - 0x20]
call fcn.180281c7
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.18027a38
mov edi, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
js 0x18028378
cmp edi, eax
je 0x18028378
sub esp, 0xc
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.18024d55
mov cl, byte [ebp - 0x31]
call fcn.18027d80
mov edi, dword [ebp - 0x14]
mov ebx, eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x38], eax
test edi, edi
je 0x180283bc
cmp edi, eax
je 0x1802839a
mov esi, dword [ebp - 0x38]
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.18007012
add edi, 4
cmp edi, esi
jne 0x18028383
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
sub eax, edi
and eax, 0xfffffffc
push eax
push edi
call fcn.1800a288
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
jmp 0x180283be
mov ebx, eax
jmp 0x180283be
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.18007012
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x1819440c
je 0x180283e6
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x200
lea ecx, [ebp - 0x30]
call fcn.180154b8
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x181944d0
je 0x18028404
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1803009c
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x180300de
call fcn.18030310
mov ecx, esi
cmp eax, 0xef
jne 0x180300d9
call fcn.18030310
cmp eax, 0xbb
jne 0x180300cd
mov ecx, esi
call fcn.18030310
cmp eax, 0xbf
je 0x180300de
mov dword [esi + 0x40], str.invalid_BOM__must_be_0xEF_0xBB_0xBF_if_given
push 0xe
pop eax
pop esi
ret
call fcn.18030dd6
mov ecx, esi
call fcn.18030310
mov eax, dword [esi + 8]
cmp eax, 0x20
je 0x180300de
cmp eax, 9
je 0x180300de
cmp eax, 0xa
je 0x180300de
cmp eax, 0xd
je 0x180300de
cmp eax, 0x36
jg 0x18030157
je 0x18030126
cmp eax, 0x30
jg 0x1803013e
je 0x18030126
cmp eax, 0xffffffff
je 0x1803013a
test eax, eax
je 0x1803013a
cmp eax, 0x22
je 0x18030132
cmp eax, 0x2c
je 0x1803012e
cmp eax, 0x2d
jne 0x180301a6
mov ecx, esi
pop esi
jmp fcn.180303ba
push 0xd
jmp 0x180300d6
mov ecx, esi
pop esi
jmp fcn.18030780
push 0xf
jmp 0x180300d6
sub eax, 0x31
je 0x18030126
sub eax, 1
je 0x18030126
sub eax, 1
je 0x18030126
sub eax, 1
je 0x18030126
sub eax, 1
jmp 0x18030120
cmp eax, 0x5d
jg 0x1803018c
je 0x18030185
sub eax, 0x37
je 0x18030126
sub eax, 1
je 0x18030126
sub eax, 1
je 0x18030126
sub eax, 1
je 0x1803017e
sub eax, 0x21
jne 0x180301a6
push 8
jmp 0x180300d6
push 0xc
jmp 0x180300d6
push 0xa
jmp 0x180300d6
sub eax, 0x66
je 0x180301d6
sub eax, 8
je 0x180301cb
sub eax, 6
je 0x180301c0
sub eax, 7
je 0x180301b9
dec eax
sub eax, 1
je 0x180301b2
mov dword [esi + 0x40], str.invalid_literal
jmp 0x180300d4
push 0xb
jmp 0x180300d6
push 9
jmp 0x180300d6
push 1
push 4
push str.true
jmp 0x180301df
push 3
push 4
push str.null
jmp 0x180301df
push 2
push 5
push str.false
mov ecx, esi
call fcn.1803037c
pop esi
ret
Function at 0x1803ab69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x181c600c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
push 0x400
lea eax, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edi
push eax
mov dword [esp + 0x1c], edi
call fcn.1812c700
add esp, 0xc
mov dword [esp + 0x18], edi
push 0x60
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1803abe0
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1803abe0
call fcn.18007ab0
mov esi, eax
jmp 0x1803ac93
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1803abfc
call fcn.18007ab0
jmp 0x1803ac86
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1803abf2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea ecx, [esi + 1]
cmp ecx, esi
jae 0x1803ac22
mov esi, 0x8007000e
jmp 0x1803ac88
push 2
pop edx
lfence
call fcn.180100d9
cmp eax, 0x400
jbe 0x1803ac43
push eax
lea ecx, [esp + 0x1c]
lfence
call fcn.18040e63
jmp 0x1803ac4b
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x1803ac1b
push esi
lfence
push dword [esp + 0x1c]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1803abf2
mov eax, dword [esp + 0x18]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [esp + 0x14]
push dword [esp + 0x1c]
call fcn.1803b748
mov esi, eax
test edi, edi
je 0x1803ac93
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x1c]
cmp dword [esp + 0x18], eax
je 0x1803aca6
lea ecx, [esp + 0x18]
call fcn.1803ff97
mov ecx, dword [esp + 0x424]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18117a58
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1803caee
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 0x98]
cmp dword [esi], 0
jne 0x1803cb49
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
inc edi
test eax, eax
je 0x1803cb45
jmp 0x1803cb3f
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
cmp eax, ebx
jae 0x1803cb36
or ecx, 0xffffffff
sub ecx, ebx
add ecx, eax
cmp ecx, dword [ebp - 4]
jae 0x1803cb45
cmp dword [esi + 4], 0
jg 0x1803cb1a
xchg dword [esi], edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1803d38a
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 2
pop esi
mov ecx, dword [edi + 0x80]
cmp ecx, dword [edi + 0x84]
je 0x1803d3bd
xor eax, eax
cmp dword [ecx + 0x14], eax
setne al
mov dword [ebp - 0xc], eax
mov esi, eax
mov al, byte [edi + 0x8d]
mov bl, byte [edi + 0x11]
mov dword [ebp - 0xc], eax
call fcn.1801f60c
mov ecx, dword [edi + 0xc]
inc eax
push esi
push ebx
push dword [ebp - 0xc]
mov dl, byte [eax]
call fcn.1803ea92
add esp, 0xc
mov byte [edi + 0x8c], al
mov ecx, 0x181c7618
push eax
call fcn.18025a3c
cmp byte [edi + 0x8c], 0
je 0x1803d40a
call fcn.18016d6c
test al, al
je 0x1803d40a
mov cl, 1
xor ebx, ebx
jmp 0x1803d40e
xor ebx, ebx
mov cl, bl
call fcn.180740fe
mov edx, dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18014a77
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], ebx
je 0x1803d4ec
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1803d4ec
movzx ecx, byte [0x181cc106]
neg ecx
sbb ecx, ecx
and ecx, 0x181cc000
je 0x1803d498
push 7
pop edx
push 3
pop eax
push eax
push edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008bfd
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.180072ef
push dword [ebp - 0xc]
movzx eax, byte [edi + 0x8c]
push eax
lea eax, [ebp - 0x1c]
push str._is_machine:__d__Current_dir___s_
push eax
call fcn.180072d0
mov ecx, dword [ebp - 0xc]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18007012
mov ecx, edi
call fcn.1803dd47
mov cl, byte [edi + 0x8c]
call fcn.1803e96a
push dword [edi + 0xc]
call fcn.1803dc63
test al, al
je 0x1803d4cc
mov cl, byte [edi + 0x8c]
call fcn.18026aa8
test al, al
je 0x1803d4cc
mov edi, 0xa0430607
jmp 0x1803d4f3
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [edi + 0xc]
call fcn.1803dcb5
mov edi, eax
mov ecx, edi
call fcn.1801ccd7
mov esi, dword [ebp - 8]
test edi, edi
js 0x1803d4f3
jmp 0x1803d4f5
call fcn.1801b6cc
mov edi, eax
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1803e59f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
call fcn.1801f60c
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
jne 0x1803e5d0
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.1800759a
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
push 0x20019
push edi
mov dword [ebp - 0x18], 0x1819440c
mov dword [ebp - 0x10], 0x200
call fcn.18019f1e
mov ebx, eax
mov ecx, ebx
call fcn.1801ccd7
test ebx, ebx
js 0x1803e745
lea ecx, [ebp - 0x18]
call fcn.1801aeee
test eax, eax
je 0x1803e740
push str.Clients
lea ecx, [ebp - 0x18]
call fcn.18019f80
test al, al
je 0x1803e740
push str.ClientState
lea ecx, [ebp - 0x18]
call fcn.18019f80
test al, al
je 0x1803e740
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1803e740
push ebx
push ebx
push ebx
push ebx
push str.path
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1803e740
mov dword [ebp - 8], ebx
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
lea eax, [ebp - 8]
push eax
push str.version
lea ecx, [ebp - 0x18]
call fcn.1801a503
mov ebx, eax
mov ecx, ebx
call fcn.1801ccd7
test ebx, ebx
js 0x1803e733
and dword [ebp - 0x1c], 0
call fcn.1801f60c
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
jne 0x1803e6cc
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
push eax
lea ecx, [ebp - 0x1c]
call fcn.1800759a
and dword [ebp - 0xc], 0
call fcn.1800703b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800774f
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
mov edx, 0x1819de58
mov ecx, esi
call fcn.1801c6e1
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.1801ccd7
test ebx, ebx
js 0x1803e720
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.18009caa
test al, al
je 0x1803e71e
mov ebx, 0xa043090b
jmp 0x1803e720
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18007012
lea ecx, [esi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
jmp 0x1803e745
mov ebx, 0x80070003
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x1819440c
je 0x1803e766
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x200
lea ecx, [edi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1803f47a
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18153500
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.180159b1
test al, al
je 0x1803f66b
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812c700
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.180400a0
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x1803f501
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803f66b
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803f513
mov eax, edi
jmp 0x1803f66d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1803f538
call fcn.1801b6cc
mov esi, eax
jmp 0x1803f667
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.1808128c
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1803f56e
call fcn.1801b6cc
mov esi, eax
jmp 0x1803f652
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18041bf6
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x1803f5e1
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x1803f5a0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a1a20
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803f635
call fcn.1801b6cc
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x1803f640
push esi
call fcn.18118303
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1803f66d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1803f680
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.180159b1
test al, al
je 0x1803f724
call fcn.1804017c
test al, al
jne 0x1803f724
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1803f6c7
call fcn.1801b6cc
mov ebx, eax
jmp 0x1803f720
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.1808128c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1803f6fc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803f707
call fcn.1801b6cc
mov ebx, eax
test esi, esi
je 0x1803f70e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x1803f726
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1803f94b
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18153500
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.180159b1
test al, al
je 0x1803fb3c
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812c700
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18040509
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x1803f9d2
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803fb3c
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803f9e4
mov eax, edi
jmp 0x1803fb3e
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1803fa09
call fcn.1801b6cc
mov esi, eax
jmp 0x1803fb38
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.180811cf
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1803fa3f
call fcn.1801b6cc
mov esi, eax
jmp 0x1803fb23
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18041bf6
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x1803fab2
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x1803fa71
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a1a20
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803fb06
call fcn.1801b6cc
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x1803fb11
push esi
call fcn.18118303
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1803fb3e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1803fb51
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.180159b1
test al, al
je 0x1803fbf5
call fcn.180405e5
test al, al
jne 0x1803fbf5
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1803fb98
call fcn.1801b6cc
mov ebx, eax
jmp 0x1803fbf1
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180811cf
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1803fbcd
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803fbd8
call fcn.1801b6cc
mov ebx, eax
test esi, esi
je 0x1803fbdf
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x1803fbf7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret

Function at 0x18040254
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18040f14
test al, al
je 0x1804027c
xor eax, eax
jmp 0x1804032f
call fcn.1803f7cb
mov esi, eax
mov ecx, esi
call fcn.1801ccd7
test esi, esi
jns 0x18040298
lfence
mov eax, esi
jmp 0x1804032f
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180402c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1804032d
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1804032d
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.1808128c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x180402fb
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18040314
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040310
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1804031b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret