joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c67f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10111e48
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x10156de0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0
mov dword [esp + 0x14], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x100c6833
mov esi, 1
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006f0d2
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
push edi
push esi
mov dword [esp + 0x24], 0
call ebp
test eax, eax
jne 0x100c686c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100c686e
xor eax, eax
mov ecx, dword [esp + 0x28]
push str.boost::filesystem::current_path
push ecx
push eax
call fcn.100c6090
mov esi, dword [esp + 0x30]
add esp, 0xc
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov eax, edi
mov word [esi + 4], dx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100c68a0
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, esi
call fcn.10078d30
push edi
call fcn.100d3041
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x100c7810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10112020
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10156de0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x48]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x100c7847
mov eax, dword [esi]
jmp 0x100c7849
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100c787f
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x44]
push eax
push edi
push esi
call fcn.100c63d0
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
test ebx, 0x400
je 0x100c7960
cmp dword [edi + 0x18], 8
jb 0x100c7893
mov esi, dword [esi]
push esi
lea ecx, [esp + 0x1c]
call fcn.100c11c0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], 0
jae 0x100c78b4
lea eax, [esp + 0x1c]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x48], esi
cmp dword [esp + 0x30], 8
mov byte [esp + 0x3c], 2
jb 0x100c78e9
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.100d30aa
add esp, 4
xor edx, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], dx
cmp esi, 0xffffffff
je 0x100c7857
push edi
call fcn.100c4e40
add esp, 4
test al, al
jne 0x100c7951
push ebx
push edi
call fcn.100c52a0
mov edi, dword [esp + 0x4c]
add esp, 8
push esi
mov dword [edi], 9
mov dword [edi + 4], eax
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push esi
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x100c7976
mov dword [esi], 0
call fcn.100bec70
mov dword [esi + 4], eax
push ebx
push edi
mov dword [esp + 0x18], 3
test bl, 0x10
jne 0x100c798d
mov dword [esp + 0x18], 2
call fcn.100c52a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x4c]
mov ecx, dword [ecx + 4]
add esp, 8
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x100c79c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x18], 8
jb 0x100c79d4
mov eax, dword [esi + 4]
jmp 0x100c79d7
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100c7a00
mov eax, dword [esp + 0x1c]
push eax
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.100c63d0
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x100c7a17
mov dword [edi], 0
call fcn.100bec70
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x100c7a41
push esi
call fcn.100c4e40
add esp, 4
push ebx
push esi
mov dword [esp + 0x10], 4
test al, al
jne 0x100c7a58
mov dword [esp + 0x10], 9
jmp 0x100c7a58
push ebx
push esi
mov dword [esp + 0x10], 3
test bl, 0x10
jne 0x100c7a58
mov dword [esp + 0x10], 2
call fcn.100c52a0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
add esp, 8
pop esi
mov dword [eax + 4], ecx
mov dword [eax], edx
pop ebx
add esp, 8
ret
Function at 0x100c8ff0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x10112328
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x10156de0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa0]
cmp dword [esi + 0x18], 8
jb 0x100c902e
mov eax, dword [esi + 4]
jmp 0x100c9031
lea eax, [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100c905e
mov esi, dword [esp + 0xa4]
test esi, esi
je 0x100c9057
mov dword [esi], 0
call fcn.100bec70
mov dword [esi + 4], eax
mov al, 1
jmp 0x100c90f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.100bec70
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.100c7810
add esp, 0xc
cmp dword [esp + 0x10], 3
jne 0x100c90a0
mov esi, dword [esp + 0xa4]
test esi, esi
je 0x100c90ef
mov dword [esi], 0
call fcn.100bec70
mov dword [esi + 4], eax
jmp 0x100c90ef
mov edi, dword [esp + 0xa4]
test edi, edi
jne 0x100c90e5
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x24]
call fcn.100062e0
mov dword [esp + 0x98], edi
call fcn.100bec70
push eax
push ebx
push esi
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x4c]
call fcn.100afb50
push 0x10142210
lea eax, [esp + 0x40]
push eax
call fcn.100d54dc
call fcn.100bec70
mov dword [edi], ebx
mov dword [edi + 4], eax
xor al, al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x8c
ret

Function at 0x100cac70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x100cac96
mov eax, dword [esp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
cmp dword [esp + 4], 0
jg 0x100caca5
jl 0x100cac81
cmp dword [esp], 0
jbe 0x100cac81
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x10]
push ecx
xor esi, esi
call edi
test eax, eax
jne 0x100cacd1
lea ebx, [ebx]
inc esi
cmp esi, 3
ja 0x100cacf7
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
je 0x100cacc0
fild qword [esp + 0x10]
fmul qword [0x101269a0]
fild qword [esp + 8]
fdivp st(1)
call fcn.100db556
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, ecx
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], 0
mov dword [eax + 4], 0
pop esi
add esp, 0x10
ret
Function at 0x100cf770
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1015682c]
sub esp, 8
push esi
push edi
cmp eax, 0xffffffff
je 0x100cf7de
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100cf7de
lea esi, [eax + 0x14]
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.100cf620
mov edi, dword [esp + 0xc]
mov ebx, dword [esi + 0x18]
mov esi, dword [esi]
test edi, edi
je 0x100cf7b0
cmp edi, esi
je 0x100cf7b5
call fcn.100d2bcd
mov esi, dword [esp + 0x10]
cmp esi, ebx
pop ebx
je 0x100cf7de
test edi, edi
jne 0x100cf7da
call fcn.100d2bcd
cmp esi, dword [edi + 0x18]
jne 0x100cf7d1
call fcn.100d2bcd
pop edi
lea eax, [esi + 0x10]
pop esi
add esp, 8
ret
mov edi, dword [edi]
jmp 0x100cf7c7
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x100d0060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10112e88
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10156de0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x1015682c]
cmp eax, 0xffffffff
jne 0x100d009b
xor ebx, ebx
jmp 0x100d00a4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], 0
test ebx, ebx
je 0x100d00e5
cmp dword [ebx + 0x30], 0
jne 0x100d012c
cmp dword [ebx + 0xc], 0
jne 0x100d0132
push 0x100cad90
push 0x1015bc08
call fcn.100cc5f0
mov eax, dword [0x1015682c]
add esp, 8
cmp eax, 0xffffffff
je 0x100d00e5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test ebx, ebx
je 0x100d0118
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x100d0118
mov edx, dword [ebx]
push eax
mov eax, dword [edx]
mov ecx, ebx
call eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0xc], 0
je 0x100d017a
mov edi, dword [ebx + 0xc]
mov eax, dword [edi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100d0164
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebx + 0xc], 0
jne 0x100d0132
cmp dword [ebx + 0x30], 0
je 0x100d00ba
lea esi, [ebx + 0x14]
mov ecx, dword [esi + 0x18]
mov esi, dword [esi]
mov edi, dword [ecx]
test esi, esi
jne 0x100d0223
call fcn.100d2bcd
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x100d01a7
call fcn.100d2bcd
cmp dword [edi + 0x10], 0
je 0x100d0203
test esi, esi
jne 0x100d022a
call fcn.100d2bcd
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x100d01c2
call fcn.100d2bcd
cmp dword [edi + 0x18], 0
je 0x100d0203
test esi, esi
jne 0x100d022e
call fcn.100d2bcd
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x100d01dd
call fcn.100d2bcd
mov ebp, dword [edi + 0x10]
test esi, esi
jne 0x100d0232
call fcn.100d2bcd
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x100d01f5
call fcn.100d2bcd
mov edx, dword [ebp]
mov eax, dword [edi + 0x18]
mov edx, dword [edx + 4]
push eax
mov ecx, ebp
call edx
push edi
push esi
lea eax, [esp + 0x24]
lea esi, [ebx + 0x14]
push eax
mov ecx, esi
call fcn.100cf810
cmp dword [ebx + 0x30], 0
jne 0x100d0187
jmp 0x100d00b4
mov eax, dword [esi]
jmp 0x100d019d
mov eax, dword [esi]
jmp 0x100d01b8
mov eax, dword [esi]
jmp 0x100d01d3
mov eax, dword [esi]
jmp 0x100d01eb
Function at 0x100d1ca0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10113120
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10156de0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.100d1bf0
mov esi, eax
push 0x100cad90
push 0x1015bc08
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call fcn.100cc5f0
mov eax, dword [0x1015682c]
add esp, 8
cmp eax, 0xffffffff
je 0x100d1d00
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d1d60
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1015682c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x100d1d78
push eax
call esi
test eax, eax
jne 0x100d1da1
call fcn.100d1ca0
mov eax, dword [0x1015682c]
cmp eax, 0xffffffff
jne 0x100d1d9e
xor eax, eax
lea esi, [eax + 0xc]
lea eax, [esp + 8]
push esi
push eax
call fcn.100d0030
add esp, 8
mov dword [esi], eax
pop esi
ret
push eax
call esi
lea esi, [eax + 0xc]
lea eax, [esp + 8]
push esi
push eax
call fcn.100d0030
add esp, 8
mov dword [esi], eax
pop esi
ret
Function at 0x100d21d1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10156de0]
jne 0x100d21db
repz ret
jmp fcn.100db77c

Function at 0x100f060e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100da431
and dword [ebp - 4], 0
cmp dword [0x1015c750], 0
mov ebx, eax
jne 0x100f06bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100f0770
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100f0770
push eax
call fcn.100da3bf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1015c750], eax
call esi
push eax
call fcn.100da3bf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1015c754], eax
call esi
push eax
call fcn.100da3bf
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1015c758], eax
call esi
push eax
call fcn.100da3bf
pop ecx
mov dword [0x1015c760], eax
test eax, eax
je 0x100f06bf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100da3bf
pop ecx
mov dword [0x1015c75c], eax
mov eax, dword [0x1015c75c]
cmp eax, ebx
je 0x100f0717
cmp dword [0x1015c760], ebx
je 0x100f0717
push eax
call fcn.100da43a
push dword [0x1015c760]
mov esi, eax
call fcn.100da43a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100f0717
test edi, edi
je 0x100f0717
call esi
test eax, eax
je 0x100f070e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100f070e
test byte [ebp - 0xc], 1
jne 0x100f0717
or dword [ebp + 0x10], 0x200000
jmp 0x100f0750
mov eax, dword [0x1015c754]
cmp eax, ebx
je 0x100f0750
push eax
call fcn.100da43a
pop ecx
test eax, eax
je 0x100f0750
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100f0750
mov eax, dword [0x1015c758]
cmp eax, ebx
je 0x100f0750
push eax
call fcn.100da43a
pop ecx
test eax, eax
je 0x100f0750
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1015c750]
call fcn.100da43a
pop ecx
test eax, eax
je 0x100f0770
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100f0772
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 1
push eax
test edx, eax
cmp eax, ecx
pop eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4012f4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401336
xor esi, esi
jbe 0x401358
push si
mov si, 0x5c11
pop si
ja 0x401358
jo 0x401306
push cs
invalid
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401370
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 4], 0xffffffff
call dword [0x423614]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 8], ebx
jne 0x4013a0
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x128
rep stosd dword es:[edi], eax
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [0x423618]
test eax, eax
je 0x40143b
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
jle 0x4013ea
push si
mov si, 0xf280
pop si
jg 0x4013ea
lea ecx, [ebp - 0x10c]
push esi
push ecx
call edi
add esp, 8
test eax, eax
je 0x40140f
lea edx, [ebp - 0x130]
push edx
push ebx
call dword [0x42361c]
test eax, eax
je 0x40143b
jmp 0x4013de
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x128]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402020
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push edx
push edi
sub dx, dx
cmp edx, ecx
cmp dx, ax
test edx, 0x4d5b
sub di, 0x50f1
mov di, 0x11cb
and di, ax
pop edi
pop edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x402060
pop edi
pop esi
pop ebp
ret
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
jle 0x402080
push si
mov si, 0xf280
pop si
jg 0x402080
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x402110
Capabilities:
Check os version

Disassembly:
inc ebp
or al, 0x50
push edi
push esi
call fcn.004023c0
add esp, 0x14
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push edi
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push ax
push cx
push edi
and al, dl
or ch, 0x3a
dec edi
inc edi
cmp ah, bl
xor ax, ax
cmp cl, dl
dec cl
pop edi
pop cx
pop ax
cmp dword [ebp - 0x90], 5
jne 0x40215e
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
jle 0x402170
mov ax, ax
mov cx, cx
jg 0x402170
aaa
jecxz 0x4020ec
hlt
cmp dword [ebp - 0x90], 6
jne 0x40218d
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x40218d
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4023c0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x402410
pop esi
pop ebx
pop ebp
ret
push ebx
push esi
push dx
inc dl
xor bl, dl
inc si
cmp dx, 0x676a
xor bx, 0x35f8
cmp esi, 0x222c
pop dx
pop esi
pop ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x402440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ecx, eax
add esp, 8
test ecx, ecx
mov dword [ebp + 0xc], ecx
jne 0x402465
pop edi
pop esi
pop ebx
pop ebp
ret
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
pushal
test cx, ax
inc ax
popal
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
push bx
push edx
push edi
or dh, dh
xor bx, cx
pop edi
pop edx
pop bx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jbe 0x402566
push esi
pop esi
ja 0x402566
pop ebx
hlt
lea eax, [ebp - 4]
lea ecx, [ebp - 0x110]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push 0x419488
push 0x419460
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x402597
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jp 0x4025a1
push cx
mov cl, 0x21
pop cx
jnp 0x4025a1
lea eax, [ebp - 0x110]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4025c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x110]
push edx
mov byte [ecx], 0
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 6
jne 0x4025fb
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
cmp eax, 7
sete cl
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret