joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053400
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push esi
mov esi, dword [ebp + 8]
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], ebx
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x22
add esp, 0xc
cmp cx, word [esi]
jne 0x10053449
add esi, 2
cmp cx, word [esi]
je 0x10053441
movzx eax, word [esi]
cmp cx, ax
je 0x1005348e
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov ebx, ecx
nop word [eax + eax]
xor ecx, ecx
cmp cx, ax
je 0x10053487
push 1
push esi
lea eax, [ebp - 0x210]
push 0x104
push eax
call edi
movzx eax, word [esi + 2]
add esi, 2
add esp, 0x10
cmp bx, ax
jne 0x10053460
mov ebx, dword [ebp - 0x214]
pop edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test esi, esi
je 0x100534de
cmp word [ebp - 0x210], 0
jne 0x100534af
xor ecx, ecx
jmp 0x100534cf
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100534c0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.10002e00
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
Function at 0x10053b60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x238], edx
mov edi, ecx
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10053baa
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10053c25
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
cmp dword [ebp - 0x228], edi
je 0x10053be8
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x10053bd0
jmp 0x10053c24
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10053bf1
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
push dword [ebp + 8]
push dword [ebp - 0x238]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov dword [ebp - 0x234], 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x10053c50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1007b00c]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x20
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10053cfb
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0
push eax
push str.SeDebugPrivilege
xorps xmm0, xmm0
mov dword [esp + 0x14], 1
push 0
movq qword [esp + 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [esp + 0x18]
neg esi
push eax
sbb esi, esi
push 0
push dword [esp + 0x1c]
and esi, 2
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 8]
neg eax
sbb esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 1]
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10053d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x1007b00c]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push ecx
mov dword [esp + 0x18], eax
xor edi, edi
mov eax, dword [ebp + 8]
xor esi, esi
push edi
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x10]
push 0x400
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10053ea8
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x10053e9e
push 0x208
lea eax, [esp + 0x54]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x50]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0xa
push str.winsta.dll
lea eax, [esp + 0x58]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10053e9e
push str.WinStationGetProcessSid
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10053e83
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], esi
push ecx
push edi
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x1c]
push edi
call eax
push dword [esp + 0x20]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea eax, [esp + 0x20]
push eax
push edi
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x1c]
push esi
call dword [esp + 0x28]
test al, al
je 0x10053e83
push edi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x10053e83
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x28]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
mov ecx, 1
cmovne esi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10053e9e
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x25c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10053f10
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x10053fad
lea eax, [ebp - 0x20c]
push eax
call fcn.10054570
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x10053fad
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x10053fad
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.10054790
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x10053fad
lea eax, [ebp - 0x20c]
push eax
call fcn.100549d0
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x61c]
push 8
push str.userinit
push 0x104
push eax
mov dword [ebp - 0x620], 2
call esi
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10053fe0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call esi
mov eax, dword [edi + 4]
lea edx, [ebp - 0x620]
add esp, 0x10
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 4]
test eax, eax
jne 0x10054023
mov dword [edi + 8], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
Function at 0x10054040
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push esi
mov dword [ebp - 0x82c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100541df
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
add esp, 0xc
push esi
push 0x104
push eax
push 0x10067498
push str.open
push str.autorun
call edi
xor eax, eax
cmp ax, word [ebp - 0x20c]
jne 0x1005414c
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x10067498
push str.shellexecute
push str.autorun
call edi
xor eax, eax
cmp ax, word [ebp - 0x20c]
jne 0x1005414c
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x10067498
push str.shellopenCommand
push str.autorun
call edi
xor eax, eax
cmp ax, word [ebp - 0x20c]
jne 0x1005414c
push esi
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x10067498
push str.shellexploreCommand
push str.autorun
call edi
xor ecx, ecx
cmp cx, word [ebp - 0x20c]
jne 0x1005414c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x82c]
lea eax, [ebp - 0x414]
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100542e0
xor eax, eax
cmp ax, word [ebp - 0x414]
je 0x100541c7
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0xffffffffffffffff
push str.autoruninf
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call esi
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call esi
mov eax, dword [ebx + 4]
lea edx, [ebp - 0x828]
add esp, 0x20
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 4]
test eax, eax
jne 0x100541c7
mov dword [ebx + 8], 1
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
Function at 0x10054200
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100542c3
cmp dword [edi + 8], 0
push esi
lea esi, [ebp - 0x20c]
jne 0x100542ae
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
cmp ax, word [esi]
je 0x100542ad
push esi
call ebx
cmp eax, 2
je 0x1005425d
cmp eax, 3
je 0x1005425d
cmp eax, 6
jne 0x1005428d
push str.autorun.inf
push esi
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.1000f290
add esp, 0x18
lea eax, [ebp - 0x414]
mov ecx, edi
push esi
push eax
call fcn.10054040
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10054292
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2]
add esi, 2
cmp dword [edi + 8], 0
je 0x10054244
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x100542e0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call esi
test eax, eax
jne 0x100543d2
push edi
push ebx
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1000f290
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1005439f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054366
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0x10
push edi
call fcn.10054570
push edi
call esi
test eax, eax
jne 0x100543d2
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push edi
call esi
test eax, eax
jne 0x100543d2
push 0x104
push edi
call fcn.10054790
push edi
call esi
test eax, eax
jne 0x100543d2
push edi
call fcn.100549d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100543f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
push 0x12
push str.HKEY_LOCAL_MACHINE
push dword [esi*4 + 0x10064050]
call edi
add esp, 0xc
test eax, eax
jne 0x1005442d
mov eax, dword [ebp + 8]
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov eax, dword [esi*4 + 0x10064050]
add eax, 0x26
jmp 0x100544de
push 0x11
push str.HKEY_CURRENT_USER
push dword [esi*4 + 0x10064050]
call edi
add esp, 0xc
test eax, eax
jne 0x1005445c
mov eax, dword [ebp + 8]
mov dword [eax], SysReAllocString
mov eax, dword [esi*4 + 0x10064050]
add eax, 0x24
jmp 0x100544de
push 0x11
push str.HKEY_CLASSES_ROOT
push dword [esi*4 + 0x10064050]
call edi
add esp, 0xc
test eax, eax
jne 0x10054488
mov eax, dword [ebp + 8]
mov dword [eax], SysReAllocString
mov eax, dword [esi*4 + 0x10064050]
add eax, 0x24
jmp 0x100544de
push 0x13
push str.HKEY_CURRENT_CONFIG
push dword [esi*4 + 0x10064050]
call edi
add esp, 0xc
test eax, eax
jne 0x100544b4
mov eax, dword [ebp + 8]
mov dword [eax], htons
mov eax, dword [esi*4 + 0x10064050]
add eax, 0x28
jmp 0x100544de
push 0xa
push str.HKEY_USERS
push dword [esi*4 + 0x10064050]
call edi
add esp, 0xc
test eax, eax
jne 0x100544fd
mov eax, dword [ebp + 8]
mov dword [eax], htonl
mov eax, dword [esi*4 + 0x10064050]
add eax, 0x16
push 0xffffffffffffffff
push eax
push 0x104
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10054570
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x41c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x624]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100545c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 2]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
add esp, 8
push str.rundll32
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10054776
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x214]
push 0x103
push edi
push 0x104
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea eax, [ebp - 0x214]
push str.rundll32
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
lea eax, [ebp - 0x214]
jne 0x1005464c
push 0x103
push str.rundll32.exe
push 0x104
push eax
jmp 0x1005467e
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10054683
add esi, 2
push str.rundll32
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x10054683
push 4
push str..exe
push 5
push esi
call ebx
add esp, 0x10
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
jne 0x100546c0
push 0x104
lea eax, [ebp - 0x214]
push eax
call fcn.10054790
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
jne 0x100546c0
lea eax, [ebp - 0x214]
push eax
call fcn.100549d0
push 0x104
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp - 0x41c]
push eax
push 0x100676d8
push 0xffffffffffffffff
lea eax, [ebp - 0x624]
push 0x104
push eax
call fcn.1000f290
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x20
test eax, eax
jne 0x10054776
push 0x20
push edi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10054776
mov eax, 0x20
cmp ax, word [esi]
jne 0x10054738
nop dword [eax]
add esi, 2
cmp ax, word [esi]
je 0x10054730
push 0x2c
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
test eax, eax
je 0x1005474d
xor ecx, ecx
mov word [eax], cx
push 0x103
push esi
push 0x104
push edi
call ebx
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
Function at 0x100547f0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [ebp - 0x420], eax
xor ebx, ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x1005482a
mov ecx, 0x2e
cmp cx, word [eax]
je 0x100549bb
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push str.pathext
call edi
mov esi, eax
test esi, esi
je 0x100549bb
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x424], eax
test eax, eax
je 0x100549bb
push esi
push eax
push str.pathext
call edi
mov ecx, dword [ebp - 0x424]
xor edx, edx
push 0x3b
mov esi, ecx
push ecx
mov word [ecx + eax*2 - 2], dx
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov edi, eax
add esp, 8
test edi, edi
je 0x1005490f
mov ecx, edi
lea eax, [ebp - 0x41c]
sub ecx, esi
sar ecx, 1
push ecx
push esi
push 0x104
push eax
call edx
mov esi, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
push esi
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.1000f290
add esp, 0x28
test eax, eax
js 0x100548f1
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100548f9
lea esi, [edi + 2]
push 0x3b
push esi
jmp 0x10054888
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054902
jmp 0x1005498b
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054914
sub ecx, edi
lea eax, [ebp - 0x41c]
sar ecx, 1
push ecx
push esi
push 0x104
push eax
call edx
mov esi, dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
push esi
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.1000f290
add esp, 0x28
test eax, eax
js 0x100549ac
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100549ac
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10054980
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0x104
push esi
call eax
add esp, 0x10
mov ebx, 1
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
Function at 0x100552e0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
xor esi, esi
push edi
push edi
mov ebx, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1005539b
push edi
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push edi
push 3
push 0x30
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x1005533e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x10055398
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x10055398
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 3
push 0x30
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x10055398
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x10055393
cmp esi, dword [ebp - 8]
jae 0x10055390
push dword [edi]
mov ecx, ebx
call fcn.10055060
inc esi
add edi, 0x24
cmp dword [ebx + 8], 0
je 0x10055378
mov edi, dword [ebp - 0x14]
mov esi, 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x100553ad
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret