joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028ddc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10028e0a
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002aaf3
pop ecx
pop ecx
jmp 0x10028e4c
mov edi, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x10028e43
mov eax, dword [ebp - 4]
cmp eax, 0xc000003e
jne 0x10028e4b
push edi
push esi
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
pop esi
pop edi
test eax, eax
jge 0x10028e5b
mov dword [0x1005f278], 0x10
leave
ret

Function at 0x10028e5d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor eax, eax
and dword [ebp - 8], eax
push 6
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10028e99
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002ab74
add esp, 0x18
jmp 0x10028eff
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
push 0x13
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x10028eeb
mov eax, dword [ebp - 4]
cmp eax, 0xc000003e
jne 0x10028efd
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
pop esi
pop ebx
pop edi
test eax, eax
jge 0x10028f0e
mov dword [0x1005f278], 0x13
leave
ret
Function at 0x10028f10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor eax, eax
and dword [ebp - 8], eax
push 6
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10028f4c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002ac1e
add esp, 0x18
jmp 0x10028fb2
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
push 0xf
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x10028f9e
mov eax, dword [ebp - 4]
cmp eax, 0xc000003e
jne 0x10028fb0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
pop esi
pop ebx
pop edi
test eax, eax
jge 0x10028fc1
mov dword [0x1005f278], 0xf
leave
ret

Function at 0x10028fc3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor eax, eax
and dword [ebp - 8], eax
push 6
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10028fff
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002acc4
add esp, 0x18
jmp 0x10029065
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
push 0xd
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x10029051
mov eax, dword [ebp - 4]
cmp eax, 0xc000003e
jne 0x10029063
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
pop esi
pop ebx
pop edi
test eax, eax
jge 0x10029074
mov dword [0x1005f278], 0xd
leave
ret
Function at 0x10029076
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor eax, eax
and dword [ebp - 8], eax
push 6
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x100290b2
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002ad51
add esp, 0x18
jmp 0x10029118
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
push 0xe
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x10029104
mov eax, dword [ebp - 4]
cmp eax, 0xc000003e
jne 0x10029116
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
pop esi
pop ebx
pop edi
test eax, eax
jge 0x10029127
mov dword [0x1005f278], 0xe
leave
ret

Function at 0x10029328
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor eax, eax
and dword [ebp - 8], eax
push 9
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10029386
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002b058
add esp, 0x24
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jge 0x10029381
mov dword [0x1005f278], 6
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 6
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
jne 0x10029370
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ntdll.dll_NtReadFile]
jmp 0x10029381
Function at 0x100293fb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor eax, eax
and dword [ebp - 8], eax
push 9
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10029459
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002b13d
add esp, 0x24
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jge 0x10029454
mov dword [0x1005f278], 7
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 7
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
jne 0x10029443
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtWriteFile]
jmp 0x10029454

Function at 0x100294ce
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
push 4
stosd dword es:[edi], eax
pop edi
cmp dword [0x1005f274], eax
je 0x100294fc
push dword [ebp + 8]
call fcn.1002b222
pop ecx
jmp 0x1002954e
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push edi
add esi, 8
mov dword [ebp - 0x10], ecx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x1002953a
mov eax, dword [ebp - 4]
cmp eax, 0xc0000368
jne 0x1002954e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10029549
xor eax, eax
jmp 0x10029558
mov eax, 0xc0000001
test eax, eax
jge 0x10029558
mov dword [0x1005f278], edi
pop edi
pop esi
leave
ret
Function at 0x1002955c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x10029597
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002b295
add esp, 0x14
jmp 0x100295ef
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x14
lea eax, [ebp - 0x1c]
push eax
push 8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
jne 0x100295ea
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
jmp 0x100295ed
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
test eax, eax
jge 0x100295fe
mov dword [0x1005f278], 8
leave
ret

Function at 0x10029600
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
cmp dword [0x1005f274], eax
je 0x1002963b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002b33c
add esp, 0x14
jmp 0x10029693
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x14
lea eax, [ebp - 0x1c]
push eax
push 9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
jne 0x1002968e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
jmp 0x10029691
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
test eax, eax
jge 0x100296a2
mov dword [0x1005f278], 9
leave
ret
Function at 0x100296a4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
push 0x2c
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.10035680
xor eax, eax
add esp, 0xc
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov dword [ebp - 8], esi
cmp dword [0x1005f274], esi
je 0x100296fc
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002b3e3
add esp, 0x2c
jmp 0x10029788
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x28]
mov byte [ebp - 0x14], al
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov al, byte [ebp + 0x30]
push ebx
mov ebx, dword [ebp + 0x10]
mov byte [ebp - 0xc], al
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x2c
lea eax, [ebp - 0x34]
push eax
push 0xa
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
jne 0x10029784
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
jmp 0x10029787
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
test eax, eax
jge 0x10029798
mov dword [0x1005f278], 0xa
leave
ret

Function at 0x10029924
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
push 5
stosd dword es:[edi], eax
pop edi
cmp dword [0x1005f274], eax
je 0x10029952
push dword [ebp + 8]
call fcn.1002b632
pop ecx
jmp 0x100299a5
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push edi
add esi, 8
mov dword [ebp - 0x10], ecx
call fcn.1001fc6b
mov ecx, eax
call fcn.10022df0
test al, al
je 0x10029991
mov eax, dword [ebp - 4]
cmp eax, 0xc0000368
jne 0x100299a5
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x100299a0
xor eax, eax
jmp 0x100299af
mov eax, 0xc0000001
test eax, eax
jge 0x100299af
mov dword [0x1005f278], edi
pop edi
pop esi
leave
ret
Function at 0x10029bf7
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 0xf003f
push 0
push 0
mov byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x10029c61
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x10029c25
mov eax, dword [eax + 4]
jmp 0x10029c28
add eax, 4
push esi
push edi
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x10029c5c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10029c59
cmp dword [ebp - 0x1c], 4
jne 0x10029c59
mov byte [ebp - 1], 1
push esi
call edi
push ebx
call edi
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x10029c67
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.10029bab
pop ecx
test al, al
je 0x10029c7f
xor al, al
jmp 0x10029c99
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x10029c9c
xor al, al
pop edi
pop esi
leave
ret
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 8
jb 0x10029caa
mov eax, dword [eax + 4]
jmp 0x10029cad
add eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
push ebx
jb 0x10029cbf
mov ebx, dword [eax + 4]
jmp 0x10029cc2
lea ebx, [eax + 4]
mov edx, dword [esi + 0x18]
lea eax, [esi + 4]
cmp edx, 8
jb 0x10029cd1
mov ecx, dword [eax]
jmp 0x10029cd3
mov ecx, eax
cmp edx, 8
jb 0x10029cda
mov eax, dword [eax]
push edi
push edi
push 0x1005450c
push edi
push dword [ebp - 4]
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp eax, edi
jne 0x10029d13
xor bl, bl
push dword [ebp - 8]
call esi
mov al, bl
pop ebx
jmp 0x10029c98
push eax
call esi
mov bl, 1
jmp 0x10029d09
Function at 0x10029e37
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 6
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
push esi
rep stosd dword es:[edi], eax
call fcn.10029bab
pop ecx
test al, al
jne 0x10029e61
inc al
jmp 0x10029ecd
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10029ec8
cmp dword [esi + 0x18], 8
jb 0x10029e80
mov eax, dword [esi + 4]
jmp 0x10029e83
lea eax, [esi + 4]
push 0x24
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x10029ec3
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x10029ebd
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, eax
jmp 0x10029ec0
xor ebx, ebx
inc ebx
push esi
call edi
push dword [ebp - 4]
call edi
test ebx, ebx
setne al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10029ed2
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
xor ebx, ebx
call fcn.10029bab
pop ecx
test al, al
je 0x10029f70
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10029f6e
cmp dword [esi + 0x18], 8
jb 0x10029f0b
mov esi, dword [esi + 4]
jmp 0x10029f0e
add esi, 4
push edi
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x10029f68
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 8
jb 0x10029f36
mov ecx, dword [eax + 4]
jmp 0x10029f39
lea ecx, [eax + 4]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
jb 0x10029f47
mov eax, dword [eax + 4]
jmp 0x10029f4a
add eax, 4
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
push 1
push dword [ebp + 0x14]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x10029f65
mov bl, 1
push esi
call edi
push dword [ebp - 4]
call edi
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x1002a779
Capabilities:
Get file size

Disassembly:
push 0x1c
push 0x10056448
call fcn.10036378
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 0x20
push esi
mov edi, 0x80
push edi
push 3
push esi
push 7
push 0xa0000000
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
call ebx
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x1002a7ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1002a7e5
push esi
push edi
push 3
push esi
push 7
push 0x80000000
push dword [ebp + 8]
call ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], 0xffffffff
je 0x1002a8db
cmp dword [ebp - 0x20], 1
jne 0x1002a7fa
push 2
pop eax
jmp 0x1002a7fd
mov eax, dword [ebp - 0x24]
push esi
push esi
push esi
or eax, 0x1000000
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x1002a825
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002a8db
push esi
push esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp ebx, esi
jne 0x1002a84f
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
jmp 0x1002a8db
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], esi
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.1002a605
pop ecx
pop ecx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x34]
cmp ebx, ecx
je 0x1002a8a1
cmp eax, esi
je 0x1002a8a1
push dword [ebp - 0x24]
push eax
push ecx
push ebx
push ebx
call fcn.1002a70a
add esp, 0x14
cmp eax, esi
jge 0x1002a8a1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
jmp 0x1002a8cc
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, ebx
jmp 0x1002a8dd
call fcn.1002a75a
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.100363bd
ret