joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1cd6100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.01c92c17
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x1cd6150
push ecx
push ecx
call fcn.01ca22aa
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1cd613f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1cd6420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x38], eax
mov ebx, 0x57
test ecx, ecx
je 0x1cd64ad
mov edi, edx
test edx, edx
je 0x1cd64ad
mov esi, ecx
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movups xmmword [eax + 0xc], xmm0
movaps xmmword [eax], xmm0
push 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1cd64a5
test byte [esp + 0x24], 0xf0
lea ebx, [esp + 0xc]
mov dword [ebx], 0
mov eax, 4
mov ecx, 0x40
cmove ecx, eax
push ebx
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1cd64a5
mov eax, dword [edi]
mov dword [esi], eax
push ebx
push dword [esp + 0x10]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
jmp 0x1cd64ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1cded20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x1cded72
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.01cde670
test al, al
jne 0x1cded5f
add esi, 0x58
cmp esi, ebx
jne 0x1cded4a
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x1cded72
cmp byte [esi + 0x1b], 0
jns 0x1cded89
mov eax, dword [esi + 0x10]
jmp 0x1cded8c
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x1cded75
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x1cded75
Function at 0x1cdeee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x1cdef3d
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.01cde670
test al, al
jne 0x1cdef1f
add edi, 0x58
cmp edi, ebx
jne 0x1cdef0a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x1cdef40
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x1cdef54
cmp byte [edi + 0x1b], 0
jns 0x1cdef62
mov eax, dword [edi + 0x10]
jmp 0x1cdef65
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x1cdef40
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cdef40
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x1cdef40
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x1cdef40
Function at 0x1cdf910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x1d36680], 0
je 0x1cdf948
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1d3666c]
test esi, esi
je 0x1cdf9e2
test byte [0x1d2fe54], 1
je 0x1cdf931
cmp byte [esi + 0xb], 0
jns 0x1cdf967
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x1d0a4d0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1d36680], eax
inc eax
cmp eax, 1
ja 0x1cdf931
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.01c96470
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1cdfa87
xor ebx, ebx
jmp 0x1cdf931
push 0xc
call fcn.01c92c17
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.01c96470
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.01cbf900
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1cdfa37
mov eax, dword [esi + 4]
mov ecx, dword [esi]
jmp 0x1cdfa3c
and eax, 0x7f
mov ecx, esi
test eax, eax
jne 0x1cdfa59
mov ecx, esi
push 9
push str.debug.log
call fcn.01c3e6d0
mov dword [0x1d3666c], esi
jmp 0x1cdf956
lea edi, [eax + eax]
test edi, edi
je 0x1cdfa40
lea edx, [edi - 2]
cmp word [ecx + edi - 2], 0x5c
mov edi, edx
jne 0x1cdfa5c
cmp edx, 0xfffffffe
je 0x1cdfa40
sar edx, 1
inc edx
cmp eax, edx
jb 0x1cdfb27
mov ecx, esi
push edx
call fcn.01cd65b0
jmp 0x1cdfa40
mov esi, dword [0x1d3666c]
push edi
call fcn.01cad054
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.01c3e3d0
mov ecx, dword [0x1d3666c]
call fcn.01c3c5e0
cmp word [eax], 0x5c
je 0x1cdfac2
mov ecx, dword [0x1d3666c]
push 1
push 0x1d06144
call fcn.01c3e6d0
mov ecx, dword [0x1d3666c]
push 9
push str.debug.log
call fcn.01c3e6d0
mov eax, dword [0x1d3666c]
cmp byte [eax + 0xb], 0
jns 0x1cdfae1
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x1d0a4d0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1d36680], eax
inc eax
cmp eax, 1
ja 0x1cdf931
mov dword [0x1d36680], 0
jmp 0x1cdf9db
call fcn.01ca7500
int3
Function at 0x1ce7080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1ce70a3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1ce70c8
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x1ce70c0
mov eax, ebx
and eax, 0x400
jne 0x1ce70d6
and ebx, 0x10
shr ebx, 4
jmp 0x1ce70d8
push 2
call fcn.01c798d0
add esp, 4
test al, al
jne 0x1ce70ef
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01cdfce0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cdfe20
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cc02b0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1ce7133
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x1ce7136
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1ce715d
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1ce7160
and eax, 0x7f
push eax
push ebx
push esi
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1ce7182
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cdfe80
jmp 0x1ce70d6

Function at 0x1ce71a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1ce71c3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1ce71ee
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c798d0
add esp, 4
test al, al
jne 0x1ce7200
xor ebx, ebx
jmp 0x1ce71d7
call fcn.01cdfce0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cdfe20
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cc02b0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1ce7241
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x1ce7244
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1ce726b
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1ce726e
and eax, 0x7f
push eax
push ebx
push esi
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1ce7290
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cdfe80
jmp 0x1ce71fc
Function at 0x1ce72a0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1ce72c3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1ce72db
and eax, 0x410
cmp eax, 0x410
je 0x1ce731b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1ce72e5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x1ce7309
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c798d0
add esp, 4
test al, al
jne 0x1ce7336
xor ebx, ebx
jmp 0x1ce72f2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01ce73e0
call fcn.01cdfce0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cdfe20
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.01cc02b0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1ce737a
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1ce737d
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1ce73a4
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1ce73a7
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1ce73c9
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cdfe80
jmp 0x1ce7317
Function at 0x1ce73e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1ce7402
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1ce741d
push 2
call fcn.01c798d0
add esp, 4
test al, al
jne 0x1ce7439
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01cdfce0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01cdfe20
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01cc02b0
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x1ce747e
mov ecx, dword [edi + 4]
mov edi, dword [edi]
jmp 0x1ce7481
and ecx, 0x7f
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1ce74a8
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1ce74ab
and eax, 0x7f
mov ecx, dword [ebp - 0xc8]
push eax
push ebx
push ecx
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1ce74d3
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cdfe80
jmp 0x1ce741d
Function at 0x1cecb54
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1cecb8f

Function at 0x1ceda00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01cecaf2
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0

Function at 0x1ceda60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
invalid
invalid

Function at 0x1cedf70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb byte [ebp - 0x4e], dl
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51

Function at 0x1cf0f10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01ce72a0

Function at 0x1cf5870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x1cf58ca
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x1cf58c4
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x1cf5894
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001440
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x100
xor eax, eax
nop dword [eax + eax]
mov byte [esp + eax], al
inc eax
cmp eax, 0x100
jl 0x10001450
push ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
push edi
xor edi, edi
xor esi, esi
nop word [eax + eax]
mov eax, esi
mov bl, byte [esp + esi + 0x10]
cdq
idiv ebp
mov eax, dword [esp + 0x114]
movzx ecx, bl
movsx eax, byte [edx + eax]
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x1000149b
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], al
inc esi
mov byte [esp + edi + 0x10], bl
cmp esi, 0x100
jl 0x10001470
mov ebp, dword [esp + 0x120]
xor esi, esi
xor edi, edi
xor ebx, ebx
test ebp, ebp
jle 0x10001516
inc esi
and esi, 0x800000ff
jns 0x100014d2
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [esp + esi + 0x10]
movzx edx, cl
add edi, edx
and edi, 0x800000ff
jns 0x100014eb
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], al
mov byte [esp + edi + 0x10], cl
movzx eax, byte [esp + esi + 0x10]
mov ecx, dword [esp + 0x11c]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x10]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, ebp
jl 0x100014c1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret

Function at 0x10001540
Capabilities:
Create thread
Set current directory
Terminate process

Disassembly:
push esi
push edi
push dword [0x1000e450]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, dword [esp + 0x10]
push 0
push 0x100064f0
mov dword [0x1000e4ac], 0x20
mov dword [0x1000e4b0], 2
mov dword [0x1000e4b4], 0x85
mov dword [0x1000e4b8], 0
mov dword [0x1000e4bc], 0
mov dword [0x1000e4c0], 0
mov dword [0x1000e4c4], 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov esi, eax
mov dword [0x1000e5e4], esi
test esi, esi
je 0x10001635
mov edx, dword [esp + 0xc]
mov dword [0x1000e4b0], 4
cmp edx, 1
jbe 0x100015e6
mov eax, 1
jle 0x100015e6
mov ecx, dword [edi + eax*4]
cmp word [ecx], 0x73
jne 0x100015e1
cmp word [ecx + 2], 0
je 0x10001624
inc eax
cmp eax, edx
jl 0x100015d1
push 4
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1000161e
mov ecx, dword [0x1000e41c]
push 0
push 0
push eax
push 0x100072d0
push 0
push 0
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x1000e5e4]
push 0x1000e4ac
push esi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
pop edi
pop esi
ret 8
push 0x1000e4ac
push 0
mov dword [0x1000e4b0], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001e80
Capabilities:
Suspend thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.10003d50
add esp, 4
test eax, eax
jne 0x10001ead
mov eax, 9
pop ebx
ret
cmp dword [ebx], 0
je 0x10001f02
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10001efd
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call fcn.100042b0
mov edi, eax
test edi, edi
je 0x10001ef0
push 0
push edi
call sub.NTDLL.dll_NtSuspendThread
push ebp
push dword [esp + 0x1c]
push edi
call fcn.10006a90
add esp, 0xc
push edi
call sub.NTDLL.dll_NtClose
inc esi
cmp esi, dword [ebx + 8]
jb 0x10001ec0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x100038e0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
xor ebp, ebp
push 0xf003f
push ebp
push ebp
call esi
mov ebx, eax
test ebx, ebx
jne 0x1000390d
push 1
push eax
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x100039bd
push edi
push 0xf01ff
push dword [esp + 0x34]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x100039b9
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x14], 1
je 0x10003985
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1000397f
xor esi, esi
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x14], 1
je 0x100039a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jl 0x10003955
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
test eax, eax
je 0x100039b6
cmp dword [esp + 0x34], ebp
jne 0x100039ad
push edi
mov ebp, 1
call esi
push ebx
call esi
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x10003981
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, eax
push edi
call esi
push ebx
call esi
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x10003c80
Capabilities:
Create thread

Disassembly:
sub esp, 0x20c
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x220]
cmp dword [esp + 0x21c], esi
jne 0x10003c9e
test edi, edi
je 0x10003d0f
cmp dword [0x1000e440], esi
je 0x10003cb5
push 0
push str.USBSafeManager
call fcn.100038e0
add esp, 8
cmp dword [esp + 0x21c], esi
je 0x10003d0b
push 0x52
push str.F5E1DC90_2556_4C9A_A9CA_71F4A60D0F8F
push str.Global_
lea eax, [esp + 0x14]
push str._s_s_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 8]
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
test edi, edi
je 0x10003d3e
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
add esp, 0x20c
ret
test edi, edi
jne 0x10003d22
push 0
push dword [esp + 0x21c]
call fcn.100071d0
add esp, 8
mov esi, eax
push 0
push 0
push 0
push 0x10007d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
add esp, 0x20c
ret
Function at 0x10003d50
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 8]
push eax
xor ebx, ebx
push ebx
push ebx
push 5
mov dword [esp + 0x18], ebx
call sub.NTDLL.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x10003eb7
mov eax, dword [esp + 8]
test eax, eax
je 0x10003eb7
push 4
push 0x1000
push eax
push ebx
call fcn.10006a60
mov dword [esp + 0x14], eax
test eax, eax
je 0x10003eb7
lea ecx, [esp + 8]
push ecx
push dword [esp + 0xc]
push eax
push 5
call sub.NTDLL.dll_NtQuerySystemInformation
test eax, eax
js 0x10003ea5
cmp dword [esp + 8], ebx
jbe 0x10003ea5
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, 1
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.10007070
cmp dword [esi + 0x44], eax
jne 0x10003e73
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x10003e6f
lea ebp, [esi + 0xdc]
mov esi, dword [ebp]
mov dword [esp + 0x20], esi
call fcn.10007530
cmp esi, eax
je 0x10003e62
mov eax, dword [edi]
test eax, eax
jne 0x10003e30
push 0x200
push eax
mov dword [edi + 4], 0x80
push dword [0x1000e140]
call fcn.10007d60
mov dword [edi], eax
test eax, eax
je 0x10003ebf
lea esi, [edi + 8]
jmp 0x10003e57
mov ecx, dword [edi + 4]
lea esi, [edi + 8]
cmp dword [esi], ecx
jb 0x10003e57
add ecx, ecx
mov dword [edi + 4], ecx
shl ecx, 2
push ecx
push eax
push 0
push dword [0x1000e140]
call fcn.10007de0
test eax, eax
je 0x10003ebf
mov dword [edi], eax
mov ecx, dword [esi]
mov edx, dword [esp + 0x20]
mov dword [eax + ecx*4], edx
inc dword [esi]
mov esi, dword [esp + 0x18]
inc ebx
add ebp, 0x40
cmp ebx, dword [esi + 4]
jb 0x10003df3
mov ebx, dword [esp + 0x14]
mov eax, dword [esi]
test eax, eax
je 0x10003e85
add esi, eax
mov dword [esp + 0x18], esi
jne 0x10003dd4
pop esi
pop ebp
test ebx, ebx
jne 0x10003ea5
mov eax, dword [edi]
test eax, eax
je 0x10003ea5
push eax
push 0
push dword [0x1000e140]
call fcn.10008ee0
mov dword [edi], 0
push 0x8000
push dword [esp + 0xc]
push dword [esp + 0x1c]
call fcn.10004330
pop edi
mov eax, ebx
pop ebx
add esp, 0x14
ret
mov esi, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0x14], ebx
jmp 0x10003e73