joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42973a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x42974b
pop esi
ret
push ebx
push edi
push esi
call fcn.00429788
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00425606
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x429773
push ebx
push esi
push edi
call fcn.004116b0
add esp, 0xc
push 0
call fcn.00422e14
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4297bf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004297ca
Function at 0x42c81e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4575c8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42c85e
cmp byte [ebx], 0xa
jne 0x42c85e
or byte [edi + eax + 0x28], 4
jmp 0x42c863
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x42c962
mov dl, byte [eax]
cmp dl, 0x1a
je 0x42c945
inc eax
cmp dl, 0xd
je 0x42c88f
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x42c8b5
cmp eax, ecx
jae 0x42c8c3
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x42c877
jmp 0x42c962
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x42c940
cmp dword [ebp - 0x10], 0
je 0x42c940
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4575c8]
test byte [eax + edi + 0x28], 0x48
je 0x42c91a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x42c905
mov byte [esi], dl
jmp 0x42c916
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4575c8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42c962
cmp byte [ebp - 1], 0xa
jne 0x42c929
cmp esi, ebx
jne 0x42c929
mov byte [esi], 0xa
jmp 0x42c961
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042ccff
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42c962
mov byte [esi], 0xd
jmp 0x42c961
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4575c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42c95f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42c962
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42c96b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4575c8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42c9b1
cmp word [ebx], dx
jne 0x42c9b1
or byte [eax + edi + 0x28], 4
jmp 0x42c9b6
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x42cb19
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x42caf9
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x42c9f7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x42ca2d
cmp eax, edx
jae 0x42ca3b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x42c9d2
jmp 0x42cb19
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x42caf4
cmp dword [ebp - 0x18], 0
je 0x42caf4
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4575c8]
test byte [eax + edi + 0x28], 0x48
je 0x42caca
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x42ca8e
mov word [esi], cx
jmp 0x42cac5
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4575c8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4575c8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4575c8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x42cb19
pop eax
cmp word [ebp - 4], ax
jne 0x42cada
cmp esi, ebx
jne 0x42cada
mov word [esi], ax
jmp 0x42cb16
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0042ccff
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x42cb19
push 0xd
pop eax
jmp 0x42cad5
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4575c8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x42cb13
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x42cb19
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x101637c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
mov edi, 0x1001adc
jne 0x101639f
push 0x1001bac
push 0x1676
push edi
call fcn.0107b4be
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
test eax, eax
jne 0x10163c5
push 0x1001bfc
push 0x1677
push edi
call fcn.0107b4be
push 0x80004005
call fcn.01015f2c
cmp dword [ebp + 0x10], 1
je 0x10163e1
cmp dword [ebp + 0x10], 2
je 0x10163e1
push 0x1001bd4
push 0x1678
push edi
call fcn.0107b4be
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x101640d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
cmp dword [ebx], 0
push edi
mov edi, 0x1001adc
jne 0x1016431
push 0x1001bac
push 0x1683
push edi
call fcn.0107b4be
mov esi, dword [ebp + 0xc]
xor eax, eax
test esi, esi
setne al
test eax, eax
jne 0x1016459
push 0x1001bfc
push 0x1684
push edi
call fcn.0107b4be
push 0x80004005
call fcn.01015f2c
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x101645b
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1016c2a
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.010162c8
mov edi, eax
cmp edi, esi
je 0x1016c9c
lea ecx, [ebp - 0x214]
call fcn.0101623a
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0106f5f8
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1016cba
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.01016c2a
cmp eax, esi
jne 0x1016d05
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x1016ca4
lea ecx, [ebp - 0x214]
call fcn.0101623a
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.01016166
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0101623a
mov eax, esi
jmp 0x1016c8c
Function at 0x101859a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1105d7d
call fcn.0106f6f9
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x10185f3
call fcn.01016097
mov esi, eax
jmp 0x10186fc
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x101860c
call fcn.01016097
jmp 0x10186ee
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1018602
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x1018672
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1018658
lea ecx, [ebp - 0x418]
call fcn.01016b9b
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.010169ee
mov eax, esi
call fcn.0106f764
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.010175b9
mov dword [ebp - 4], 1
jmp 0x10186a0
cmp dword [ebp - 0x418], esi
jne 0x10186af
mov esi, 0x8007000e
jmp 0x10186f0
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x1018602
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.0101845d
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x101865d
lea ecx, [ebp - 0x418]
call fcn.01016b9b
jmp 0x101865d
Function at 0x101be8e
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
mov eax, dword [0x111124c]
mov ebx, 0x10023f8
cmp eax, 0x111124c
je 0x101becb
test byte [eax + 0x1c], 1
je 0x101becb
cmp byte [eax + 0x19], 4
jb 0x101becb
push ebx
push 0x136
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
test byte [esi + 0xec], 4
jne 0x101bee8
push 0x1002518
push 0x1821
push 0x1002460
call fcn.0107b4be
push edi
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x114]
push eax
push dword [esi + 0x170]
call fcn.010e00be
mov dword [ebp - 4], eax
test eax, eax
jl 0x101c05c
mov ecx, dword [esi + 0x144]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
test ecx, ecx
je 0x101bfaf
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x101bf4b
test byte [eax + 0x1c], 1
je 0x101bf4b
cmp byte [eax + 0x19], 4
jb 0x101bf4b
push ecx
push dword [ebp - 8]
push ebx
push 0x137
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019979
push dword [esi + 0x144]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x101bfaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x101c04f
test byte [eax + 0x1c], 1
je 0x101c04f
cmp byte [eax + 0x19], 2
jb 0x101c04f
push edi
push dword [esi + 0x144]
push dword [ebp - 8]
push ebx
push 0x138
jmp 0x101c03f
and edi, 0xffff
or edi, 0x80070000
mov dword [ebp - 4], edi
jmp 0x101c061
cmp dword [esi + 0xe8], 4
je 0x101c05c
mov ecx, dword [esi + 0x174]
test ecx, ecx
je 0x101c05c
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x101bffa
test byte [eax + 0x1c], 1
je 0x101bffa
cmp byte [eax + 0x19], 4
jb 0x101bffa
push ecx
push dword [esi + 0x170]
push ebx
push 0x139
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019979
push dword [esi + 0x174]
push dword [esi + 0x170]
call edi
test eax, eax
jne 0x101c05c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x101c04f
test byte [eax + 0x1c], 1
je 0x101c04f
cmp byte [eax + 0x19], 2
jb 0x101c04f
push edi
push dword [esi + 0x174]
push dword [esi + 0x170]
push ebx
push 0x13a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019a40
mov eax, dword [0x111124c]
test edi, edi
jg 0x101bf9b
jmp 0x101bfa7
mov eax, dword [0x111124c]
cmp dword [ebp - 8], 0
pop edi
je 0x101c076
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x111124c]
cmp dword [ebp - 4], 0
jge 0x101c0a8
cmp eax, 0x111124c
je 0x101c0cc
test byte [eax + 0x1c], 1
je 0x101c0a8
cmp byte [eax + 0x19], 2
jb 0x101c0a8
push dword [ebp - 4]
push ebx
push 0x13b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189f6
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x101c0cc
test byte [eax + 0x1c], 1
je 0x101c0cc
cmp byte [eax + 0x19], 4
jb 0x101c0cc
push ebx
push 0x13c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x1027b31
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20c], 0
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [0x111124c]
mov ebx, 0x111124c
cmp eax, ebx
je 0x1027b81
test byte [eax + 0x1c], 1
je 0x1027b81
cmp byte [eax + 0x19], 4
jb 0x1027b81
push 0x10023f8
push 0x26a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0xe8]
push dword [esi + 0xf0]
call fcn.010d6bb2
mov edi, eax
test edi, edi
jge 0x1027be1
mov eax, dword [0x111124c]
cmp eax, ebx
je 0x1027ce0
test byte [eax + 0x1c], 1
je 0x1027ce0
cmp byte [eax + 0x19], 2
jb 0x1027ce0
push edi
push dword [esi + 0xf0]
push 0x10023f8
push 0x26b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010196ed
jmp 0x1027cdb
mov edi, 0x101
push edi
lea eax, [ebp - 0x208]
push 0
push eax
mov dword [ebp - 0x210], edi
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x188]
add esp, 0xc
test eax, eax
jne 0x1027c6c
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1027c7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1027c34
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [0x111124c]
cmp eax, ebx
je 0x1027c61
test byte [eax + 0x1c], 1
je 0x1027c61
cmp byte [eax + 0x19], 2
jb 0x1027c61
push ecx
push 0x10023f8
push 0x26c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189f6
xor eax, eax
mov word [ebp - 0x208], ax
jmp 0x1027c7a
push eax
push edi
lea eax, [ebp - 0x208]
push eax
call fcn.01025872
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x118]
push dword [esi + 0x114]
push dword [esi + 0xf0]
push dword [ebp - 0x20c]
call fcn.010bddb3
mov edi, eax
test edi, edi
jge 0x1027cdb
mov eax, dword [0x111124c]
cmp eax, ebx
je 0x1027ce0
test byte [eax + 0x1c], 1
je 0x1027ce0
cmp byte [eax + 0x19], 2
jb 0x1027ce0
push edi
push dword [esi + 0xf4]
push dword [esi + 0xf0]
push 0x10023f8
push 0x26d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019a40
mov eax, dword [0x111124c]
cmp dword [ebp - 0x20c], 0
je 0x1027d01
push dword [ebp - 0x20c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
and dword [ebp - 0x20c], 0
mov eax, dword [0x111124c]
cmp eax, ebx
je 0x1027d26
test byte [eax + 0x1c], 1
je 0x1027d26
cmp byte [eax + 0x19], 4
jb 0x1027d26
push 0x10023f8
push 0x26e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0106f5f8
leave
ret
Function at 0x103326f
Capabilities:
Move file

Disassembly:
push 0x1c
mov eax, 0x1107a5d
call fcn.0106f64b
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xe], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x114]
push eax
push dword [esi + 0x170]
mov dword [ebp - 4], ebx
call fcn.010e00be
mov edi, eax
cmp edi, ebx
jl 0x10333e6
lea eax, [ebp - 0xe]
push eax
mov ecx, esi
call fcn.01032716
mov edi, eax
cmp edi, ebx
jl 0x10333e6
test byte [esi + 0xec], 4
je 0x10333a0
lea eax, [ebp - 0xd]
push eax
push dword [ebp - 0x14]
call fcn.010d3c28
mov edi, eax
cmp edi, ebx
jl 0x10333e6
cmp byte [ebp - 0xd], bl
jne 0x10333a0
cmp byte [ebp - 0xe], bl
jne 0x10333a0
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0x170]
call fcn.010e00be
mov edi, eax
cmp edi, ebx
jl 0x10333e6
lea eax, [esi + 0x144]
push eax
push dword [ebp - 0x18]
call fcn.010d594b
mov edi, eax
cmp edi, ebx
jl 0x10333e6
mov eax, dword [esi + 0x144]
cmp eax, ebx
je 0x10333a0
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x10333a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x103338e
test byte [eax + 0x1c], 1
je 0x103338e
cmp byte [eax + 0x19], 2
jb 0x103338e
push edi
push dword [ebp - 0x14]
push dword [esi + 0x144]
push 0x10023f8
push 0x134
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019a40
cmp edi, ebx
jle 0x10333e6
and edi, 0xffff
or edi, 0x80070000
jmp 0x10333e6
cmp dword [esi + 0xe8], 4
push ebx
setne al
movzx eax, al
push ebx
push eax
push dword [ebp - 0x14]
call fcn.010d3ae1
mov edi, eax
cmp edi, ebx
jl 0x10333e6
cmp dword [esi + 0x140], ebx
je 0x10333da
push 0x100374c
push 0x17e5
push 0x1002460
call fcn.0107b4be
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x140], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x18], ebx
je 0x10333f4
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x14], ebx
je 0x1033402
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x28]
call fcn.0102878d
cmp edi, ebx
jge 0x1033452
push edi
push 0x8078014b
lea ecx, [esi + 0xc]
call fcn.0101fc31
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x1033452
test byte [eax + 0x1c], 1
je 0x1033452
cmp byte [eax + 0x19], 2
jb 0x1033452
push dword [esi + 0x14]
push dword [esi + 0x10]
push 0x10023f8
push 0x135
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0109ba57
lea ecx, [ebp - 0x28]
call fcn.01040ced
mov eax, edi
call fcn.0106f737
ret
Function at 0x103a8ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 8]
push eax
push esi
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x103a990
cmp dword [esi], edi
je 0x103a952
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x103aa0e
test byte [eax + 0x1c], 1
je 0x103aa0e
cmp byte [eax + 0x19], 4
jb 0x103aa0e
push dword [ebp + 0xc]
push 0x1003920
push 0x1f8
jmp 0x103a983
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x103aa0e
test byte [eax + 0x1c], 1
je 0x103aa0e
cmp byte [eax + 0x19], 4
jb 0x103aa0e
push dword [ebp + 0xc]
push 0x1003920
push 0x1f9
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019680
jmp 0x103aa0e
cmp eax, 2
jne 0x103a9ca
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x103a9c5
test byte [eax + 0x1c], 1
je 0x103a9c5
cmp byte [eax + 0x19], 3
jb 0x103a9c5
push dword [ebp + 0xc]
push 0x1003920
push 0x1fa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019680
mov dword [ebp - 4], edi
jmp 0x103aa0e
cmp eax, edi
jle 0x103a9d8
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x103aa0e
test byte [eax + 0x1c], 1
je 0x103aa0e
cmp byte [eax + 0x19], 2
jb 0x103aa0e
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x1003920
push 0x1fb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010196ed
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc
Function at 0x105256b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
mov ebx, 0x1001adc
jne 0x1052591
push 0x1001bac
push 0x15bb
push ebx
call fcn.0107b4be
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x10525a8
push 0x1004b10
push 0x15bc
push ebx
call fcn.0107b4be
mov eax, dword [esi]
mov ebx, dword [ebp + 0xc]
and dword [esi], 0
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1052608
cmp dword [ebp - 4], 1
je 0x10525e0
cmp dword [ebp - 4], 2
je 0x10525e0
push 0xd
pop eax
jmp 0x1052608
mov eax, dword [ebp - 8]
test ebx, ebx
je 0x1052602
test eax, eax
je 0x10525fd
test al, 1
jne 0x10525db
mov ecx, eax
shr ecx, 1
cmp word [ebx + ecx*2 - 2], 0
je 0x1052602
jmp 0x10525db
xor ecx, ecx
mov word [ebx], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1053119
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call fcn.010521da
test eax, eax
je 0x1053142
xor eax, eax
inc eax
jmp 0x10531e0
push ebx
push esi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20e]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x10531dc
cmp eax, ebx
je 0x10531dc
push 0x22
pop ecx
mov word [ebp - 0x210], cx
add eax, eax
push 0xf003f
mov word [ebp + eax - 0x20e], cx
push esi
xor ecx, ecx
push esi
mov word [ebp + eax - 0x20c], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
jne 0x10531ed
mov ebx, 0x400
push ebx
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.01052320
test eax, eax
jne 0x10531c9
push 0x1004cc4
lea eax, [ebp - 0xa10]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push eax
call fcn.01015f65
add edi, 0x40
push esi
push edi
lea eax, [ebp - 0xa10]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0106f5f8
leave
ret
push esi
push esi
push 0x1004cb4
push esi
push esi
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x10
push 0xf01ff
add edi, 0x40
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, esi
jne 0x105325a
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x400
push ebx
lea eax, [ebp - 0xa10]
push eax
push 0xd80b
call fcn.01052320
test eax, eax
jne 0x10531cc
push 0x1004c84
lea eax, [ebp - 0xa10]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push eax
call fcn.01015f65
jmp 0x10531cc
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
xor eax, eax
inc eax
jmp 0x10531de