joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022af0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
cmp dword [ebp + 8], 0
je 0x10022b11
mov eax, dword [ebp + 4]
push eax
push 0x24
lea ecx, [ebp + 0x20]
push 1
push ecx
call fcn.100048e0
jmp 0x10022b50
cmp dword [ebp + 0xc], 0
je 0x10022b3f
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
sub eax, edx
cmp eax, 0x24
jb 0x10022c48
mov esi, dword [ebp + 0x14]
add esi, edx
lea edi, [ebp + 0x20]
mov ecx, 9
add edx, 0x24
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x1c], edx
jmp 0x10022b5c
mov edx, dword [ebp]
push edx
push 0x24
lea eax, [ebp + 0x20]
push 1
push eax
call fcn.100273cd
add esp, 0x10
cmp eax, 0x24
jne 0x10022c48
cmp dword [ebp + 0x10], 0
je 0x10022b7d
mov ecx, dword [ebp + 0x30]
push ecx
call fcn.10025e60
mov edx, dword [ebp + 0x34]
push edx
mov dword [ebp + 0x30], eax
call fcn.10025e60
add esp, 8
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x34]
sub eax, 0
je 0x10022b9a
sub eax, 1
je 0x10022b9a
sub eax, 1
jne 0x10022c17
mov edi, 2
jmp 0x10022b9f
mov edi, 1
cmp dword [ebp + 0x10], 0
je 0x10022bc5
test edi, edi
jle 0x10022bc5
lea esi, [ebp + 0x38]
lea esp, [esp]
mov eax, dword [esi]
push eax
call fcn.10025e60
mov dword [esi], eax
add esp, 4
add esi, 4
sub edi, 1
jne 0x10022bb0
cmp dword [ebp + 0x44], 0
mov dword [esp + 0x14], 0
jl 0x10022c17
lea esi, [ebp + 0x48]
lea ecx, [ebp + 0x20]
xor edi, edi
mov eax, esi
sub ecx, esi
nop
mov dl, byte [eax]
mov bl, byte [ecx + eax]
add eax, 1
cmp dl, bl
jne 0x10022c04
add edi, 1
cmp edi, 0x10
jl 0x10022be0
mov eax, dword [ebp + 0x30]
cmp eax, dword [esi + 0x10]
jne 0x10022c04
mov ecx, dword [ebp + 0x34]
cmp ecx, dword [esi + 0x14]
je 0x10022c1f
mov eax, dword [esp + 0x14]
add eax, 1
add esi, 0x2c
cmp eax, dword [ebp + 0x44]
mov dword [esp + 0x14], eax
jle 0x10022bd6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x14]
imul eax, eax, 0x2c
lea edx, [eax + ebp + 0x48]
push edx
mov eax, ebp
call fcn.10022640
add esp, 4
neg eax
sbb eax, eax
inc eax
jne 0x10022af8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
neg eax
pop ebp
sbb eax, eax
pop ebx
ret

Function at 0x10026fe4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10050294]
jne 0x10026fee
repz ret
jmp fcn.1002cddc
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4013d6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041c0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x401301
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014a0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041c8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041c8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014a0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401485
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007fbe
pop dword [ebp - 0x34]
mov eax, 0x10007fbe
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x34633e18
sub dword [ebp - 0x44], 0xe610f8cd
mov dword [ebp - 0x40], 0x35ef42bb
sub dword [ebp - 0x40], 0x3bbf676
mov dword [ebp - 0x3c], 0x2c9a0229
sub dword [ebp - 0x3c], 0xe04dbdfb
mov dword [ebp - 0x38], 0x83c5b69f
sub dword [ebp - 0x38], 0x83c5b69f
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x388a750e
add dword [ebp - 0x44], 0x3be7f448
mov dword [ebp - 0x40], 0xbff670bd
sub dword [ebp - 0x40], 0x7e8a0f48
mov dword [ebp - 0x3c], 0xe708a488
add dword [ebp - 0x3c], 0x7c66c7e4
mov dword [ebp - 0x38], 0x37f84fd7
add dword [ebp - 0x38], 0xc807b029
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x399a3
push 0
call eax
mov ecx, 0xbc537646
sub ecx, 0xbc5325da
xor esi, esi
add esi, eax
mov edi, 0x10026800
add edi, dword [ebp - 0x34]
mov edx, 0xf98431b5
add edx, 0x28161b4e
mov dword [ebp - 0x2c], 0xa8a229b3
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0x809bbde7
sub ebx, edx
mov dword [ebp - 0x20], 0xabe3b383
mov dword [esi], ebx
add esi, 0x591ad057
add esi, 0xa6e52fad
add edi, 0x495f6d74
sub edi, 0x495f6d70
loop 0x100080cd
add eax, 0xf889fc87
add eax, 0x77737fc
xor ebx, ebx
add ebx, eax
add eax, 0xf954daa6
add eax, 0x6ab255f
mov ecx, 0x15b4e853
add ecx, 0xfa4b17ad
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_394
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_105
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol esi, 0x88
ror edx, 0xb7
or ebx, 0x14
dec edx
rcr esi, 0x1f
neg edi
inc ebx
imul ebx
neg edx
rcr edi, 0x34
neg esi
ror esi, 0x73
dec eax
not eax
or edx, 0x7d
rcl eax, 0x4b
sbb esi, 0x48
bswap ebx
sbb ebx, 0x47
imul edi
and eax, 0xc6
ror edi, 0xd
rol edx, 0xee
dec edx
inc edi
rol edx, 0xa7
or ebx, 0x69
add eax, 0xff
imul esi
bswap ebx
and esi, 0xb4
not esi
rcl edx, 8
not eax
rol ebx, 0x49
bswap ebx
bswap eax
add eax, 0xd0
bswap edi
neg edx
ror eax, 0x5e
bswap edi
add ebx, 0x73
rcl edx, 0xda
dec eax
imul ebx
imul esi
neg esi
dec eax
add esi, 0xdf
xor ecx, ecx
xor edi, edi
rcl ebx, 0x90
sbb edi, 0xa1
neg edi
not ebx
rol ebx, 0xe8
dec esi
add esi, 0x96
rcr edi, 0x12
mov esi, 0x37
not eax
and eax, 0xf1
neg esi
not eax
bswap esi
or esi, 0xd5
bswap esi
dec esi
rcr ebx, 0xb
inc edi
sbb ebx, 0x4e
bswap edi
inc ebx
not ebx
not eax
add esi, 0x16
inc esi
sub edx, 0x10
neg edi
imul edx
imul edx
dec esi
mov eax, 6
bswap eax
rol edi, 6
inc edx
inc esi
rcr eax, 0xf0
inc ebx
mov eax, 0x7b
sbb edx, 0xda
mov edi, 4
dec eax
neg eax
rcr edx, 0x83
imul edx
dec eax
inc eax
neg edi
inc edx
neg edx
mov ecx, dword [ebp + 0xc]
and esi, 0xa2
neg edx
sbb edi, 0x50
and ebx, 0xb3
imul esi
dec esi
rcl ebx, 0x69
bswap esi
and esi, 0x47
sub edi, 0x9d
dec ebx
rcr esi, 0x98
ror edx, 0x7e
ror edx, 0xc9
neg edx
not esi
add eax, 0x40
bswap ebx
imul esi
sbb ebx, 0xcf
imul edi
inc ebx
bswap esi
mov esi, 0x44
imul edx
rcr ebx, 0x15
or edx, 0x27
not ebx
bswap edi
inc edi
bswap eax
not eax
inc esi
sbb ebx, 0x2b
sbb edx, 0x94
bswap eax
ror eax, 0xce
sbb ebx, 0x7c
rol edx, 0x6a
mov edi, 0xcf
not edx
imul edi
rcr edi, 0x52
sbb eax, 0x15
bswap edi
not ebx
bswap esi
add edi, 0x2c
bswap esi
sub edx, 0x27
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ebx, esi
xor eax, eax
mov eax, eax
xor eax, esi
xor eax, esi
xor ebx, esi
mov ebx, eax
mov esi, ebx
mov esi, esi
mov eax, eax
mov eax, ebx
not byte [edi]
mov eax, ebx
mov eax, ebx
mov ebx, eax
mov esi, ebx
xor esi, ebx
xor esi, esi
mov esi, eax
xor esi, esi
mov eax, esi
add byte [edi], 0x67
mov eax, esi
mov eax, esi
xor ebx, esi
mov esi, eax
mov eax, esi
mov esi, esi
xor esi, esi
xor eax, ebx
mov ebx, eax
sub byte [edi], 0x88
mov ebx, esi
mov esi, eax
xor ebx, ebx
mov eax, ebx
xor eax, esi
xor ebx, ebx
mov esi, esi
mov esi, esi
xor eax, ebx
imul byte [edi]
inc edi
loop 0x4011a1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404c14
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4546f0]
jne 0x404c1e
repz ret
jmp fcn.00409115
Function at 0x405583
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402eb1
and dword [ebp - 4], 0
cmp dword [0x4553f4], 0
mov ebx, eax
jne 0x405634
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4056e5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40eb90
push edi
call esi
test eax, eax
je 0x4056e5
push eax
call fcn.00402e3f
mov dword [esp], 0x40eb80
push edi
mov dword [0x4553f4], eax
call esi
push eax
call fcn.00402e3f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4553f8], eax
call esi
push eax
call fcn.00402e3f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4553fc], eax
call esi
push eax
call fcn.00402e3f
pop ecx
mov dword [0x455404], eax
test eax, eax
je 0x405634
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e3f
pop ecx
mov dword [0x455400], eax
mov eax, dword [0x455400]
cmp eax, ebx
je 0x40568c
cmp dword [0x455404], ebx
je 0x40568c
push eax
call fcn.00402eba
push dword [0x455404]
mov esi, eax
call fcn.00402eba
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40568c
test edi, edi
je 0x40568c
call esi
test eax, eax
je 0x405683
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405683
test byte [ebp - 0xc], 1
jne 0x40568c
or dword [ebp + 0x10], 0x200000
jmp 0x4056c5
mov eax, dword [0x4553f8]
cmp eax, ebx
je 0x4056c5
push eax
call fcn.00402eba
pop ecx
test eax, eax
je 0x4056c5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4056c5
mov eax, dword [0x4553fc]
cmp eax, ebx
je 0x4056c5
push eax
call fcn.00402eba
pop ecx
test eax, eax
je 0x4056c5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4553f4]
call fcn.00402eba
pop ecx
test eax, eax
je 0x4056e5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4056e7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x880370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x88038e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x8a9074
push ecx
mov edi, eax
call fcn.00894198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8803cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0089402e
push esi
call fcn.00893fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x883850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x8838ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x8ae720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8838ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.008941e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x8838ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x8ae720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x88392a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00895082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x883957
mov word [eax], si
add eax, 2
push eax
call fcn.00895030
add esp, 4
jmp 0x883959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x8838ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x8838b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x883ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x884080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x8840c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x8a9458
push ecx
call fcn.008941e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.008941e1
add esp, 0x10
jmp 0x8840d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0089420b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00893dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00884050
mov eax, dword [0x8ae728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x88413b
push esi
call fcn.00883fb0
add esp, 4
mov dword [0x8ae728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x88414c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00883ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x887440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x8874b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x88748e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x887471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x88747e
add edx, ecx
cmp ebx, edx
jb 0x88748a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x887467
xor ecx, ecx
jmp 0x8874a2
test eax, eax
jne 0x887492
xor ecx, ecx
jmp 0x8874a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.008873c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x8878f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x887921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x887946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x88796e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x887993
push ecx
push esi
call fcn.008874c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x888c00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x888c4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x888c2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x888c38
add edx, eax
cmp ebx, edx
jb 0x888c46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x888c21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x888c50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x888c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x888cb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x888c9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x888ca8
add edx, ecx
cmp ebx, edx
jb 0x888cb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x888c91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x888f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00895145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x888ffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x888fdd
lea eax, [esp + 0x18]
push eax
jmp 0x888fe2
push 0x8ae720
call fcn.00894fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x888fb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x888f40
push 4
push ecx
push eax
call fcn.0089543f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x889310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00895145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x8893ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x88938d
lea eax, [esp + 0x18]
push eax
jmp 0x889392
push 0x8ae720
call fcn.00894fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x889360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x888f40
push 4
push ecx
push eax
call fcn.0089543f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x88af20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0x88afd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x88afcf
push ebx
push edi
push 0x8ae770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x88afae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x8ae770
push esi
call ebx
test eax, eax
je 0x88afae
mov ebp, 3
cmp dword [0x8ae774], ebp
jne 0x88afaa
push 0x3e8
call edi
push 0x8ae770
push esi
call ebx
test eax, eax
jne 0x88af8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0x88afc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0x88afbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret