joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d520
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x7e
mov edi, ecx
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.1000ae30
xor edx, edx
push 0x7e
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x182]
push edx
mov word [ebp - 0x184], cx
call fcn.1000ae30
add esp, 0x24
push 0x40
lea eax, [ebp - 0x184]
push eax
push 0x40
lea ecx, [ebp - 0x104]
push ecx
push 0x40
lea edx, [ebp - 0x84]
push edx
push esi
mov ecx, edi
call fcn.1002d280
test eax, eax
jne 0x1002d5c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 4
push edi
push 0x20
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
test eax, eax
je 0x1002d5ac
xor esi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
cmp dword [ebp - 0x210], esi
jbe 0x1002d647
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.1000ae30
push esi
lea edx, [ebp - 0x184]
push edx
push str._s_d
lea eax, [ebp - 0x204]
push 0x3f
push eax
call fcn.1000c37d
add esp, 0x20
push edi
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x84]
push edx
call ebx
inc esi
cmp esi, dword [ebp - 0x210]
jb 0x1002d5f3
push edi
push 0
push 0
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x84]
push ecx
call ebx
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d6c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], esi
test esi, esi
je 0x1002d7f0
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1002d7f0
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x82]
push edx
mov word [ebp - 0x84], cx
call fcn.1000ae30
mov ecx, dword [ebp - 0x88]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x84]
push eax
push ecx
mov ecx, edi
call fcn.1002d670
test eax, eax
je 0x1002d7f0
push ebx
push esi
lea edx, [ebp - 0xb0]
push edx
mov ecx, edi
call fcn.1002d220
lea eax, [ebx + 0x20]
push eax
mov dword [ebp - 0x88], eax
call fcn.1000c806
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1002d7f0
mov eax, dword [ebp + 0x10]
mov ecx, 8
lea esi, [ebp - 0xb0]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x90]
push eax
push ecx
lea edx, [ebx + 0x20]
push edx
call fcn.1000b030
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp - 0xa4]
push edi
push ebx
push esi
call fcn.1002cb50
add esp, 0x18
push edi
push ebx
push 3
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x8c]
lea ecx, [eax + 0x20c]
mov dword [ebx + 0xc], esi
mov edx, dword [eax + 0x208]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
mov esi, eax
call fcn.1000ad98
add esp, 4
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002d810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x82]
push edx
mov dword [ebp - 0x8c], eax
mov word [ebp - 0x84], cx
call fcn.1000ae30
add esp, 0xc
push 0x40
lea eax, [ebp - 0x84]
push eax
push esi
mov ecx, ebx
call fcn.1002d670
test eax, eax
jne 0x1002d87a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
add eax, 0x20
push eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x90], eax
call fcn.1000c806
mov esi, eax
add esp, 4
test esi, esi
je 0x1002d94a
lea ecx, [ebp - 0x90]
push ecx
push esi
lea edx, [ebp - 0x94]
push edx
mov edx, dword [ebx + 0x208]
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x20c]
push ecx
push edx
mov dword [ebp - 0x94], 3
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1002d941
mov eax, dword [ebp - 0x90]
mov ecx, dword [esi + 0xc]
push eax
push esi
push ecx
call fcn.1002cb90
add esp, 0xc
cmp dword [ebp - 0x8c], 0
je 0x1002d931
mov eax, dword [esi + 8]
cmp eax, dword [edi]
ja 0x1002d931
push eax
lea ebx, [esi + 0x20]
push ebx
mov dword [edi], eax
call fcn.1002cd50
add esp, 8
cmp eax, dword [esi + 0x10]
jne 0x1002d941
mov edx, dword [edi]
mov eax, dword [ebp - 0x8c]
push edx
push ebx
push eax
call fcn.1000b030
add esp, 0xc
mov dword [ebp - 0x88], 1
jmp 0x1002d941
mov ecx, dword [esi + 8]
push 0xea
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.1000ad98
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002d970
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x7e
mov esi, ecx
push eax
lea ecx, [ebp - 0x82]
push ecx
mov word [ebp - 0x84], ax
call fcn.1000ae30
add esp, 0xc
push 0x40
lea edx, [ebp - 0x84]
push edx
push edi
mov ecx, esi
call fcn.1002d670
test eax, eax
jne 0x1002d9cc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 0x208]
lea eax, [ebp - 0x84]
push eax
lea ecx, [esi + 0x20c]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 4
Function at 0x1002deee
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov ecx, 0x10057430
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
xor edi, edi
call fcn.1001b4a0
lea ecx, [ebp - 4]
push ecx
push 3
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x1002dfb0
mov esi, 0x10057440
mov ecx, esi
call fcn.1001b4a0
lea ecx, [ebp - 8]
push ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp - 4]
call ebx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1002dfae
push dword [ebp - 8]
call fcn.1000b020
mov edi, eax
pop ecx
test edi, edi
je 0x1002dfae
mov ecx, esi
call fcn.1001b4a0
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push dword [ebp - 4]
call ebx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1002dfae
lea eax, [edi + 0x10]
push eax
call fcn.1000b581
mov ax, word [ebp + 8]
pop ecx
mov ecx, esi
mov word [edi + 0x3e], ax
call fcn.1001b4a0
push dword [ebp - 8]
push edi
push 3
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1002dfbe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.1000b015
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov esi, eax
push esi
push dword [ebp + 8]
push str.QS_FinishInstallTBHFlag__d____d
call fcn.1001aca0
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1002f405
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x1002f446
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x1002f41f
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1002f464
dec esi
je 0x1002f45b
dec esi
jne 0x1002f469
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10033290
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x10033330
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
push ebx
push edi
push edi
push edi
push eax
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push 1
push eax
mov eax, dword [ebp + 8]
push ecx
push 0xf01ff
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x10033324
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x10033315
cmp eax, 0x430
je 0x10033315
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_error_0x_08x
call fcn.1001aca0
add esp, 8
push esi
call ebx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
push esi
mov edi, 1
call ebx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
push eax
mov edi, 1
call ebx
push esi
call ebx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x100333a0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
je 0x100334d3
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x100334b8
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10033418
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x100334b1
mov dword [ebp - 0x24], 1
jmp 0x100334b1
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100334b1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [ebp - 0x1c], 2
mov ecx, dword [ebp - 0xc]
mov esi, eax
mov dword [ebp - 0x28], ecx
jne 0x100334a1
mov eax, 0xcccccccd
mul dword [ebp - 8]
shr edx, 3
cmp edx, 0x3e8
jae 0x1003345b
mov edx, 0x3e8
jmp 0x10033468
cmp edx, 0x2710
jbe 0x10033468
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x20]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100334a1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xc], eax
jbe 0x10033492
call edi
mov ecx, dword [ebp - 0xc]
mov esi, eax
mov dword [ebp - 0x28], ecx
jmp 0x1003349b
call edi
sub eax, esi
cmp eax, dword [ebp - 8]
ja 0x100334a1
cmp dword [ebp - 0x1c], 2
je 0x10033441
cmp dword [ebp - 0x1c], 4
jne 0x100334ae
mov dword [ebp - 0x24], 1
mov edi, dword [ebp - 0x2c]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x100334f0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x10033558
push 0x20
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10033551
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x10033545
cmp eax, 3
jne 0x1003354a
mov ebx, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10033680
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x2a4]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x100336c2
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push pe_nt_image_headers32
lea ecx, [ebp - 0x104]
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x100336b0
lea edx, [ebp - 0x104]
push edx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x100336b0
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.1000b030
movzx eax, byte [ebp - 0x110]
cdq
mov ecx, 0x1a
idiv ecx
movzx eax, byte [ebp - 0x10f]
add esp, 0xc
add dl, 0x41
mov byte [esi], dl
cdq
idiv ecx
add dl, 0x41
mov byte [edi], dl
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10033a00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa014
call fcn.1000aeb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x4ffe
push ecx
lea edx, [ebp - 0x5002]
push edx
mov dword [ebp - 0xa014], eax
mov dword [ebp - 0xa008], 7
mov dword [ebp - 0xa010], 0x2800
mov word [ebp - 0x5004], cx
call fcn.1000ae30
add esp, 0xc
lea eax, [ebp - 0xa010]
push eax
mov eax, dword [str.List]
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlServiceGroupOrder]
lea edx, [ebp - 0xa008]
push edx
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10033b78
push ebx
push edi
xor edx, edx
push 0x4ffe
push edx
lea eax, [ebp - 0xa002]
push eax
xor ebx, ebx
lea edi, [ebp - 0x5004]
mov word [ebp - 0xa004], dx
call fcn.1000ae30
add esp, 0xc
mov ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10033b4b
push esi
mov dword [ebp - 0xa00c], 0
mov esi, 0x10050ab0
mov edx, dword [esi]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10033af1
add esi, 4
cmp esi, 0x10050ac4
jl 0x10033ad0
mov esi, dword [ebp - 0xa00c]
jmp 0x10033af6
mov esi, 1
mov eax, dword [ebp - 0xa014]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10033b32
test esi, esi
jne 0x10033b32
mov ecx, 0x2800
sub ecx, ebx
push ecx
push edi
lea edx, [ebp + ebx*2 - 0xa004]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
lea ebx, [ebx + eax + 1]
jmp 0x10033b38
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
lea edi, [edi + eax*2 + 2]
push edi
call esi
test eax, eax
jne 0x10033ac1
pop esi
mov edx, dword [ebp - 0xa008]
lea eax, [ebx + ebx + 2]
push eax
mov eax, dword [str.List]
lea ecx, [ebp - 0xa004]
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlServiceGroupOrder]
push edx
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10033b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x24a]
push eax
mov dword [ebp - 0x254], 0x20
mov dword [ebp - 0x250], 1
mov word [ebp - 0x24c], dx
call fcn.1000ae30
add esp, 0x18
push 0x104
mov ecx, 0x10058604
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea edx, [ebp - 0x24c]
push esi
push edx
call fcn.1001e290
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x250]
push edx
push str.Group
lea eax, [ebp - 0x24c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10033c56
lea ecx, [ebp - 0x44]
push ecx
call fcn.10033a00
add esp, 4
push esi
call fcn.10033340
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10033c80
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x640], eax
test ebx, ebx
je 0x10033e8e
test eax, eax
je 0x10033e8e
cmp dword [ebp + 0x10], 0
je 0x10033e8e
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x62a]
push ecx
mov word [ebp - 0x62c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
lea edx, [ebp - 0x62c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.Drivers
lea eax, [ebp - 0x62c]
push eax
call esi
xor ecx, ecx
xor eax, eax
mov word [ebp - 0x14], cx
lea ecx, [ebp - 0x63c]
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
call fcn.1003b380
push 6
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x63c]
call fcn.1003b3c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test eax, eax
jne 0x10033d44
push 7
push str.123456
lea eax, [ebp - 0x14]
push eax
call edi
call fcn.10026770
test al, al
je 0x10033d79
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, ax
push ecx
xor eax, eax
push 0x10047f10
lea edx, [ebp - 0x14]
push 7
push edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
call fcn.1000c6df
add esp, 0x10
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
mov word [ebp - 0x21c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
lea edx, [ebp - 0x62c]
push edx
lea eax, [ebp - 0x21c]
push eax
call edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x21c]
push edx
call esi
push 0x104
lea eax, [ebp - 0x21c]
push str..sys
push eax
call fcn.1001e290
add esp, 0xc
push 0
lea ecx, [ebp - 0x21c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor edx, edx
push 0x206
mov esi, eax
push edx
lea eax, [ebp - 0x422]
push eax
mov word [ebp - 0x424], dx
call fcn.1000ae30
add esp, 0xc
push 0x104
mov ecx, 0x100585c4
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x424]
push ecx
call edi
push 0x104
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x424]
push eax
call fcn.1001e290
push 0x104
lea ecx, [ebp - 0x424]
push str..sys
push ecx
call fcn.1001e290
add esp, 0x18
test esi, esi
je 0x10033e6a
push 0
push 0
push 3
push 1
lea edx, [ebp - 0x424]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.10033290
add esp, 0x18
mov esi, eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x640]
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x10033ea0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100333a0

Function at 0x10033eb0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100334f0
Function at 0x10033ec0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
lea eax, [ebp - 0x20c]
push str.drivers_
push eax
call fcn.1001e290
push 0x104
lea ecx, [ebp - 0x20c]
push esi
push ecx
call fcn.1001e290
push 0x104
lea edx, [ebp - 0x20c]
push str..sys
push edx
call fcn.1001e290
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.10033340
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x4045f0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406d60
test esi, esi
jne 0x404628
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406e9c
jmp 0x404646
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404534
mov edi, eax
test esi, esi
je 0x404646
cmp dword [ebx], 0
je 0x404646
dec esi
jmp 0x40462f
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405ea0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x505054], 0
je 0x405f01
cmp word [0x505330], 0xd7b2
jne 0x405ec9
cmp dword [0x505338], 0
jbe 0x405ec9
mov eax, 0x50532c
call dword [0x505348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405f2c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x501030], 0
jne 0x405f1d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4060ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x501034], 0
je 0x4060d2
mov edx, esi
mov eax, ebx
call dword [0x501034]
jmp 0x4060e1
mov eax, 8
call fcn.0040427c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x505055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406074
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4077ec
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40782e
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40784e
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00406f48
add esp, 0x41c
pop esi
pop ebx
ret