joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002635d
Capabilities:
Start service

Disassembly:
mov eax, 0x1005c92e
call fcn.1005bac8
sub esp, 0x10
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
je 0x1002644f
cmp byte [ebp + 0x10], 0
je 0x10026398
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
jmp 0x10026476
mov dword [ebp + 0x1c], 0x445e
cmp dword [ebp + 0x1c], 0x465a
jle 0x100263eb
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10076b78
or eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc ebx
cmp ebx, 0x66aa
jl 0x100263ac
inc esi
cmp esi, 0x120b
jl 0x100263aa
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x19c9
push 0
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ebx, dword [ebp - 0x14]
and dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0x431b
jge 0x10026429
mov edx, str.clyjopm_ekfbbiwr_gvybixntk
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x10026429
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [ebp + 0xc]
mov ecx, 0xfff9
setl dl
mov eax, dword [eax]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setge cl
mov dword [ebx], ecx
jmp 0x10026476
cmp byte [ebp + 0x18], 0
je 0x1002645f
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10026476
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10026476
push 0
push 0x3d1
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100264ba
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c938
call fcn.1005bac8
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002657e
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
sub ecx, 2
call fcn.100229a3
mov ecx, dword [ebp + 0x14]
cmp ax, word [ecx]
jne 0x100264ef
add dword [esi], 0xfffffffe
mov dword [ebp - 0x18], 0x7312
cmp dword [ebp - 0x18], 0x75ec
jle 0x10026546
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
add eax, ebx
mov ecx, 0x10076b78
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10001c56
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x57d4
jl 0x1002650a
inc ebx
cmp ebx, 0x2432
jl 0x10026505
inc edi
cmp edi, 0xd81
jl 0x10026503
inc esi
cmp esi, 0x6a43
jl 0x10026501
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6f73
jge 0x10026562
mov edx, str.efnpd_cfgffdphy_jupkwl_hswk_tat_lczavhgo
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x1002659b
cmp byte [ecx], 0
je 0x1002659b
push 0x63c
push 0
push 1
mov edx, 0x16f3
mov cl, 1
call fcn.10022cd4
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026799
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x1005c954
call fcn.1005bac8
sub esp, 0xc
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
je 0x10026849
mov dword [ebp - 0x18], 0x14c0
cmp dword [ebp - 0x18], 0x16b3
jle 0x100267f7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076b78
or eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc edi
cmp edi, 0x1eaf
jl 0x100267d4
inc esi
cmp esi, 0x7b0b
jl 0x100267d2
cmp byte [ebx], 0
je 0x10026811
push 0x5d6a
push 0
mov edx, 0x414b
mov cl, 1
call fcn.10024885
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x11b2
jge 0x1002682d
mov edx, str.keeyr_biasw_sumv_kwjis_kfiv_yydsb_gvmot_oeqzk_sipvzcgpi_egopoas_dtcf_xorm
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x1002685a
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002685a
xor cl, cl
call fcn.10023257
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002689f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
je 0x100268c2
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
sub esp, 0x10
push 1
push ecx
push ecx
call fcn.10023755
add esp, 0x20
jmp 0x100268cf
push 0x11c1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x1002efde
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005caf5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002f08f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002f065
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f063
push 0x4641
push 0x2ec2
push 1
push 0x45a9
push 0
push 0x458f
push 0x1829
call fcn.1002eb5a
add esp, 0x1c
jmp 0x1002f08a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1002f08a
push 0xe3d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1002f17d
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f173
mov dword [ebp - 0x1c], 0x6221
mov dword [ebp - 0x44], str.apekr_oasdsqqwf_akln_gkgqqgz
cmp dword [ebp - 0x1c], 0x633f
jle 0x1002f121
and dword [ebp - 0x14], 0
jmp 0x1002f0c7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x42dc
jge 0x1002f121
and dword [ebp - 0x18], 0
jmp 0x1002f0dd
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2597
jge 0x1002f11f
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.10001c36
push eax
call fcn.10043bf4
pop ecx
lea ecx, [ebp - 0x64]
call fcn.10001c2c
jmp 0x1002f0d6
jmp 0x1002f0c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x603f
jge 0x1002f14b
push dword [ebp - 0x44]
call fcn.10043bf4
pop ecx
jmp 0x1002f167
or dword [ebp - 4], 0xffffffff
jmp 0x1002f171
jmp 0x1002f17d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032061
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005cbbc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10032182
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10032178
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x1bd0
mov dword [ebp - 0x2c], str.kfeclbqv_ehvm_vatdzlq
cmp dword [ebp - 0x1c], 0x1f21
jle 0x1003211b
and dword [ebp - 0x14], 0
jmp 0x100320d3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7f75
jge 0x10032113
and dword [ebp - 0x18], 0
jmp 0x100320e9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x312a
jge 0x10032111
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x10076b78
call fcn.10001c56
jmp 0x100320e2
jmp 0x100320cc
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1aa0
jge 0x1003213b
mov edx, dword [ebp - 0x2c]
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x10032157
or dword [ebp - 4], 0xffffffff
jmp 0x10032161
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10032176
push 0
push 1
call fcn.10032306
pop ecx
pop ecx
jmp 0x10032180
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1003219a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
push 0x5faf
push 0
push dword [ebp - 0x34]
call fcn.1002d993
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100390c4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x10039101
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10039110
push 0x558c
push 0x13b6
push 0x5a41
push 0
push 0x4d4e
push 0x4f2
push 0
mov dl, 1
mov ecx, 0x2df2
call fcn.10039395
add esp, 0x1c
pop ebp
ret
push 0xe3d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop ebp
ret

Function at 0x1003919d
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov eax, 0x1005ccdf
call fcn.1005bac8
sub esp, 0x10
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100391d9
push 0
push 0xf44
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x27d5
cmp dword [ebp - 0x18], 0x2af7
jle 0x10039210
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076b78
xor eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc edi
cmp edi, 0x1d78
jl 0x100391ed
inc esi
cmp esi, 0x19eb
jl 0x100391eb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
and dword [ebp - 0x1c], 0
push eax
call fcn.1001f7e7
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x27a3
jge 0x100391c8
mov edx, str.rbpyiekav_cvaur_xbfxby_bbftrosg_kqxjlqua_bxyyomvxx_nzyg_gcjyrwn
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x100391c8

Function at 0x1003927d
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x1005cce9
call fcn.1005bac8
sub esp, 0x14
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003933e
mov dword [ebp - 0x20], 0x7ec5
cmp dword [ebp - 0x20], 0x7f35
jle 0x100392ef
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10076b78
cdq
push edx
push eax
call fcn.10001c56
inc ebx
cmp ebx, 0x5fc3
jl 0x100392bb
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0xf3e
jl 0x100392b2
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1426
jl 0x100392b0
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7b6f
jge 0x1003930f
mov edx, str.xmaxaqudf_vxawixhnd_xraokf_gofyiqoy_zwcxdurfv_mdgcclwj_owwjudeey_bfdr_hwkcez_oqbeh_rbdva_rsf
mov ecx, 0x10076b78
call fcn.10003a53
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x11], 0
je 0x10039357
mov dl, 1
xor cl, cl
call fcn.1003927d
jmp 0x10039357
push 0x1c07
push 0xcf
push 0
push 0x562
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x829400
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
fld xword [eax + 0x527273da]
clc
loop 0x401074
or dword [eax], esi
push esi
pop ebp
invalid
invalid
pop eax
sbb al, 0xc0
mov ebx, dword [ebp + 0x1e3009fd]
invalid
Function at 0x72f370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x72f38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x758074
push ecx
mov edi, eax
call fcn.00743198
mov esi, eax
add esp, 8
test esi, esi
jne 0x72f3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0074302e
push esi
call fcn.00742fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x732850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x7328ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x75d720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7328ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.007431e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x7328ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x75d720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x73292a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00744082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x732957
mov word [eax], si
add eax, 2
push eax
call fcn.00744030
add esp, 4
jmp 0x732959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x7328ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x7328b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x732ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x733080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x7330c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x758458
push ecx
call fcn.007431e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.007431e1
add esp, 0x10
jmp 0x7330d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0074320b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00742dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00733050
mov eax, dword [0x75d728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x73313b
push esi
call fcn.00732fb0
add esp, 4
mov dword [0x75d728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x73314c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00732ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x736440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x7364b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x73648e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x736471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x73647e
add edx, ecx
cmp ebx, edx
jb 0x73648a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x736467
xor ecx, ecx
jmp 0x7364a2
test eax, eax
jne 0x736492
xor ecx, ecx
jmp 0x7364a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.007363c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x7368f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x736921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x736946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x73696e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x736993
push ecx
push esi
call fcn.007364c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x737c00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x737c4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x737c2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x737c38
add edx, eax
cmp ebx, edx
jb 0x737c46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x737c21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x737c50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x737c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x737cb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x737c9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x737ca8
add edx, ecx
cmp ebx, edx
jb 0x737cb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x737c91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x737f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00744145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x737ffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x737fdd
lea eax, [esp + 0x18]
push eax
jmp 0x737fe2
push 0x75d720
call fcn.00743fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x737fb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x737f40
push 4
push ecx
push eax
call fcn.0074443f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x738310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00744145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x7383ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x73838d
lea eax, [esp + 0x18]
push eax
jmp 0x738392
push 0x75d720
call fcn.00743fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x738360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x737f40
push 4
push ecx
push eax
call fcn.0074443f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x739f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0x739fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x739fcf
push ebx
push edi
push 0x75d770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x739fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x75d770
push esi
call ebx
test eax, eax
je 0x739fae
mov ebp, 3
cmp dword [0x75d774], ebp
jne 0x739faa
push 0x3e8
call edi
push 0x75d770
push esi
call ebx
test eax, eax
jne 0x739f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0x739fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0x739fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret