joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180177b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xcc
movzx eax, byte [ebx]
movzx edx, byte [ebx + 4]
mov dword [ebp + 0x24], eax
movzx eax, byte [ebx + 1]
mov dword [ebp + 0x28], eax
movzx eax, byte [ebx + 2]
push esi
mov dword [ebp + 0x2c], eax
movzx eax, byte [ebx + 3]
push edi
push 0xf
pop ecx
and eax, ecx
mov dword [ebp + 0x30], eax
mov eax, 0xfc
and edx, eax
mov dword [ebp + 0x34], edx
movzx edx, byte [ebx + 5]
mov dword [ebp + 0x38], edx
movzx edx, byte [ebx + 6]
mov dword [ebp + 0x3c], edx
movzx edx, byte [ebx + 7]
and edx, ecx
mov dword [ebp + 0x40], edx
movzx edx, byte [ebx + 8]
and edx, eax
mov dword [ebp + 0x44], edx
movzx edx, byte [ebx + 9]
mov dword [ebp + 0x48], edx
movzx edx, byte [ebx + 0xa]
mov dword [ebp + 0x4c], edx
movzx edx, byte [ebx + 0xb]
mov esi, dword [ebp + 0x7c]
and dword [ebp + 0x64], 0
and edx, ecx
mov dword [ebp + 0x50], edx
movzx edx, byte [ebx + 0xc]
and edx, eax
movzx eax, byte [ebx + 0xd]
mov dword [ebp + 0x58], eax
movzx eax, byte [ebx + 0xe]
mov dword [ebp + 0x5c], eax
movzx eax, byte [ebx + 0xf]
and eax, ecx
push 0x11
mov dword [ebp + 0x60], eax
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp + 0x54], edx
rep stosd dword es:[edi], eax
test esi, esi
ja 0x18017863
cmp dword [ebp + 0x78], eax
jbe 0x180178bf
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
xor ecx, ecx
cmp ecx, esi
ja 0x1801788b
jb 0x1801787a
cmp eax, dword [ebp + 0x78]
jae 0x1801788b
mov edx, dword [ebp + 0x74]
movzx edx, byte [eax + edx]
mov dword [ebp + eax*4 - 0x64], edx
inc eax
cmp eax, 0x10
jb 0x1801786f
add dword [ebp + 0x74], eax
sub dword [ebp + 0x78], eax
mov dword [ebp + eax*4 - 0x64], 1
lea eax, [ebp - 0x20]
sbb esi, ecx
lea ecx, [ebp - 0x64]
call fcn.180176d4
lea eax, [ebp + 0x24]
push eax
lea edx, [ebp - 0x20]
call fcn.180176f5
pop ecx
test esi, esi
ja 0x18017863
jb 0x180178bf
cmp dword [ebp + 0x78], 0
ja 0x18017863
push 0x11
pop ecx
lea esi, [ebp - 0x20]
lea edi, [ebp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x180c1d70
lea eax, [ebp - 0x20]
call fcn.180176d4
mov eax, dword [ebp + 0x20]
shr eax, 7
neg eax
xor edx, edx
mov edi, dword [ebp + edx + 0x24]
lea ecx, [ebp + edx - 0x20]
mov esi, dword [ecx]
xor edi, esi
and edi, eax
xor edi, esi
add edx, 4
mov dword [ecx], edi
cmp edx, 0x44
jb 0x180178e1
pop edi
xor eax, eax
pop esi
movzx ecx, byte [ebx + eax + 0x10]
mov dword [ebp + eax*4 - 0x64], ecx
inc eax
cmp eax, 0x10
jb 0x180178ff
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x20]
call fcn.180176d4
xor eax, eax
mov cl, byte [ebp + eax*4 - 0x20]
mov edx, dword [ebp + 0x70]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x10
jb 0x1801791f
xor eax, eax
add ebp, 0x68
leave
ret
Function at 0x18017a13
Capabilities:
Create thread

Disassembly:
mov eax, dword [esi + 4]
test eax, eax
je 0x18017a21
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 4]
mov dword [esi], eax
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x18017968
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x18017a51
xor al, al
jmp 0x18017a61
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
ret 4
Function at 0x180180f7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [0x180fb8f9]
sub esp, 0x1c
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
and ecx, 0x180fbba0
push 1
pop ebx
je 0x1801813c
push 3
pop esi
push esi
push ebx
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._KillProcessViaWndMessages_
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
call fcn.18001000
pop ecx
pop ecx
mov edi, dword [ebp + 8]
lea esi, [edi + 0x38]
mov eax, esi
call fcn.18086b2b
push edi
push 0x18018038
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x18018166
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
test eax, 0xfffffffc
jne 0x180181a6
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1801819f
push ebx
push ebx
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
push dword [edi]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._KillProcessViaWndMessages__failed_to_find_any_windows_for__s_
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.18001000
add esp, 0xc
xor al, al
jmp 0x180182b8
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
and dword [ebp - 8], 0
sar eax, 2
mov byte [ebp - 1], 0
test eax, eax
jbe 0x1801827a
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 2
cmp dword [ebp - 8], eax
jb 0x180181d2
call fcn.1809e0d9
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0xc]
push 0
push 0xf060
shl edi, 2
add eax, edi
push 0x112
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x1801825c
mov eax, dword [ebp + 8]
cmp byte [eax + 0x54], 0
je 0x18018259
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18018239
push 3
push ebx
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._PostMessageSucceeded_flashing_window_
push eax
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], ebx
call fcn.18001000
pop ecx
pop ecx
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 2
cmp dword [ebp - 8], eax
jb 0x1801824c
call fcn.1809e0d9
mov eax, dword [esi + 0xc]
push ebx
push dword [edi + eax]
call dword [sym.imp.USER32.dll_FlashWindow]
mov byte [ebp - 1], bl
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
inc dword [ebp - 8]
sar eax, 2
cmp dword [ebp - 8], eax
jb 0x180181bf
cmp byte [ebp - 1], 0
mov edi, dword [ebp + 8]
jne 0x180182bf
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x180182b6
push 3
pop esi
push esi
push ebx
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
push dword [edi]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._KillProcessViaWndMessages__failed_to_PostMessage_to_windows_of__s_
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
call fcn.18001000
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push dword [ebp + 0xc]
call fcn.18017bb4
test al, al
je 0x180182b6
mov eax, ebx
jmp 0x180182b8
Function at 0x180184d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
dec ecx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov edi, edx
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x40
mov ecx, dword [ebx + eax]
mov edx, dword [eax]
mov esi, ecx
xor esi, edx
and esi, dword [ebp - 8]
xor edx, esi
mov dword [edi + eax], edx
mov edx, dword [ebp - 0xc]
xor ecx, esi
mov dword [edx + eax], ecx
add eax, 4
dec dword [ebp - 4]
jne 0x180184fa
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18018b6d
Capabilities:
Encode data using xor
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x20
push dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
call fcn.1809cfb0
mov al, byte [ebp - 5]
and byte [ebp - 0x24], 0xf8
and al, 0x3f
or al, 0x40
add esp, 0xc
mov byte [ebp - 5], al
xor eax, eax
mov ecx, dword [ebp + 0x10]
movzx ecx, byte [eax + ecx]
mov dword [ebp + eax*4 - 0x1a8], ecx
inc eax
cmp eax, 0x20
jb 0x18018ba7
push esi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.18018520
lea eax, [ebp - 0x128]
push eax
push eax
call fcn.180187d7
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.180183cc
push 0x20
pop ecx
lea eax, [ebp - 0xa8]
lea esi, [ebp - 0xa8]
lea edi, [ebp - 0x228]
push eax
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, 0x180c1cd8
call fcn.180182ef
mov eax, dword [ebp - 0x2c]
shr eax, 7
and eax, 1
add esp, 0x24
neg eax
xor edx, edx
mov edi, dword [ebp + edx - 0x228]
lea ecx, [ebp + edx - 0xa8]
mov esi, dword [ecx]
xor edi, esi
and edi, eax
xor edi, esi
add edx, 4
mov dword [ecx], edi
cmp edx, 0x80
jb 0x18018c27
pop edi
xor eax, eax
pop esi
mov cl, byte [ebp + eax*4 - 0xa8]
mov edx, dword [ebp - 0x28]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x20
jb 0x18018c4e
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1809ccb5
leave
ret
Function at 0x18019065
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], ecx
je 0x18019165
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
cmp dword [ebp + 0x10], 0
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
ja 0x180190a6
cmp dword [ebp + 0xc], 0x40
jb 0x18019114
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov edi, ecx
sub edi, eax
sub ebx, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
call fcn.1801919f
pop ecx
xor esi, esi
lea eax, [ebp + esi - 0x54]
mov cl, byte [ebx + eax]
xor cl, byte [eax]
inc esi
cmp esi, 0x40
mov byte [edi + eax], cl
jl 0x180190c5
xor ecx, ecx
push 8
inc ecx
pop edx
lea eax, [ebp + edx - 0x14]
movzx esi, byte [eax]
add ecx, esi
mov byte [eax], cl
shr ecx, 8
inc edx
cmp edx, 0x10
jl 0x180190dd
add dword [ebp + 0xc], 0xffffffc0
push 0x40
pop eax
adc dword [ebp + 0x10], 0xffffffff
add dword [ebp - 0x58], eax
add dword [ebp + 8], eax
add edi, eax
add ebx, eax
cmp dword [ebp + 0x10], 0
ja 0x180190b3
jb 0x18019113
cmp dword [ebp + 0xc], eax
jae 0x180190b3
pop ebx
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
je 0x18019163
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
call fcn.1801919f
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
jb 0x18019163
ja 0x1801913a
cmp dword [ebp + 0xc], ecx
jbe 0x18019163
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x54]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
mov byte [edi + eax], dl
mov eax, ecx
cdq
cmp edx, dword [ebp + 0x10]
jb 0x18019147
ja 0x18019163
cmp eax, dword [ebp + 0xc]
jb 0x18019147
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1809ccb5
leave
ret
Function at 0x18019993
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x414], ecx
mov ecx, dword [ebp + 0xc]
push edi
lea esi, [ebp - 0x424]
mov edi, edx
mov dword [ebp - 0x418], ecx
call fcn.18019c42
and dword [ebp - 0x410], 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x180199eb
call fcn.1800370f
mov esi, eax
jmp 0x18019ad9
push dword [ebp - 0x418]
push dword [ebp - 0x414]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x18019a0e
call fcn.1800370f
jmp 0x18019ad0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x414], eax
test eax, eax
je 0x18019a04
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x18019a54
lea eax, [ebp - 0x40c]
cmp dword [ebp - 0x410], eax
je 0x18019a4a
lea eax, [ebp - 0x410]
call fcn.180229cb
mov eax, 0x8007000e
jmp 0x18019af4
push 2
push eax
call fcn.180071f6
pop ecx
pop ecx
cmp eax, 0x400
jbe 0x18019a74
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.18022965
jmp 0x18019a80
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x18019a90
mov esi, 0x8007000e
jmp 0x18019ad2
push esi
push dword [ebp - 0x410]
push esi
push dword [ebp - 0x414]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18019a04
mov edx, dword [ebp - 0x410]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edx, dword [ebp - 0x410]
lea ecx, [ebp - 0x424]
call fcn.1801a399
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x40c]
cmp dword [ebp - 0x410], eax
je 0x18019af2
lea eax, [ebp - 0x410]
call fcn.180229cb
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1809ccb5
leave
ret 0xc
Function at 0x1801c48b
Capabilities:
Delete file

Disassembly:
push 0x10
push 0x180f18a8
call fcn.180a0c98
mov edi, ecx
mov esi, 0x180f6f58
call fcn.180572c7
movzx eax, byte [edi + 0xa8]
push eax
call fcn.1806d460
pop ecx
push eax
call fcn.18019601
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.1806dbba
mov dword [ebp - 0x1c], ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 4
push str.AlwaysAllowCrashUploads
push str.HKLMSoftwareDropboxUpdateUpdateDev_
call fcn.1800ed2d
add esp, 0x14
cmp dword [ebp - 0x1c], ebx
jne 0x1801c502
movzx eax, byte [edi + 0xa8]
push eax
call fcn.1806eaa5
test al, al
je 0x1801c4fd
call fcn.1806bb8e
test al, al
je 0x1801c502
mov byte [ebp - 0x1c], bl
jmp 0x1801c506
mov byte [ebp - 0x1c], 1
lea eax, [edi + 0xb4]
lea esi, [edi + 0x2c]
add edi, 0x28
mov ecx, dword [esi]
cmp dword [ecx - 0xc], ebx
setne cl
cmp cl, bl
je 0x1801c533
push edi
mov ecx, esi
call fcn.18026267
pop ecx
mov ebx, eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1801c542
push eax
push edi
push dword [ebp - 0x1c]
call fcn.1802606d
add esp, 0xc
mov ebx, eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.18025e85
mov dword [ebp - 0x20], ebx
jmp 0x1801c562
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.180a0cdd
ret
Function at 0x1801e4e2
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
call fcn.1800fcdd
test al, al
jne 0x1801e4fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.1801f8f6
test al, al
jne 0x1801e4f4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1801e563
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1801e55f
push 0xfffffffffffffffe
pop edi
push edi
push 2
pop esi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenSCManager_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov eax, ebx
jmp 0x1801e4f6
lea eax, [ebp - 8]
push eax
call fcn.18055bd3
pop ecx
push 2
pop esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1801e5e9
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x1801e5cf
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenService_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 0xc]
call ebx
mov eax, esi
jmp 0x1801e4f6
lea ecx, [ebp - 0x14]
push ecx
push 3
pop edi
push edi
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801e64f
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x1801e648
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._ChangeServiceConfig2_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
push dword [ebp - 0x10]
call ebx
jmp 0x1801e5cf
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1801e685
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._SetDelayedAutoStart_succeeded_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
pop ecx
pop ecx
push dword [ebp - 0x10]
call ebx
xor esi, esi
jmp 0x1801e5d2
Function at 0x1801e691
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [0x180fb8f9]
sub esp, 0x1c
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
and ecx, 0x180fbba0
push 2
pop edi
je 0x1801e6ee
push 3
pop esi
push esi
push edi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call fcn.18055bd3
pop ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push str._DeleteService___s_
push eax
call fcn.18001000
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, 0xfffffff0
call fcn.18004250
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1801e70e
call fcn.1800fc86
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0xc]
push eax
call fcn.18055bd3
mov eax, dword [eax]
mov dword [esp], 0x10002
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.18004250
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x1801e751
call fcn.1800fc86
mov edi, eax
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1801e709
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1801e7b1
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x1801e7a0
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
push dword [ebp - 4]
or dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._DeleteService_failed__0x_x_
push eax
mov dword [ebp - 0x10], edi
call fcn.18001000
add esp, 0xc
cmp dword [ebp - 4], 0x80070430
je 0x1801e7b1
push ebx
call esi
mov edi, dword [ebp - 4]
jmp 0x1801e748
push ebx
call esi
xor edi, edi
jmp 0x1801e748
Function at 0x1801e7b8
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, eax
push esi
push edi
mov ecx, ebx
call fcn.1801fb15
test al, al
je 0x1801e7d5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1801e7f2
call fcn.1800fc86
jmp 0x1801e7d0
lea eax, [ebp - 4]
push eax
call fcn.18055bd3
mov dword [esp], 0xf01ff
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x1801e835
call fcn.1800fc86
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 8]
call esi
mov eax, edi
jmp 0x1801e7d0
lea eax, [ebp - 0xc]
push eax
push 1
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801e857
call fcn.1800fc86
push edi
mov ebx, eax
call esi
mov edi, ebx
jmp 0x1801e821
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1801e895
push 3
push 2
pop ebx
push ebx
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._service_description_changed_successfully_
push eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], ebx
call fcn.18001000
pop ecx
pop ecx
push edi
call esi
xor edi, edi
jmp 0x1801e821
Function at 0x1801ea7a
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
call fcn.1800fcdd
test al, al
jne 0x1801ea93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.180201d0
test al, al
jne 0x1801ea8c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1801eafb
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1801eaf7
push 0xfffffffffffffffe
pop edi
push edi
push 2
pop esi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenSCManager_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov eax, ebx
jmp 0x1801ea8e
lea eax, [ebp - 8]
push eax
call fcn.18055ca3
pop ecx
push 2
pop esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1801eb81
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x1801eb67
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._OpenService_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.18004250
push dword [ebp - 0xc]
call ebx
mov eax, esi
jmp 0x1801ea8e
lea ecx, [ebp - 0x14]
push ecx
push 3
pop edi
push edi
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1801ebe7
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x1801ebe0
push 0xfffffffffffffffe
pop edi
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._ChangeServiceConfig2_failed__0x_x_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
add esp, 0xc
push dword [ebp - 0x10]
call ebx
jmp 0x1801eb67
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1801ec1d
push edi
push esi
mov dword [ebp - 0x24], ecx
call fcn.18001d8a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push str._SetDelayedAutoStart_succeeded_
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.18001000
pop ecx
pop ecx
push dword [ebp - 0x10]
call ebx
xor esi, esi
jmp 0x1801eb6a