joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102437f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
cmp eax, edi
jne 0x10243a9
mov dword [ebp - 4], 0xa0
jmp 0x102445f
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x10243b4
mov dword [eax], edi
push esi
lea eax, [ebp - 8]
push eax
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1024424
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call esi
cmp eax, edi
jne 0x1024424
push edi
push dword [ebp - 0xc]
call fcn.01019232
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x1024402
mov dword [ebp - 4], 0xe
jmp 0x1024439
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x102440e
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x1024429
mov dword [ebp - 4], eax
jmp 0x1024434
cmp dword [ebp + 0xc], 7
jne 0x102444d
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
cmp dword [ebp - 4], edi
je 0x102444d
cmp ebx, edi
je 0x102444d
push ebx
call fcn.01017ef4
mov eax, dword [ebp + 0x18]
pop ecx
cmp eax, edi
je 0x102444d
mov dword [eax], edi
pop esi
cmp dword [ebp - 8], edi
je 0x102445f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 4], edi
pop edi
sete al
pop ebx
leave
ret 0x14

Function at 0x1024884
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10248b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x10248a7
cmp eax, 2
jne 0x10248af
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10248b6
xor eax, eax
inc eax
pop ebp
ret 4
Function at 0x10251e5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
cmp edi, esi
je 0x102536a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1025210
sub eax, edx
sar eax, 1
je 0x102536a
lea eax, [ebp - 8]
push eax
push 0x2001f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1025246
mov dword [ebp - 4], eax
jmp 0x102538c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0102437f
test eax, eax
jne 0x102526b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1025326
mov esi, dword [ebp - 0x10]
mov eax, edi
lea edx, [eax + 2]
cmp esi, 4
jb 0x102528c
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1025278
sub eax, edx
sar eax, 1
lea edi, [esi + eax*2 + 2]
jmp 0x102529e
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102528c
sub eax, edx
sar eax, 1
lea edi, [esi + eax*2 + 4]
push 0
push edi
call fcn.01019232
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x10252ba
mov dword [ebp - 4], 0xe
jmp 0x1025371
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp esi, 4
jb 0x10252f0
push esi
push dword [ebp - 0xc]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp + 0x14]
mov eax, edi
sub eax, esi
inc eax
inc eax
push eax
shr esi, 1
lea eax, [ebx + esi*2 - 2]
push eax
call fcn.01024975
jmp 0x10252fa
push dword [ebp + 0x14]
push edi
push ebx
call fcn.010248f9
test eax, eax
jge 0x1025306
push eax
call fcn.01023e47
jmp 0x1025326
push edi
push ebx
push 7
xor ecx, ecx
push ecx
push dword [ebp + 0x10]
mov eax, edi
shr eax, 1
mov word [ebx + eax*2 - 2], cx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x102532b
mov dword [ebp - 4], eax
jmp 0x1025371
push 0x10117e0
push dword [ebp + 0x10]
push 0x1008408
push dword [ebp + 0xc]
push 0x1011788
push 0x102c3b8
call fcn.01018f8f
push eax
call fcn.01018f8f
push eax
call fcn.01018f8f
push eax
call fcn.01018f8f
push eax
call fcn.01018f8f
push ebx
call fcn.01024600
jmp 0x1025371
mov dword [ebp - 4], 0xa0
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x1025381
push dword [ebp - 0xc]
call fcn.01017ef4
pop ecx
cmp ebx, esi
je 0x102538c
push ebx
call fcn.01017ef4
pop ecx
cmp dword [ebp - 8], esi
je 0x102539d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 4], esi
pop edi
pop esi
sete al
pop ebx
leave
ret 0x10
Function at 0x10255dd
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x102c358]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov edi, 0x208
push edi
xor ebx, ebx
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
test esi, esi
jne 0x102563e
mov ebx, 0xa0
jmp 0x1025730
and dword [esi], ebx
mov edi, 0x105
push edi
lea eax, [ebp - 0x41c]
push eax
push 0x10125d0
call fcn.010249bb
test eax, eax
je 0x1025700
lea eax, [ebp - 0x41c]
push eax
call fcn.01023e71
test eax, eax
jne 0x1025677
push 2
pop ebx
jmp 0x1025730
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.010254e7
test eax, eax
je 0x1025700
cmp dword [ebp - 0x44c], 1
je 0x10256e5
push 0x10126d8
push 0x1012678
push 0x80000002
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.010241fc
test eax, eax
jne 0x10256cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 2
je 0x10256c9
cmp ebx, 3
jne 0x1025730
xor ebx, ebx
mov dword [esi], ebx
jmp 0x1025730
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
call fcn.01023e71
test eax, eax
jne 0x10256e9
and dword [esi], ebx
jmp 0x1025730
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.010254e7
test eax, eax
jne 0x102570a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1025730
push dword [ebp - 0x470]
push dword [ebp - 0x474]
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.01023fa2
xor ecx, ecx
test eax, eax
setl cl
mov dword [esi], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01027ce5
leave
ret 4
Function at 0x10258bf
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x102c358]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x208
xor edi, edi
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
mov dword [ebp - 0x420], edi
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x1012950
mov esi, 0x102c3b8
push esi
call fcn.01018f8f
cmp dword [ebp + 8], edi
je 0x1025931
push 0x1012940
jmp 0x1025936
push 0x1012938
push esi
call fcn.01018f8f
push 0x10128f0
push esi
call fcn.01018f8f
push 0x10126d8
push 0x1012678
push 0x80000002
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.010241fc
test eax, eax
jne 0x1025997
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
cmp eax, 2
je 0x1025986
cmp eax, 3
jne 0x1025a7a
push 0x10128e0
mov dword [ebp - 0x420], edi
push esi
jmp 0x1025a75
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.01018f8f
mov edi, 0x1002440
push edi
push esi
call fcn.01018f8f
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.010249bb
test eax, eax
je 0x10259e5
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.01023e9e
test eax, eax
jne 0x10259f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
jmp 0x1025a7a
push 0x10128d8
lea eax, [ebp - 0x41c]
push eax
push 0x10128b4
push esi
call fcn.01018f8f
push eax
call fcn.01018f8f
push eax
call fcn.01018f8f
movzx eax, word [ebp - 0x422]
push edi
cdq
push edx
push eax
movzx eax, word [ebp - 0x424]
cdq
mov ecx, 0x10128b0
push ecx
push edx
push eax
movzx eax, word [ebp - 0x426]
push ecx
cdq
push edx
push eax
movzx eax, word [ebp - 0x428]
push ecx
cdq
push edx
push eax
push esi
call fcn.01018fc7
push eax
call fcn.01018f8f
push eax
call fcn.01018fc7
push eax
call fcn.01018f8f
push eax
call fcn.01018fc7
push eax
call fcn.01018f8f
push eax
call fcn.01018fc7
push eax
call fcn.01018f8f
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x420], eax
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01027ce5
leave
ret 4
Function at 0x1025bab
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102c358]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
cmp esi, ebx
je 0x1025c58
cmp eax, ebx
je 0x1025c58
lea eax, [ebp - 0x10]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x1025bfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1025c6a
push edi
call fcn.01019242
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1025c10
mov dword [ebp - 8], 0xe
jmp 0x1025c5f
push ebx
push edi
push dword [ebp - 0x10]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1025c2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1025c5f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1012a84
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1025c4a
mov dword [ebp - 8], 0xd
jmp 0x1025c5f
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
mov ecx, dword [ebp - 0x18]
mov word [ecx], ax
jmp 0x1025c5f
mov dword [ebp - 8], 0xa0
test ebx, ebx
je 0x1025c6a
push ebx
call fcn.01017ef4
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01027ce5
leave
ret 0xc
Function at 0x102661f
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102c358]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, 0x1014004
push ebx
mov edi, 0x1013fa0
push edi
mov esi, 0x80000002
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.010241fc
test eax, eax
jne 0x102669a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1026693
cmp eax, 3
jne 0x10266d2
and dword [ebp - 0x214], 0
push 0x1013f5c
lea eax, [ebp - 0x210]
push eax
call fcn.01024498
cmp eax, 2
jne 0x10266c1
push 0x1013f08
push 0x102c3b8
call fcn.01018f8f
jmp 0x10266de
push 0x1013f5c
push ebx
push edi
push esi
call fcn.01024279
test eax, eax
jne 0x10266de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x214], eax
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01027ce5
leave
ret
Function at 0x1026964
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
cmp dword [ebp + 8], edi
jne 0x1026987
mov ebx, 0xa0
jmp 0x1026aa8
push esi
mov esi, 0x80000000
push esi
push 0x10143d4
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x10269c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
jle 0x10269b7
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x1014458
jmp 0x1026a5a
push esi
push 0x1014364
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x10269f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, edi
jle 0x10269ec
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x101432c
jmp 0x1026a5a
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [ebp - 4]
push ecx
push edi
push edi
push edi
push eax
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x1026a7d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
jne 0x1026a78
push dword [ebp - 4]
xor ebx, ebx
call fcn.01019242
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1026a2f
push 0xe
pop ebx
jmp 0x1026a7d
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 0
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1026a61
call edi
mov ebx, eax
test ebx, ebx
jle 0x1026a54
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x10143f8
call fcn.0101872f
jmp 0x1026a7d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0xc]
cmp eax, 0x42a
jne 0x1026a71
mov eax, dword [ecx + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x1026a7d
mov ebx, 0x139f
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x1026a8f
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 8], edi
je 0x1026a99
push dword [ebp - 8]
call esi
pop esi
cmp dword [ebp - 0xc], edi
je 0x1026aa8
push dword [ebp - 0xc]
call fcn.01017ef4
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebx, edi
pop edi
sete al
pop ebx
leave
ret 4
Function at 0x1026cb2
Capabilities:
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x102c358]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x1014364
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
movsw word es:[edi], word [esi]
cmp eax, ebx
je 0x1026ce1
mov dword [eax], ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x1026d02
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1026e13
push 0xf01ff
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x1026d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1026e01
lea eax, [ebp - 0x3c]
push eax
push 4
push edi
call fcn.01026c72
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1026df5
and dword [ebp - 0x14], ebx
push 0x10146a8
lea eax, [ebp - 0x10]
push eax
push 0x1014658
mov esi, 0x102c3b8
push esi
call fcn.01018f8f
push eax
call fcn.01018f8f
push eax
call fcn.01018f8f
lea eax, [ebp - 0x3c]
push eax
push 1
push edi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1026da0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1002440
push 0
push dword [ebp - 0x38]
mov ebx, eax
push 0x1014620
push esi
call fcn.01018f8f
push eax
call fcn.01018fc7
push eax
call fcn.01018f8f
lea eax, [ebp - 0x3c]
push eax
push 1
push edi
call fcn.01026c72
test eax, eax
jne 0x1026dc6
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jb 0x1026d64
jmp 0x1026de8
push 0x100235c
lea eax, [ebp - 0x10]
push eax
push 0x10145ec
push esi
xor ebx, ebx
call fcn.01018f8f
push eax
call fcn.01018f8f
push eax
call fcn.01018f8f
cmp dword [ebp - 0x14], 0x14
jne 0x1026df5
mov ebx, 0x41d
jmp 0x1026e01
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1026e01
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1026e0e
push edi
call esi
push dword [ebp - 0x20]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01027ce5
leave
ret 4
Function at 0x1026e37
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x1026e67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1026efc
push esi
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
jne 0x1026e89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1026ee8
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1026ea9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0x420
jne 0x1026ee8
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push 4
push edi
xor esi, esi
call fcn.01026c72
test eax, eax
jne 0x1026ee8
cmp esi, 0x2d
jae 0x1026edf
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push 4
push edi
inc esi
call fcn.01026c72
test eax, eax
je 0x1026ebb
cmp esi, 0x2d
jne 0x1026ee8
mov dword [ebp - 4], 0x41d
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, ebx
je 0x1026ef5
push edi
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 4], ebx
pop ebx
sete al
leave
ret 4
Function at 0x10001f8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001c7f1
call fcn.1001c3b8
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000219d
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x10001fdd
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.10001357
test eax, eax
js 0x1000219d
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1000202e
mov ecx, esi
call fcn.10001387
test al, al
je 0x1000202e
mov eax, esi
call fcn.1001c519
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000203a
push esi
lea ecx, [ebp - 0x428]
call fcn.10006ae0
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.10006ae0
mov edi, eax
test edi, edi
je 0x10002197
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x10002088
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x10002088
call fcn.10001543
mov edi, eax
jmp 0x1000217c
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100020ab
call fcn.10001543
jmp 0x1000216f
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100020a1
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x100020de
mov edi, 0x8007000e
jmp 0x10002171
mov byte [ebp - 4], 2
call fcn.10005d4e
cmp eax, 0x400
jbe 0x100020fc
push eax
lea ecx, [ebp - 0x418]
call fcn.10006ae0
jmp 0x10002108
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1000212c
cmp dword [ebp - 0x418], 0
je 0x100020d4
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.10006ae0
pop ecx
pop ecx
mov ecx, eax
call fcn.100014e5
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.10006ae0
mov edi, eax
test esi, esi
je 0x1000217c
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100021b7
lea ecx, [ebp - 0x418]
call fcn.100058b0
jmp 0x100021b7
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x100021b2
lea ecx, [ebp - 0x418]
call fcn.100058b0
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10005668
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1001c309
ret 0x10
Function at 0x10006ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10006aef
pop dword [ebp - 0x18]
mov eax, 0x10006aef
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x8f72c4d4
add dword [ebp - 0x28], 0xbedf8077
mov dword [ebp - 0x24], 0x70ff112a
add dword [ebp - 0x24], 0xc1343b1b
mov dword [ebp - 0x20], 0x4243e8fe
sub dword [ebp - 0x20], 0xf5f7a4d0
mov dword [ebp - 0x1c], 0x7f7033a
sub dword [ebp - 0x1c], 0x7f7033a
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd7436c97
sub eax, 0xc7418c47
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2b9da24f
sub dword [ebp - 0x28], 0xb72b38f9
mov dword [ebp - 0x24], 0xa684e0d
sub dword [ebp - 0x24], 0xc8fbec98
mov dword [ebp - 0x20], 0xa231a60d
sub dword [ebp - 0x20], 0x3ec239a1
mov dword [ebp - 0x1c], 0x5c7c793b
add dword [ebp - 0x1c], 0xa38386c5
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3f9be
push 0
call eax
mov ecx, 0xc61c68a1
sub ecx, 0xc61c134b
mov edx, eax
mov edi, 0x31f5dd5e
add edi, 0xde0cfea2
add edi, dword [ebp - 0x18]
mov esi, 0x2a349495
add esi, 0xe10a9dc3
sub dword [ebp - 4], 0x339f3a8d
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0xdef541d4
xor ebx, esi
sub dword [ebp - 0x14], 0x1affa6c0
mov dword [edx], ebx
add dword [ebp - 0x10], 0x4d4a133c
add edx, 0x23ac22fc
sub edx, 0x23ac22f8
add edi, 0x6e05eb8a
sub edi, 0x6e05eb86
loop 0x10006c07
add eax, 0x1482b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret