joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e71204c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
test dword [0x6107e298], 0xf6d2b837
jno 0x5e712080
test dword [eax], edx
lodsb al, byte [esi]
sal byte [ebp - 0x3f1df848], 0x35
out 0x3c, eax
mov dword [esi], ebx
xlatb
xchg edx, eax
push edx
ljmp 0xccc4
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, word [edx]
movzx ecx, word [esi]
sub ecx, edi
jne 0x5e7120ef
sub esi, edx
test di, di
je 0x5e7120ef
add edx, 2
movzx edi, word [edx]
test byte [0x610631da], 0xa1
jno 0x5e7120e7
jnp 0x5e7120d3
xor ebp, dword [0xc6f2f489]
test dword [edx], edx
sbb byte [edi + 0x2b2aafa3], bl
fistp word [ebx + 0xb]
call 0x68a0dede
loop 0x5e71211d
mov eax, 0x2ed5fcb6
pop edx
les ecx, [eax + 0x4eb15fc]
add ah, cl
and byte [ebx], dh
pop ecx
or dword [esi + 0x20], edx
outsd dx, dword [esi]
insb byte es:[edi], dx
add ch, byte [esi]
jle 0x5e71214c
iretd
movzx ecx, word [esi + edx]
sub ecx, edi
je 0x5e712094
pop edi
pop esi
test ecx, ecx
jns 0x5e7120fc
mov ecx, ecx
or ecx, 0xffffffff
jmp 0x5e712103
jle 0x5e712103
xor ecx, ecx
mov ecx, ecx
inc ecx
mov eax, ecx
nop
nop
pop ebp
ret
leave
and al, 0x10
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
shr ecx, 1
rcr ebx, 1
shr edx, 1
mov ecx, ecx
rcr eax, 1
or ecx, ecx
jne 0x5e712156
mov ecx, ecx
div ebx
nop
nop
nop
mov esi, eax
mul dword [esp + 0x14]
nop
mov ecx, eax
mov ecx, ecx
mov eax, dword [esp + 0x10]
mul esi
add edx, ecx
jb 0x5e71218e
cmp edx, dword [esp + 0xc]
ja 0x5e71218e
jb 0x5e712199
cmp eax, dword [esp + 8]
jbe 0x5e712199
nop
nop
dec esi
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
xor ebx, ebx
Function at 0x5e7153ef
Capabilities:
Encode data using base64
Encrypt data using aes
Reference aes constants

Disassembly:
jmp fcn.5e6c0085
push ebp
mov ebp, esp
nop
nop
sub esp, 0x18
lea ecx, [ebp - 0x18]
push ebx
push edi
test byte [0x61039971], 0xfd
jns 0x5e6d90b5
push dword [ebp + 0xc]
call fcn.5e71464d
nop
nop
mov ebx, dword [ebp + 8]
test byte [0x61037fdd], 0x89
jns 0x5e715445
std
arpl word [ebx - 0x7ce78167], ax
xlatb
xchg edx, eax
push edx
or bh, dh
xchg ch, bl
ljmp 0xce12
mov edi, 0x100
cmp ebx, edi
jae 0x5e7154bd
nop
mov ecx, dword [ebp - 0x18]
push ebx
mov ebx, dword [ecx + 0x74]
sub ebx, 1
pop ebx
jle 0x5e715476
mov eax, eax
lea eax, [ebp - 0x18]
push eax
mov ecx, ecx
push 1
mov eax, dword [ecx + 0x90]
movzx eax, word [eax + ebx*2]
and eax, 1
mov eax, dword [ebp - 0x18]
push ebx
mov ebx, dword [eax + 0x74]
sub ebx, 1
pop ebx
jle 0x5e71553e
mov eax, ebx
nop
lea ecx, [ebp - 0x18]
nop
sar eax, 8
nop
nop
nop
mov dword [ebp + 8], eax
push ecx
movzx eax, al
push eax
test byte [0x61053075], 0x8c
jae 0x5e715515
inc esp
or byte [ebp - 0x24339b8e], ch
and byte [ecx - 0x71], bh
sub al, 0xaa
aam 0xb6
sbb eax, 0xc5636517
xor ch, dh
jle 0x5e71550e
pop ds
test byte [esi + 0x22], dh
add byte [ebp - 0x5a422be3], 0x8f
adc byte [edi], bh
mov word [edx], fs
aas
dec eax
mov ah, 0x53
and esp, dword [ebp + 0x32]
call fcn.5e71ed46
pop ecx
pop ecx
push edx
mov edx, eax
and edx, eax
pop edx
je 0x5e71553e
mov eax, dword [ebp + 8]
nop
nop
push 2
mov ecx, ecx
mov byte [ebp - 4], al
mov byte [ebp - 3], bl
mov eax, eax
mov byte [ebp - 2], 0
mov ecx, ecx
pop ecx
jmp 0x5e715555
mov ecx, ecx
call fcn.5e70dd4f
xor ecx, ecx
inc ecx
mov dword [eax], 0x2a
mov byte [ebp - 4], bl
mov byte [ebp - 3], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
push 1
push dword [eax + 4]
cmp byte [0x610ce443], 0x56
jne 0x5e71558e
invalid
push 3
push edx
push ecx
cmp word [0x6104d2b1], 0xc6b6
jns 0x5e6c033e
lea ecx, [ebp - 4]
push ecx
mov ecx, ecx
push edi
test word [0x610c7c16], 0xc35f
jne 0x5e7155de
into
iretd
push dword [eax + 0xa8]
lea eax, [ebp - 0x18]
push eax
test dword [0x60feb4b1], 0xe5bb11e3
jb 0x5e6ba848
call fcn.5e714bad
add esp, 0x24
test eax, eax
jne 0x5e715620
push ecx
mov cl, byte [ebp - 0xc]
sub cl, al
pop ecx
je 0x5e7154b3
mov eax, eax
mov eax, dword [ebp - 0x10]
push ebx
mov ebx, eax
sub ebx, 1
pop ebx
jne 0x5e71563c
cmp byte [ebp - 0xc], 0
movzx eax, byte [ebp - 8]
je fcn.5e71565e
mov ecx, dword [ebp - 0x10]
and dword [ecx + 0x70], 0xfffffffd
jmp fcn.5e71565e
movzx edx, byte [ebp - 8]
movzx eax, byte [ebp - 7]
shl edx, 8
mov eax, eax
or edx, eax
push ecx
mov cl, byte [ebp - 0xc]
sub cl, 0
pop ecx
je 0x5e71565c
mov ecx, dword [ebp - 0x10]
and dword [ecx + 0x70], 0xfffffffd
mov eax, edx
Function at 0x5e716624
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, eax
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
Function at 0x5e71760f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
nop
nop
nop
mov eax, dword [0x610e8864]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, eax
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.5e716ec7
mov ebx, eax
pop ecx
push ecx
mov ecx, ebx
and ecx, ebx
pop ecx
jne 0x5e71764e
push esi
mov eax, eax
call fcn.5e716fbd
pop ecx
xor eax, eax
nop
nop
jmp 0x5e7178aa
push edi
xor edi, edi
mov ecx, edi
mov eax, edi
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 0x610e8ce8], ebx
je 0x5e7177e4
inc ecx
add eax, 0x30
mov dword [ebp - 0x1c], ecx
cmp eax, 0xf0
jb 0x5e717658
push eax
mov eax, ebx
sub eax, 0xfde8
push 0x101
lea eax, [esi + 0x18]
push edi
push eax
nop
nop
call fcn.5e711c80
add esp, 0xc
imul eax, dword [ebp - 0x1c], 0x30
nop
nop
nop
mov dword [ebp - 0x20], eax
lea eax, [eax + 0x610e8cf8]
mov dword [ebp - 0x1c], eax
cmp byte [eax], 0
mov ecx, eax
je 0x5e717853
mov al, byte [ecx + 1]
push edx
mov dl, al
and dl, al
pop edx
je 0x5e717850
movzx edx, byte [ecx]
movzx eax, al
mov eax, eax
jmp 0x5e717840
cmp edx, 0x100
jae 0x5e717844
mov al, byte [edi + 0x610e8ce0]
or byte [esi + edx + 0x19], al
mov eax, eax
inc edx
movzx eax, byte [ecx + 1]
cmp edx, eax
jbe 0x5e717827
add ecx, 2
push edx
mov dl, byte [ecx]
sub dl, 0
pop edx
jne 0x5e717812
mov eax, dword [ebp - 0x1c]
inc edi
add eax, 8
mov dword [ebp - 0x1c], eax
cmp edi, 4
jb 0x5e71780b
push ebx
mov dword [esi + 4], ebx
nop
mov dword [esi + 8], 1
call fcn.5e716e80
mov eax, eax
add esp, 4
mov dword [esi + 0x21c], eax
mov ecx, ecx
mov eax, dword [ebp - 0x20]
lea ecx, [esi + 0xc]
push 6
lea edx, [eax + 0x610e8cec]
pop edi
mov ax, word [edx]
lea edx, [edx + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
dec edi
jne 0x5e71788c
Function at 0x1002d240
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x1002dec0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100c6014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
cmp edi, 8
mov dword [ebp - 0x50], eax
ja 0x1002def5
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.10093d90
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.1002dfb0
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.1002ddb0
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.1002dfb0
xor eax, eax
push 0x40
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push eax
add esi, 0x28
push esi
call fcn.10093d90
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10090ee8
mov esp, ebp
pop ebp
ret 8

Function at 0x100301bd
Capabilities:
Check if file exists
Create directory

Disassembly:
push 4
mov eax, 0x100a7614
call fcn.100a5688
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1006e86f
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x100301f8
mov edi, 0x800700a1
jmp 0x10030221
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1003021f
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edi, eax
test edi, edi
je 0x1003021f
jle 0x10030221
movzx edi, di
or edi, 0x80070000
jmp 0x10030221
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov eax, edi
call fcn.100a5651
ret 4
Function at 0x10031c62
Capabilities:
Get common file path

Disassembly:
push 0x18
mov eax, 0x100a7ae0
call fcn.100a5688
mov ebx, ecx
mov dword [ebp - 0x14], ebx
and dword [ebp - 4], 0
and dword [ebp - 0x20], 0
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x10]
call fcn.1008e796
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call fcn.1008e9f3
push eax
mov ecx, ebx
call fcn.1008e796
mov esi, dword [ebp - 0x10]
mov ecx, 0x104
mov dword [ebp - 0x20], edi
mov eax, dword [esi - 8]
sub edi, dword [esi - 4]
sub eax, ecx
or eax, edi
jge 0x10031cbf
push ecx
lea ecx, [ebp - 0x10]
call fcn.1008e652
mov esi, dword [ebp - 0x10]
push esi
xor eax, eax
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10031d57
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1008e388
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x18]
call fcn.1008e796
push 0x100085ec
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.1006e93f
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x104
lea ecx, [ebx - 0x10]
call fcn.1008eb5d
lea edi, [eax + 0x10]
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 3
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
call fcn.1008e6a9
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.msi.dll_MsiMessageBoxW]
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 2
call fcn.1008ebf5
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
call fcn.1008e388
lea ecx, [ebx - 0x10]
call fcn.1008ebf5
mov ebx, dword [ebp - 0x14]
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov eax, ebx
call fcn.100a5651
ret
Function at 0x10032306
Capabilities:
Get file version info

Disassembly:
push 0x18
mov eax, 0x100a7beb
call fcn.100a5688
mov eax, ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x1000893c
mov dword [ebp - 0x1c], ebx
call fcn.1006f4e2
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
mov dword [ebp - 0x1c], edi
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x10]
call fcn.1008e796
mov dword [ebp - 4], edi
mov ecx, 0x105
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 8]
sub edi, dword [esi - 4]
sub eax, ecx
or edi, eax
jge 0x10032363
push ecx
lea ecx, [ebp - 0x10]
call fcn.1008e652
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1008e388
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x100323f7
push ebx
call fcn.1009170d
pop ecx
mov edi, eax
push edi
push ebx
push dword [ebp - 0x18]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100323eb
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x10021634
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x100323ee
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push 0x1000894c
push ebx
call fcn.1008e3f3
add esp, 0x18
jmp 0x100323ee
mov ebx, dword [ebp - 0x14]
push edi
call fcn.10091716
pop ecx
jmp 0x100323fa
mov ebx, dword [ebp - 0x14]
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov eax, ebx
call fcn.100a5651
ret

Function at 0x1003240a
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100c6014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
xor esi, esi
push eax
push 0x20019
push esi
mov edi, 0x10008968
mov dword [ebp - 0x210], esi
push edi
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100324ba
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100324ba
lea ecx, [ebp - 0x20c]
call fcn.100324d7
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 2
push esi
push 0x100089e8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 7
push eax
push 4
push esi
push 0x10008a0c
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10090ee8
mov esp, ebp
pop ebp
ret
Function at 0x100324d7
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x100a7c16
call fcn.100a5688
mov edi, ecx
xor esi, esi
mov ebx, 0x80004005
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
test edi, edi
je 0x100325f9
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push 0x10008a30
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10032561
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x208
push eax
push edi
push esi
push esi
push 0x10008aa0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1003255f
xor eax, eax
push edi
mov word [edi + 0x206], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003255f
xor ebx, ebx
jmp 0x100325f9
xor esi, esi
push edi
push esi
push esi
push 0x2b
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10032598
push 0x10008ab0
push 0x104
push edi
call fcn.100980c3
add esp, 0xc
test eax, eax
jne 0x10032598
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10032598
mov ebx, esi
jmp 0x100325f9
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x18]
call fcn.1008e796
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.10030831
push 0x10008aec
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
push dword [eax]
call fcn.1006e93f
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x18]
push esi
push 0x104
push edi
call fcn.10098138
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
lea ecx, [esi - 0x10]
neg eax
sbb eax, eax
not eax
and ebx, eax
call fcn.1008ebf5
mov eax, ebx
call fcn.100a5651
ret

Function at 0x10032e04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x100c6014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x418]
mov esi, 0x100
push eax
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x10032e3c
call fcn.1008e258
jmp 0x10032ed0
cmp eax, esi
jbe 0x10032e4a
mov eax, 0x80020013
jmp 0x10032ed0
lea eax, [ebp - 0x210]
push eax
push 0
push 0x10008c24
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10032e32
xor eax, eax
lea esi, [edi + 8]
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
push 0x101
push esi
call fcn.10098269
add esp, 0x10
mov ecx, eax
call fcn.1008e222
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x424]
mov ecx, 0x40000000
mov dword [ebp - 0x424], 0xc
push ecx
push eax
push 0x2100
push 2
push 0
push ecx
mov dword [edi + 0x20c], ecx
mov ecx, edi
push esi
mov dword [ebp - 0x41c], 1
call fcn.10032ce5
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10090ee8
mov esp, ebp
pop ebp
ret 8
Function at 0x10037543
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x100a8953
call fcn.100a5688
mov edi, ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1008eb5d
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 4
push ecx
push 1
add eax, 0x10
xor ebx, ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100375b5
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100375b5
mov bl, 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.1008ebf5
mov al, bl
call fcn.100a5651
ret 8
Function at 0x10045169
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x100ab525
call fcn.100a5688
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 0xc], edi
jle 0x100452d5
lea eax, [ebx + 4]
push edi
mov ecx, eax
call fcn.1006bd69
push 0
push 0x100c9500
push 0x100c9520
push 0
push dword [eax]
call fcn.100a698d
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x100452c8
cmp byte [ebp + 0x10], 0
je 0x1004522f
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008e796
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.10042880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.1006e93f
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10045220
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
add ecx, 8
call fcn.1006f350
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
jmp 0x100452c3
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.1008ebf5
mov esi, dword [ebp - 0x1c]
push edi
lea ecx, [ebx + 4]
call fcn.1006bd69
push 0
push 0x100c9540
push 0x100c9520
push 0
push dword [eax]
call fcn.100a698d
add esp, 0x14
mov byte [ebp - 0xd], 0
test eax, eax
je 0x10045265
cmp dword [eax + 0x134], 5
jne 0x10045265
mov byte [ebp - 0xd], 1
call fcn.1008e9f3
push eax
lea ecx, [ebp - 0x18]
call fcn.1008e796
cmp byte [ebp - 0xd], 0
mov dword [ebp - 4], 2
jne 0x100452b9
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.1004289c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.1006e93f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 8]
call fcn.1006f350
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
inc edi
lea eax, [ebx + 4]
cmp edi, dword [ebx + 0xc]
jl 0x10045185
call fcn.100a5651
ret 0xc
Function at 0x10050944
Capabilities:
Enumerate services

Disassembly:
push 0x34
mov eax, 0x100addbe
call fcn.100a5688
mov dword [ebp - 0x20], edx
mov eax, ecx
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
call fcn.1006b7e9
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
jne 0x1005099c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov ecx, dword [ebp - 0x20]
push 0x1000ff04
push 5
pop edx
call fcn.1003211a
jmp 0x10050b0d
xor ecx, ecx
lea eax, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ecx
push 1
push 0x30
push ecx
jmp 0x100509f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xea
jne 0x10050a03
xor edi, edi
test esi, esi
je 0x100509d3
push esi
call fcn.10091716
pop ecx
push dword [ebp - 0x10]
call fcn.1009170d
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push esi
push 1
push 0x30
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x100509b6
jmp 0x10050a1d
push edi
push ecx
mov ecx, dword [ebp - 0x20]
push 0x1000ff20
push 5
pop edx
call fcn.1003211a
test edi, edi
jne 0x10050af9
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x14], 0
jbe 0x10050af9
mov ebx, esi
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.1006b7bc
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x10050a8c
push dword [ebx]
lea ecx, [ebp - 0x20]
call fcn.1006f4e2
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
test eax, eax
js 0x10050b13
mov edx, dword [ebp - 0x18]
cmp eax, dword [edx + 8]
jge 0x10050b13
imul ecx, eax, 0xc
lea eax, [ebp - 0x20]
push eax
add ecx, dword [edx + 4]
call fcn.1006e65f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
jmp 0x10050ae3
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24]
push dword [ebx]
call fcn.1006f4e2
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x40]
call fcn.1006e65f
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008ebf5
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1006b833
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1007993a
mov eax, dword [ebp - 0x2c]
add ebx, 0x2c
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebp - 0x14]
jb 0x10050a2d
mov ebx, dword [ebp - 0x34]
test esi, esi
je 0x10050b04
push esi
call fcn.10091716
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
call fcn.100a5651
ret
call fcn.1008cd60
int3