joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ad30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011f668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x101267d4]
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov byte [esp + 0x1c], 3
cmp eax, 0xffffffff
je 0x1001ad89
push eax
lea eax, [esp + 0x14]
push str.__lu
push eax
call fcn.10030030
add esp, 0xc
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x1001ada5
push eax
lea ecx, [esp + 0x10]
push str.__lu
push ecx
call fcn.10030030
add esp, 0xc
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
je 0x1001adc1
push eax
lea edx, [esp + 0xc]
push str.__lu
push edx
call fcn.10030030
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
je 0x1001addd
push eax
lea eax, [esp + 8]
push 0x1014600c
push eax
call fcn.10030030
add esp, 0xc
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
call fcn.1002c910
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
add esi, 4
push str._s_s_s_s_s
push esi
mov byte [esp + 0x38], 4
call fcn.10030030
add esp, 0x1c
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call fcn.1002d0b0
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 2
call fcn.1002d0b0
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.1002d0b0
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.1002d0b0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.1002d0b0
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x14

Function at 0x1001af10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011f6c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x101267d4]
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 0x18], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x18], 2
test eax, eax
je 0x1001af5c
push 0x1014431c
jmp 0x1001af61
push 0x1014430c
lea ecx, [esp + 8]
call fcn.1002d330
mov eax, dword [esi + 4]
mov ecx, dword [esp + 4]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x10143c78
push edx
call fcn.10030030
mov esi, dword [esp + 0x30]
add esp, 0x10
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.1002c6b0
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.1002d0b0
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.1002d0b0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x1001b6d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001b6ea
test al, 0x10
je 0x1001b6ea
mov eax, 1
ret
xor eax, eax
ret
Function at 0x1001c860
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x1016dfa8
jmp 0x1001c890
push 0xffffffffffffffff
push 0x1011f925
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], 0x1e
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
lea ecx, [esi + 0x5c]
mov byte [esp + 0x1c], 4
call fcn.1003ae20
lea ebx, [esi + 0x7c]
mov dword [esp + 0x10], ebx
mov dword [ebx], 0x10126748
mov dword [ebx + 4], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], edi
lea ecx, [ebx + 0x14]
mov byte [esp + 0x1c], 6
call fcn.1003ae20
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebx + 0x34]
mov byte [esp + 0x34], 7
call fcn.1001c7f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [ebx + 0x4c]
call fcn.1001c4e0
mov dword [ebx], 0x10126740
lea ecx, [esi + 0x104]
mov byte [esp + 0x1c], 8
call fcn.1001ed30
lea ebx, [esi + 0x140]
mov dword [esp + 0x10], ebx
mov dword [ebx], 0x10126748
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], 0x11
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov eax, 0xa
mov dword [ebx + 0x1c], eax
lea ecx, [ebx + 0x20]
mov byte [esp + 0x1c], al
call fcn.1003ae20
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebx + 0x40]
mov byte [esp + 0x34], 0xb
call fcn.1001c7f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
lea ecx, [ebx + 0x58]
call fcn.1001c4e0
mov dword [ebx], 0x10126738
lea ecx, [esi + 0x1f4]
mov byte [esp + 0x1c], 0xc
call fcn.1001cd60
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x21c], edi
mov dword [esi], 0x10126734
mov dword [esi + 0x144], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1001eae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011fbc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0x2710
lea eax, [esi + 0x34]
push 0
push eax
push 0
push 0
lea ecx, [esp + 0x1c]
mov dword [eax], esi
mov dword [esi + 0x38], 0x10001cf0
call fcn.1001c4e0
push 0
lea eax, [esp + 8]
push 0
push eax
mov ecx, 0x1016dfa8
mov dword [esp + 0x54], 0
call fcn.1001d9b0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x54], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x60], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x64], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x78], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x70], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x74], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x84], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x7c], edx
mov dword [esi + 0x80], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.1001c560
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret

Function at 0x1001f4c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, ecx
push esi
push edi
xor edi, edi
lea esi, [ebp + 0xa4]
call ebx
mov ecx, dword [esi - 0x10]
test ecx, ecx
jg 0x1001f4ec
mov ecx, dword [esi]
test ecx, ecx
je 0x1001f4ec
sub eax, ecx
cmp eax, 0x493e0
ja 0x1001f4fa
inc edi
add esi, 4
cmp edi, 4
jb 0x1001f4d4
pop edi
pop esi
pop ebp
pop ebx
ret
call ebx
push eax
lea eax, [ebp + edi*4 + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1001f510
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1011fcd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0x20]
push 1
push eax
lea ecx, [esp + 0x24]
call fcn.1003b350
mov esi, dword [ebp + 0x10]
mov byte [esp + 0x7c], 1
neg esi
sbb esi, esi
cmp esi, ebx
je 0x1001f65b
lea ecx, [esp + 0x14]
call fcn.1001aae0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x50]
mov byte [esp + 0x94], 2
call fcn.1001c4e0
cmp esi, 0xffffffff
mov byte [esp + 0x7c], 3
mov ecx, esi
jne 0x1001f5b9
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, ebx
jbe 0x1001f5b9
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
cmp ecx, ebx
jne 0x1001f5b9
inc eax
add edx, 4
cmp eax, esi
jb 0x1001f5ab
mov esi, dword [ecx]
cmp esi, ebx
jne 0x1001f5de
mov eax, dword [ecx + 4]
mov edi, dword [ebp + 0xc]
inc eax
cmp eax, edi
jae 0x1001f5de
mov edx, dword [ebp + 8]
lea edx, [edx + eax*4]
mov esi, dword [edx]
cmp esi, ebx
jne 0x1001f5de
inc eax
add edx, 4
cmp eax, edi
jb 0x1001f5d0
mov eax, dword [ecx + 0xc]
add ecx, 0x10
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.1001dec0
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
je 0x1001f637
mov ecx, dword [esp + 0x5c]
cmp ecx, ebx
je 0x1001f637
mov edx, dword [esp + 0x10]
sub edx, ecx
cmp edx, eax
jbe 0x1001f637
mov edi, dword [esp + 0x2c]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
lea eax, [edi + 1]
push eax
call fcn.100206f0
lea eax, [edi + edi*2]
lea ecx, [esp + 0x38]
push ecx
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x2c]
lea ecx, [eax + edx*4]
call fcn.1001dec0
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 2
call fcn.1001c560
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 1
call fcn.1001ab20
cmp esi, ebx
jne 0x1001f571
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7c], bl
call fcn.1003b3b0
mov eax, dword [esp + 0x2c]
xor esi, esi
cmp eax, ebx
jle 0x1001f690
xor edi, edi
mov ecx, dword [esp + 0x28]
lea edx, [edi + ecx]
mov ecx, dword [ebp + 4]
push edx
call fcn.1001df20
mov eax, dword [esp + 0x2c]
inc esi
add edi, 0x3c
cmp esi, eax
jl 0x1001f674
xor esi, esi
cmp eax, ebx
jle 0x1001f6b3
xor edi, edi
mov eax, dword [esp + 0x28]
lea ecx, [edi + eax]
push ecx
mov ecx, ebp
call fcn.1001f8d0
mov eax, dword [esp + 0x2c]
inc esi
add edi, 0x3c
cmp esi, eax
jl 0x1001f698
mov esi, dword [esp + 0x28]
mov dword [esp + 0x7c], 0xffffffff
cmp esi, ebx
je 0x1001f6e3
cmp eax, ebx
je 0x1001f6da
lea edi, [eax]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx]
add esi, 0x3c
dec edi
jne 0x1001f6c9
mov esi, dword [esp + 0x28]
push esi
call fcn.100620d6
add esp, 4
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret
Function at 0x1001fa80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011fd30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebp
push esi
push edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov edi, ecx
push 0
push 0
push 0
lea ecx, [esp + 0x30]
call fcn.1001c4e0
lea eax, [edi + 0x20]
push 1
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x64], 0
call fcn.1003b350
mov ecx, dword [esp + 0x64]
mov byte [esp + 0x5c], 1
lea ebp, [ecx + 0xc]
push ebp
call fcn.1001aab0
xor edx, edx
div dword [edi + 0xc]
mov eax, dword [edi + 8]
test eax, eax
je 0x1001fb0b
mov esi, dword [eax + edx*4]
test esi, esi
je 0x1001fb0b
lea edx, [esi + 8]
push ebp
push edx
call fcn.1001aa90
add esp, 8
test eax, eax
jne 0x1001fb07
mov esi, dword [esi]
test esi, esi
jne 0x1001faee
jmp 0x1001fb6f
test esi, esi
jne 0x1001fb0f
xor esi, esi
jmp 0x1001fb6f
mov eax, dword [esi + 0x14]
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x20], ecx
mov edx, dword [esi + 0x20]
mov dword [esp + 0x28], edx
mov eax, dword [esi + 0x24]
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x30], ecx
mov edx, dword [esi + 0x2c]
mov dword [esp + 0x34], edx
mov eax, dword [esi + 0x30]
mov dword [esp + 0x38], eax
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x3c], ecx
mov edx, dword [esi + 0x38]
mov dword [esp + 0x40], edx
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x44], eax
mov ecx, dword [esi + 0x40]
mov dword [esp + 0x48], ecx
mov edx, dword [esi + 0x44]
mov dword [esp + 0x4c], edx
mov eax, dword [esi + 0x48]
mov dword [esp + 0x50], eax
mov esi, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.1003b3b0
test esi, esi
je 0x1001fb9a
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edi + 4]
call fcn.1001df20
lea edx, [esp + 0x18]
mov ecx, edi
push edx
call fcn.1001f8d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x5c], 0xffffffff
call fcn.1001c560
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x54
ret 4
Function at 0x1001fbc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1011fd48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 0xa4]
push 0xffffffffffffffff
push 0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x40]
push eax
push 2
push 0
lea ecx, [esp + 0x1c]
mov dword [eax], esi
mov dword [esi + 0x44], 0x10001cf0
call fcn.1001c4e0
push 0
lea edx, [esp + 8]
push 0
push edx
mov ecx, 0x1016dfa8
mov dword [esp + 0x54], 0
call fcn.1001d9b0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x60], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x68], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x74], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x80], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x88], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x8c], edx
mov dword [esi + 0x90], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.1001c560
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret

Function at 0x10020ae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011fde8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esi + 0x44]
lea ecx, [esi + 0x3c]
push 0
push eax
mov dword [eax], ecx
push 2
push 1
lea ecx, [esp + 0x1c]
mov dword [esi + 0x48], 0x10001cf0
call fcn.1001c4e0
push 0
lea edx, [esp + 8]
push 0
push edx
mov ecx, 0x1016dfa8
mov dword [esp + 0x54], 0
call fcn.1001d9b0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x6c], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x74], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x78], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x7c], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x80], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x84], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x8c], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x90], edx
mov dword [esi + 0x94], eax
mov dword [esp + 0x48], 0xffffffff
call fcn.1001c560
mov ecx, dword [esp + 0x40]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x10022e80
Capabilities:
Start service

Disassembly:
push ebx
call fcn.10075200
test eax, eax
jne 0x10022e8c
pop ebx
ret
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x10022ea2
mov dword [0x1016e270], 0x57
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
xor esi, esi
push 0xf003f
push esi
push esi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x10022edf
push 0x10
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10022edf
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
mov dword [0x1016e270], 0
jne 0x10022f1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1016f218]
mov dword [0x1016e270], eax
test ecx, ecx
je 0x10022f1d
push eax
push eax
push str.CTSDEncryptDrv:_StartService___failed__error_ld_0x_08x__n
push str.TSDEncryptDrv
push 4
push 0x1016e984
call fcn.100602c0
add esp, 0x18
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10022f2a
push esi
call ebx
test edi, edi
je 0x10022f31
push edi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x1002b780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1002b7ce
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002b7ce
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x1002b7d3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x1002b7b9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x1002b7e3
test esi, esi
jne 0x1002b801
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1002b7ff
mov byte [eax + esi - 1], 0
jne 0x1002b808
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x10030ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10030f40
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10030f40
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x10030f45
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x10030f2b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x10030f52
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x1003b8f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x1003b931
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003b933
mov esi, edi
test esi, esi
je 0x1003b9a8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003b99d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1003b99d
cmp dword [esp + 0x1c], eax
jbe 0x1003b96e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003b99d
cmp esi, edi
je 0x1003b98f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x1003b9a8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x1003b9c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x1003ba25
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003ba25
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x1003ba25
cmp dword [esp + 0x18], eax
jbe 0x1003ba0b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x1003ba29
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x1003bb00
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x1003bb5f
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003bb5f
cmp dword [esp + 0xc], 3
jne 0x1003bb5f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x1003bb5f
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003bb5f
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x1003bcc0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1012099f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x101267d4]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x1003bd2b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003bd2d
mov esi, edi
test esi, esi
je 0x1003bdf7
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003bdec
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x1003bd6f
cmp eax, 2
je 0x1003bd6f
cmp eax, 6
je 0x1003bd6f
cmp eax, 7
jne 0x1003bdec
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.10062117
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x1003bdd2
lea ecx, [esp + 0x14]
call fcn.1002d330
cmp esi, dword [esp + 0x14]
je 0x1003bdc7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.100620d6
add esp, 4
jmp 0x1003be09
call fcn.100620d6
add esp, 4
lea ecx, [esp + 0x10]
push 0x1016da48
call fcn.1002d330
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x1003bdf7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1003be09
push eax
lea ecx, [esp + 0x14]
call fcn.1002d330
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.1002c6b0
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.1002d0b0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10