joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11be2c60
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x11be2ca3
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
not eax
and eax, ecx
mov dword [esp + 8], eax
jmp 0x11be2cab
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
push ebp
push esi
test eax, eax
push edi
je 0x11be2dbb
mov esi, dword [esp + 0x20]
xor edi, edi
mov ebp, 2
mov eax, dword [esi + 4]
test eax, eax
jle 0x11be2cef
lea ecx, [esp + 0x1c]
push edi
push ecx
mov ecx, esi
call fcn.11be2dd0
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
mov eax, dword [edx - 8]
lea ebp, [ebp + eax*2 + 2]
call fcn.11be1970
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jl 0x11be2cc8
push ebp
call fcn.11be3194
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x1c], edx
je 0x11be2dbb
mov ecx, ebp
push ebx
mov ebx, ecx
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
xor ebx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 4]
mov edi, edx
test eax, eax
jle 0x11be2d61
lea ecx, [esp + 0x24]
push ebx
push ecx
mov ecx, esi
call fcn.11be2dd0
mov edx, dword [eax]
push edx
push edi
call fcn.11be3241
add esp, 8
lea ecx, [esp + 0x24]
call fcn.11be1970
push edi
call fcn.11be31f9
add esp, 4
lea edi, [edi + eax*2 + 2]
mov eax, dword [esi + 4]
inc ebx
cmp ebx, eax
jl 0x11be2d26
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push ebp
push edx
push 7
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop ebx
jne 0x11be2d9f
cmp esi, dword [esp + 0x10]
je 0x11be2d89
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.11be304f
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.11be304f
mov eax, dword [esp + 0x14]
add esp, 4
cmp esi, eax
je 0x11be2dbb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x11be2e40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x11be2fbd
mov eax, dword [esp + 0x10]
test eax, eax
je 0x11be2f9c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x11be2e96
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.11be3194
mov esi, eax
add esp, 4
test esi, esi
je 0x11be2fbd
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x11be2fb4
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11be2fb4
mov edi, dword [esp + 0x20]
test edi, edi
je 0x11be2fb4
push ebp
push edi
call fcn.11be2e40
add esp, 8
test eax, eax
je 0x11be2fa9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x11c052d0]
test eax, eax
je 0x11be2f45
test ebp, ebp
je 0x11be2f45
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x11be2fb4
jmp 0x11be2f51
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x11be2fb4
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x11be2f93
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x11be2fb4
mov eax, dword [esp + 0x14]
jmp 0x11be2eee
push esi
call fcn.11be304f
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x11be2fb4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.11be304f
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x11be2fd0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
test esi, esi
je 0x11be3039
mov eax, dword [esp + 0xc]
test eax, eax
je 0x11be2ff9
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x11be3039
pop edi
mov eax, 1
pop esi
ret 4
push edi
push esi
call fcn.11be2e40
add esp, 8
test eax, eax
je 0x11be3039
mov eax, dword [0x11c052d0]
test eax, eax
je 0x11be3026
test edi, edi
je 0x11be3026
push 0
push edi
push 0
push esi
call eax
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x11be3040
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x11c020e0]
jne 0x11be304a
repz ret
jmp fcn.11be54b2

Function at 0x11befa2b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.11be66a0
and dword [ebp - 4], 0
cmp dword [0x11c05cc0], 0
mov ebx, eax
jne 0x11befadc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x11befb8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x11befb8d
push eax
call fcn.11be662e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x11c05cc0], eax
call esi
push eax
call fcn.11be662e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x11c05cc4], eax
call esi
push eax
call fcn.11be662e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x11c05cc8], eax
call esi
push eax
call fcn.11be662e
pop ecx
mov dword [0x11c05cd0], eax
test eax, eax
je 0x11befadc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.11be662e
pop ecx
mov dword [0x11c05ccc], eax
mov eax, dword [0x11c05ccc]
cmp eax, ebx
je 0x11befb34
cmp dword [0x11c05cd0], ebx
je 0x11befb34
push eax
call fcn.11be66a9
push dword [0x11c05cd0]
mov esi, eax
call fcn.11be66a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x11befb34
test edi, edi
je 0x11befb34
call esi
test eax, eax
je 0x11befb2b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x11befb2b
test byte [ebp - 0xc], 1
jne 0x11befb34
or dword [ebp + 0x10], 0x200000
jmp 0x11befb6d
mov eax, dword [0x11c05cc4]
cmp eax, ebx
je 0x11befb6d
push eax
call fcn.11be66a9
pop ecx
test eax, eax
je 0x11befb6d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x11befb6d
mov eax, dword [0x11c05cc8]
cmp eax, ebx
je 0x11befb6d
push eax
call fcn.11be66a9
pop ecx
test eax, eax
je 0x11befb6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x11c05cc0]
call fcn.11be66a9
pop ecx
test eax, eax
je 0x11befb8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x11befb8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x11bf3e20
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x11c0600c]
test eax, eax
jne 0x11bf3f0c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x11c05da8
mov dword [0x11c0600c], 1
mov dword [0x11c05da8], 0x114
call esi
mov edx, dword [0x11c05db8]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x11c033e0], eax
je 0x11bf3eee
push edi
push 0x11c05ec0
mov dword [0x11c05ec0], 0x11c
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x11c06004], eax
call edi
mov dword [0x11c06008], eax
mov eax, dword [0x11c06004]
pop edi
test eax, eax
push 0x11c05fe0
je 0x11bf3ebc
call eax
jmp 0x11bf3ec2
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x11c05ec4]
cmp eax, 6
jae 0x11bf3eda
cmp eax, 5
jne 0x11bf3eee
cmp dword [0x11c05ec8], 2
jb 0x11bf3eee
cmp word [0x11c05fe0], 9
jne 0x11bf3eee
mov dword [0x11c05d9c], 1
push 0x11c05db0
push 0x11c05dac
call fcn.11bf4240
add esp, 8
call fcn.11bf3f20
mov eax, 1
pop esi
ret
mov eax, 1
ret

Function at 0x11bf4430
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x11bfa0b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x11bfb270]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x11bfb270]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x11bfb270]
mov dword [esi + 0x20], edx
mov eax, dword [0x11bfb270]
mov dword [esi + 0x24], eax
mov ecx, dword [0x11bfb270]
mov dword [esi + 0x28], ecx
mov edx, dword [0x11bfb270]
mov dword [esi + 0x2c], edx
mov eax, dword [0x11bfb270]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.11be21a0
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 7
call fcn.11be21a0
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x11bfccc4
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.11be1a90
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x11bf4500
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x11bfa0b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x11bfb270]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x11bfb270]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x11bfb270]
mov dword [esi + 0x20], edx
mov eax, dword [0x11bfb270]
lea ebp, [esi + 0x24]
mov dword [ebp], eax
mov ecx, dword [0x11bfb270]
lea ebx, [esi + 0x28]
mov dword [ebx], ecx
mov edx, dword [0x11bfb270]
mov dword [esi + 0x2c], edx
mov eax, dword [0x11bfb270]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 6
call fcn.11be21a0
lea ecx, [esi + 0x44]
mov byte [esp + 0x1c], 7
call fcn.11be21a0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esi + 0xc], ecx
push eax
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi], 0x11bfccc4
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
call fcn.11be1a90
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11bf45cf
push eax
mov ecx, ebx
call fcn.11be1a90
mov eax, dword [esp + 0x34]
test eax, eax
je 0x11bf45df
push eax
mov ecx, ebp
call fcn.11be1a90
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x11bf4e00
Capabilities:
Delete service

Disassembly:
sub esp, 0x20
push edi
call fcn.11bf4380
test eax, eax
je 0x11bf4e1e
mov dword [0x11c0601c], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x11bf4e39
mov dword [0x11c0601c], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
push esi
push 0xf003f
push edi
push edi
mov dword [0x11c0601c], edi
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x11bf4e6e
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x11bf4e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp esi, edi
je 0x11bf4e9b
mov eax, dword [esp + 0x34]
push 0xf01ff
push eax
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x11bf4eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x11bf4f08
jne 0x11bf4eee
test esi, esi
jne 0x11bf4ed3
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x11bf4ec7
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x11bf4ecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x11bf4eee
mov ecx, dword [esp + 0x34]
push 0xf01ff
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x11bf4eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, eax
test ebp, ebp
jne 0x11bf4f2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x11c0601c], eax
jmp 0x11bf4f0c
mov ebp, dword [esp + 0x10]
mov eax, dword [0x11c0601c]
test eax, eax
jne 0x11bf4f2c
test ebx, ebx
je 0x11bf4f21
mov dword [0x11c0601c], ebx
jmp 0x11bf4f2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x11c0601c], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x11bf4f39
push edi
call ebx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11bf4f48
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test esi, esi
je 0x11bf4f4f
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x11bf4f60
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.11bf4380
test eax, eax
je 0x11bf4f7e
mov dword [0x11c0601c], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x11bf4f99
mov dword [0x11c0601c], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push esi
push 2
push edi
push edi
mov dword [0x11c0601c], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x11bf4fc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
je 0x11bf4fea
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x11bf5028
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x11bf505f
jne 0x11bf5028
test esi, esi
jne 0x11bf500e
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x11bf500e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x11bf5028
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x11bf5028
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
jne 0x11bf507f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x11c0601c], eax
jne 0x11bf5068
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x11bf507f
mov eax, dword [0x11c0601c]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x11bf507f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x11bf507a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x11c0601c], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x11bf508c
push edi
call ebx
test esi, esi
je 0x11bf5093
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x11bf5260
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x11bfa17b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.11be21a0
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x11bf52a7
push eax
lea ecx, [esp + 0x18]
call fcn.11be23f0
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x11bf52bc
push eax
lea ecx, [esp + 0x18]
call fcn.11be23f0
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x11bf5327
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.11bf6420
add esp, 0x10
test eax, eax
jne 0x11bf5320
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.11be21b0
xor eax, eax
jmp 0x11bf53f5
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x11bf53de
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x11bf53de
test esi, esi
je 0x11bf53de
call fcn.11bf6050
mov eax, dword [0x11c06270]
test eax, eax
je 0x11bf53de
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.11bf63d0
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x11c06270]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.11be21b0
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x11bf5410
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x11bf542d
cmp edi, 4
jbe 0x11bf542d
mov dword [0x11c06020], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x11bf544c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.11be2be0
cmp edi, 0xffffffff
je 0x11bf5460
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.11be2be0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x11bf5478
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.11be2be0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11bf548e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.11be2c20
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11bf54a5
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.11be2c20
mov edi, dword [esp + 0x28]
test edi, edi
je 0x11bf54cd
push edi
call fcn.11be31f9
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x11bf54e4
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.11be2c20
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11bf54fb
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.11be2e20
mov eax, dword [esp + 0x34]
test eax, eax
je 0x11bf5511
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.11be2e20
pop esi
pop ebx
mov eax, 1
pop edi
ret

Function at 0x11bf5810
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11bfa1b8
push eax
mov dword fs:[0], esp
sub esp, 8
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x11bf5843
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
call fcn.11be31f9
add esp, 4
test eax, eax
jne 0x11bf5860
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
lea ecx, [esp + 8]
xor esi, esi
call fcn.11be2790
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push 0x80000002
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], esi
call fcn.11be2880
test eax, eax
je 0x11bf58a6
push edi
lea ecx, [esp + 0xc]
call fcn.11be2fd0
lea ecx, [esp + 8]
mov esi, eax
call fcn.11be28d0
test esi, esi
jne 0x11bf58d9
mov ecx, dword [str.SystemCurrentControlSetServicesVxD]
push 0x2001f
push ecx
push 0x80000002
lea ecx, [esp + 0x14]
call fcn.11be2880
test eax, eax
je 0x11bf58d9
push edi
lea ecx, [esp + 0xc]
call fcn.11be2fd0
lea ecx, [esp + 8]
mov esi, eax
call fcn.11be28d0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.11be28d0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x11bf5900
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11bfa1e8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x11bf5a11
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x11bf5a11
cmp word [edi], bx
je 0x11bf5a11
cmp word [esi], bx
je 0x11bf5a11
lea ecx, [esp + 0xc]
call fcn.11be2790
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x11bf59af
cmp eax, 1
je 0x11bf59af
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.11be2880
test eax, eax
jne 0x11bf599d
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.11be28f0
test eax, eax
je 0x11bf5a00
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.11be2c20
mov esi, eax
jmp 0x11bf5a96
mov edx, dword [0x11bfb270]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x11c04358
push ecx
mov byte [esp + 0x2c], 1
call fcn.11be2180
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push 0x80000002
call fcn.11be2880
test eax, eax
jne 0x11bf5a25
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11be1970
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.11be28d0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x11bfb270]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.11be3d24
add esp, 8
cmp eax, ebx
je 0x11bf5a4f
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.11be1a90
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x11bf5a68
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.11be1970
jmp 0x11bf59f3
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.11be2c20
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.11be1970
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.11be1970
lea ecx, [esp + 0xc]
call fcn.11be28d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.11be28d0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret