joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003970
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046894
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], 0
lea eax, [ebp - 0x98]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100039c6
xor al, al
jmp 0x10003b23
push str.SeTcbPrivilege
lea ecx, [ebp - 0x8c]
call fcn.10004c50
mov dword [ebp - 4], 0
push str.SeLoadDriverPrivilege
lea ecx, [ebp - 0x74]
call fcn.10004c50
mov byte [ebp - 4], 1
push str.SeDebugPrivilege
lea ecx, [ebp - 0x5c]
call fcn.10004c50
mov byte [ebp - 4], 2
push str.SeBackupPrivilege
lea ecx, [ebp - 0x44]
call fcn.10004c50
mov byte [ebp - 4], 3
push str.SeRestorePrivilege
lea ecx, [ebp - 0x2c]
call fcn.10004c50
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x8e]
call fcn.100043d0
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x8c]
push edx
lea ecx, [ebp - 0xb8]
call fcn.100024d0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0xb0]
call fcn.10004390
mov byte [ebp - 4], 6
push fcn.10004b10
push 5
push 0x18
lea eax, [ebp - 0x8c]
push eax
call fcn.10028b52
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x9c], ecx
lea edx, [ebp - 0x94]
push edx
mov ecx, dword [ebp - 0x9c]
call fcn.100042f0
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x9c]
call fcn.10004290
jmp 0x10003aae
lea ecx, [ebp - 0x94]
call fcn.10004250
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x94]
call fcn.10004210
movzx edx, al
test edx, edx
je 0x10003af7
lea ecx, [ebp - 0x94]
call fcn.10004270
mov dword [ebp - 0xa4], eax
push 1
mov ecx, dword [ebp - 0xa4]
call fcn.10004a50
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.100038d0
add esp, 0xc
jmp 0x10003aa3
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x8d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10004350
mov al, byte [ebp - 0x8d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret
Function at 0x10003fc0
Capabilities:
Create process on windows
Create process suspended
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x574
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003970
mov byte [ebp - 0x104], 0
push 0xff
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.1002bb10
add esp, 0xc
mov dword [ebp - 0x514], 0x100
lea ecx, [ebp - 0x514]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push str.system
lea eax, [ebp - 0x104]
push eax
call fcn.100367a8
add esp, 8
test eax, eax
jne 0x1000403d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.SetupAssist.dll_int___stdcall_CreateProcessAsConsoleSession_wchar_t_const___wchar_t_const__
jmp 0x100041f6
xor eax, eax
mov word [ebp - 0x508], ax
push 0x400
push 0
lea ecx, [ebp - 0x506]
push ecx
call fcn.1002bb10
add esp, 0xc
push 0x1005580c
lea edx, [ebp - 0x508]
push edx
call fcn.10007580
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x508]
push ecx
call fcn.100075a0
add esp, 8
push 0x10055810
lea edx, [ebp - 0x508]
push edx
call fcn.100075a0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x10004113
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
add ecx, 2
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x50c]
mov ax, word [edx]
mov word [ebp - 0x50e], ax
add dword [ebp - 0x50c], 2
cmp word [ebp - 0x50e], 0
jne 0x100040b5
mov ecx, dword [ebp - 0x50c]
sub ecx, dword [ebp - 0x518]
sar ecx, 1
mov dword [ebp - 0x51c], ecx
je 0x10004113
push 0x10055814
lea edx, [ebp - 0x508]
push edx
call fcn.100075a0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x508]
push ecx
call fcn.100075a0
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x574]
push edx
call fcn.1002bb10
add esp, 0xc
mov dword [ebp - 0x574], 0x44
mov dword [ebp - 0x520], 0x20
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x574]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x520]
push edx
push 0
push 0
push 0
mov eax, 2
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x508]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100041ae
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055840
push 0x10055818
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
xor eax, eax
jmp 0x100041f6
mov eax, dword [ebp - 0x52c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x530]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10007490
mov edx, dword [ebp - 0x528]
push edx
push str.Create_child_process__id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b6b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
je 0x1000b6dc
jmp 0x1000b87c
mov byte [ebp - 0x10c], 0
push 0x104
push 0
lea ecx, [ebp - 0x10b]
push ecx
call fcn.1002bb10
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x114]
mov al, byte [edx]
mov byte [ebp - 0x10d], al
add dword [ebp - 0x114], 1
cmp byte [ebp - 0x10d], 0
jne 0x1000b726
mov ecx, dword [ebp - 0x114]
sub ecx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], ecx
je 0x1000b7f7
lea edx, [ebp - 0x10c]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x118]
mov dl, byte [ecx]
mov byte [ebp - 0x10e], dl
add dword [ebp - 0x118], 1
cmp byte [ebp - 0x10e], 0
jne 0x1000b777
mov eax, dword [ebp - 0x118]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
movsx edx, byte [ebp + ecx - 0x10d]
cmp edx, 0x5c
je 0x1000b7f7
lea eax, [ebp - 0x10c]
add eax, 0xffffffff
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x10f], dl
add dword [ebp - 0x11c], 1
cmp byte [ebp - 0x10f], 0
jne 0x1000b7c9
mov edi, dword [ebp - 0x11c]
mov ax, word [0x10055868]
mov word [edi], ax
lea ecx, [ebp - 0x10c]
add ecx, 0xffffffff
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
mov al, byte [edx + 1]
mov byte [ebp - 0x110], al
add dword [ebp - 0x120], 1
cmp byte [ebp - 0x110], 0
jne 0x1000b806
mov edi, dword [ebp - 0x120]
mov ecx, 5
mov esi, str.EndpointInstaller2.log
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, 0x1005dfb8
call fcn.1000b510
mov ecx, 0x1005dfb8
call fcn.1000b4d0
push 1
mov ecx, 0x1005dfb8
call fcn.1000b4f0
push 0x10007490
push str.______________________________
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10003100
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000dab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046f28
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x1000daf0
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000dafc
mov al, 1
jmp 0x1000dc9f
mov dword [ebp - 0x48], 8
call fcn.10001710
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10001710
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.100016e0
add esp, 8
movzx eax, al
test eax, eax
je 0x1000db3f
xor al, al
jmp 0x1000dc9f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10004be0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x28]
call fcn.1000d960
mov ecx, eax
call fcn.10004270
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.10005620
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000d960
mov ecx, eax
call fcn.10004270
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.1000e460
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1000dbba
cmp dword [ebp - 0x38], 1
je 0x1000dbc1
cmp dword [ebp - 0x38], 3
je 0x1000dc5b
jmp 0x1000dc73
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000d960
mov ecx, eax
call fcn.10004270
mov edx, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x1000dc24
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000d960
mov ecx, eax
call fcn.10004270
push eax
call fcn.100318e8
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1000dc24
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b10
mov al, byte [ebp - 0x2d]
jmp 0x1000dc9f
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000dc47
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b10
mov al, byte [ebp - 0x2e]
jmp 0x1000dc9f
cmp dword [ebp - 0x34], 0
jne 0x1000dc59
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10005880
jmp 0x1000dc8b
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b10
mov al, byte [ebp - 0x2f]
jmp 0x1000dc9f
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b10
mov al, byte [ebp - 0x30]
jmp 0x1000dc9f
jmp 0x1000db52
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret
Function at 0x1000f350
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0x100138f0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.setEnvVar:
push 0x1005d250
call fcn.100135c0
add esp, 8
push eax
call fcn.100135c0
add esp, 8
push eax
call fcn.100135c0
add esp, 8
mov ecx, eax
call fcn.10004da0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ebp
ret 8

Function at 0x1000f4b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100470d3
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.extractSetupCustomInfoEx_Enter.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x9c], 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.10004990
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x90]
call fcn.1000f190
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.10004940
lea ecx, [ebp - 0x90]
call fcn.10014ad0
movzx ecx, al
test ecx, ecx
je 0x1000f5db
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x90]
call fcn.100154f0
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.10004990
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x90]
call fcn.10015390
mov byte [ebp - 0x91], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.10004940
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1000f5cf
lea ecx, [ebp - 0x90]
call fcn.100151e0
movzx ecx, al
test ecx, ecx
je 0x1000f5b9
mov dword [ebp - 0x98], 1
jmp 0x1000f5c3
mov dword [ebp - 0x98], 0
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.10004b10
push str.extractSetupCustomInfoEx_Leave.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.1000f220
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret 8
Function at 0x10014dc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], 0
xor eax, eax
mov word [ebp - 0x808], ax
push 0x800
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.1002bb10
add esp, 0xc
push 0x400
lea edx, [ebp - 0x808]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10004900
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10014e68
push 0x10007490
mov ecx, dword [ebp + 0xc]
call fcn.10004900
push eax
push str._error__expand_env_failed__name_:
mov ecx, 0x1005dfb8
call fcn.10014280
mov ecx, eax
call fcn.10014280
mov ecx, eax
call fcn.10003100
mov ecx, dword [ebp + 8]
call fcn.10015e40
mov eax, dword [ebp - 0x80c]
or eax, 1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 8]
jmp 0x10014e89
lea ecx, [ebp - 0x808]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10004990
mov edx, dword [ebp - 0x80c]
or edx, 1
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret 8

Function at 0x10014ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.10004900
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10014ee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x50
je 0x10014edd
cmp dword [ebp - 8], 0xb7
jne 0x10014ee4
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10014f19
push 0x10007490
mov ecx, dword [ebp + 8]
call fcn.10004900
push eax
push str._error__failed_to_create_directory__name_:
mov ecx, 0x1005dfb8
call fcn.10014280
mov ecx, eax
call fcn.10014280
mov ecx, eax
call fcn.10003100
xor al, al
jmp 0x10014f1b
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c9f0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001ca3e
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055dd8
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
xor al, al
jmp 0x1001cb4d
push 0x10000
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001caab
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055e1c
mov edx, dword [ebp + 8]
push edx
push 0x10055dfc
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1001cb4d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1001cb00
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055e4c
mov edx, dword [ebp + 8]
push edx
push str.Failed_to_DeleteService__Name_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
jmp 0x1001cb26
push 0x10007490
mov eax, dword [ebp + 8]
push eax
push str.Delete_Service
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10003100
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x10], 0
je 0x1001cb46
mov byte [ebp - 1], 1
jmp 0x1001cb4a
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x1001df50
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047b08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001df8b
jmp 0x1001e014
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1001df9b
jmp 0x1001e014
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.10004990
mov dword [ebp - 4], 0
push str..old
lea ecx, [ebp - 0x28]
call fcn.1001f8c0
lea ecx, [ebp - 0x28]
call fcn.10004900
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1001dfea
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004940
mov al, byte [ebp - 0x29]
jmp 0x1001e016
push 4
push 0
lea ecx, [ebp - 0x28]
call fcn.10004900
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004940
xor ecx, ecx
jne 0x1001df78
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret
Function at 0x10026eea
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x10048057
call fcn.100295b8
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10027007
cmp byte [ebx + 0x3e], 0
je 0x10027007
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.10029558
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x10026f36
xor al, al
jmp 0x10027009
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.100056d0
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10026f66
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.10029558
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x10026f9b
sub eax, 1
je 0x10026f9f
dec eax
sub eax, 1
je 0x10026ff5
xor bl, bl
jmp 0x10026ff7
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x10026faf
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x10026fd7
cmp eax, 0x10
jae 0x10026fbe
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.100318e8
add esp, 0x10
cmp esi, eax
jne 0x10026f97
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x10026ff5
test esi, esi
jne 0x10026f5a
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10005880
jmp 0x10026f54
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10005510
mov al, bl
jmp 0x10027009
mov al, 1
call fcn.10029573
ret
Function at 0x10027517
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x100480ac
call fcn.100295b8
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x1002753c
xor eax, eax
jmp 0x100276b5
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10027568
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10027568
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x100276b5
cmp dword [esi + 0x4c], 0
je 0x100276b2
mov ecx, esi
call fcn.10027137
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x1002759b
push dword [esi + 0x4c]
push edi
call fcn.10026ac0
pop ecx
pop ecx
test al, al
je 0x100276b2
movzx ebx, di
jmp 0x100276b2
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.100056d0
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x100275d3
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.10029558
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x100276a6
cmp eax, 1
jg 0x10027681
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x1002761c
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x10027649
cmp eax, 0x10
jae 0x1002762b
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.100318e8
add esp, 0x10
cmp edi, eax
jne 0x1002767c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x1002764c
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x10027676
test edi, edi
jne 0x100275c7
cmp dword [ebp - 0x18], 0x20
jae 0x100276a0
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.10005880
jmp 0x100275c1
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x100276a0
cmp eax, 3
jne 0x100276a6
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.10026ac0
pop ecx
pop ecx
test al, al
je 0x100276a0
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10005510
mov ax, bx
call fcn.10029573
ret 4

Function at 0x1003b258
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003af1b

Function at 0x1003b263
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003b09c

Function at 0x1004286b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004252b