joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x531f4198
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4af64bfe
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x101fd024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp esi, esp
call fcn.10022191
test eax, eax
je 0x100169cc
mov ecx, 0x101ff520
call fcn.10007ce0
test eax, eax
je 0x100169c3
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.10022191
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.create_reg_key_failed_key_s_n
push 0x3e3
push 0x1017235c
push 2
mov ecx, 0x101ff520
call fcn.10007ce0
mov edx, 0x28
imul ecx, edx, 0
add eax, ecx
push eax
call fcn.1001fe80
add esp, 0x1c
xor edx, edx
jne 0x10016973
jmp 0x10016a5e
mov esi, esp
lea eax, [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.10022191
test eax, eax
je 0x10016a4f
mov ecx, 0x101ff520
call fcn.10007ce0
test eax, eax
je 0x10016a49
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.10022191
push eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.read_reg_value_failed_key_s_value_s_n
push 0x3e7
push str.libtdc::ReadRegister
push 2
mov ecx, 0x101ff520
call fcn.10007ce0
mov ecx, 0x28
imul edx, ecx, 0
add eax, edx
push eax
call fcn.1001fe80
add esp, 0x20
xor eax, eax
jne 0x100169f5
jmp 0x10016a5e
mov dword [ebp - 8], 0
xor ecx, ecx
jne 0x10016943
cmp dword [ebp - 0x10], 0
je 0x10016a77
mov esi, esp
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10022191
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x10016aa4]
call fcn.1002213d
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021a20
add esp, 0x20
cmp ebp, esp
call fcn.10022191
mov esp, ebp
pop ebp
ret
Function at 0x10016ae0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x101fd024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 1
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp esi, esp
call fcn.10022191
mov esi, esp
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.10022191
mov esi, esp
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp esi, esp
call fcn.10022191
mov dword [ebp - 8], 0
xor ecx, ecx
jne 0x10016b23
cmp dword [ebp - 0x10], 0
je 0x10016bab
mov esi, esp
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10022191
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x10016bd8]
call fcn.1002213d
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021a20
add esp, 0x20
cmp ebp, esp
call fcn.10022191
mov esp, ebp
pop ebp
ret
Function at 0x1001b3a0
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016f808
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
lea edi, [ebp - 0x54]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101fd024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], 0
push 0xc
lea ecx, [ebp - 0x20]
call fcn.100037a0
lea ecx, [ebp - 0x20]
call fcn.10014940
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x52
mov eax, dword [ebp - 0x2c]
shl eax, 8
or eax, 0x53
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
shl ecx, 8
or ecx, 0x4d
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
shl edx, 8
or edx, 0x42
mov dword [ebp - 0x2c], edx
mov esi, esp
push 0
push 0
push 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp esi, esp
call fcn.10022191
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1014d39a
add esp, 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1001b4ee
mov esi, esp
mov edx, dword [ebp - 0x30]
push edx
mov eax, 1
imul ecx, eax, 0
add ecx, dword [ebp - 0x34]
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp esi, esp
call fcn.10022191
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x30]
jne 0x1001b4ee
mov ecx, 1
imul edx, ecx, 0
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
lea ecx, [ebp - 0x49]
call fcn.10003730
push eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x48]
call fcn.10007d00
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
push edx
lea ecx, [ebp - 0x20]
call fcn.1000efa0
lea ecx, [ebp - 0x48]
call fcn.10003640
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 8
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.10003100
push eax
call fcn.10146360
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000e510
mov ecx, dword [ebp - 0x50]
or ecx, 1
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10003640
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001b54c]
call fcn.1002213d
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021a20
add esp, 0x54
cmp ebp, esp
call fcn.10022191
mov esp, ebp
pop ebp
ret
Function at 0x1001de50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016f97b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
push esi
push edi
push ecx
lea edi, [ebp - 0x1b4]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x101fd024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.10003540
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xff
mov edx, 0x202
mov word [ebp - 0x1c], dx
mov esi, esp
lea eax, [ebp - 0x1b0]
push eax
movzx ecx, word [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp esi, esp
call fcn.10022191
test eax, eax
je 0x1001df34
mov ecx, 0x101ff520
call fcn.10007ce0
test eax, eax
je 0x1001df30
call fcn.1014d4d6
mov edx, dword [eax]
push edx
call fcn.10155ce2
add esp, 4
push eax
push 0x10173adc
push 0x44
push str.net_client_t::net_client_t
mov ecx, 0x101ff520
call fcn.10007ce0
mov ecx, 0x28
imul edx, ecx, 0
add eax, edx
push eax
call fcn.100206c0
add esp, 0x14
xor eax, eax
jne 0x1001dee8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001df78]
call fcn.1002213d
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021a20
add esp, 0x1b4
cmp ebp, esp
call fcn.10022191
mov esp, ebp
pop ebp
ret

Function at 0x1001e070
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp esi, esp
call fcn.10022191
pop esi
add esp, 4
cmp ebp, esp
call fcn.10022191
mov esp, ebp
pop ebp
ret 8

Function at 0x1001e0b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.10022191
pop esi
add esp, 4
cmp ebp, esp
call fcn.10022191
mov esp, ebp
pop ebp
ret 8
Function at 0x10020e00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push str.DriverInstallorUninstallProcess
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x101ff52c], 0
jg 0x10020e57
mov dword [0x101ff524], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10020f79
push 0
push 0
push 0
push 0xf001f
mov eax, dword [0x101fd018]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x101ff528], eax
cmp dword [0x101ff528], 0
je 0x10020f17
mov ecx, dword [0x101ff528]
mov edx, dword [ecx]
sub edx, 1
mov eax, dword [0x101ff528]
mov dword [eax], edx
mov ecx, dword [0x101ff52c]
sub ecx, 1
mov dword [0x101ff52c], ecx
mov edx, dword [0x101ff528]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [0x101ff528]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x101ff52c], 0
jne 0x10020f15
mov dword [0x101ff528], 0
mov dword [0x101ff524], 0
cmp dword [0x101fd018], 0xffffffff
je 0x10020ef6
mov edx, dword [0x101fd018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x101fd018], 0xffffffff
cmp dword [0x101fd014], 0xffffffff
je 0x10020f15
mov eax, dword [0x101fd014]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x101fd014], 0xffffffff
jmp 0x10020f5a
push str._n_driver_load_and_close_not_match_or_load_driver_fail__n
call fcn.100035a0
add esp, 4
cmp dword [0x101fd014], 0xffffffff
je 0x10020f3a
mov ecx, dword [0x101fd014]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x101ff524], 0
jmp 0x10020f79
cmp dword [ebp - 8], 0
jne 0x10020f65
call fcn.10021830
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10021720
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0x32
call fcn.10021830
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10021802
mov dword [ebp - 4], 0x32
jmp 0x10021767
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x100217ec
cmp dword [ebp + 0xc], 1
jne 0x1002177c
mov dword [ebp - 0xc], 3
jmp 0x10021783
mov dword [ebp - 0xc], 1
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
push 1
push 0xf01ff
push 0x10174054
push 0x1017405c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100217e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x430
jne 0x100217d7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002175e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1002181f
jmp 0x100217ec
cmp dword [ebp - 4], 0
jg 0x10021800
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1002181f
jmp 0x10021806
xor eax, eax
jmp 0x1002181f
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x10021830
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10021980
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100218b0
push 0xf01ff
push 0x10174064
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x100218aa
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10021891
mov dword [ebp - 0xc], 0
jmp 0x10021898
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100218ae
xor eax, eax
jmp 0x100218b7
jmp 0x100218b4
xor eax, eax
jmp 0x100218b7
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x100218c0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10021959
push 0xf01ff
push 0x1017406c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x10021946
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x1002192d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x1002192d
mov dword [ebp - 0xc], 0
jmp 0x10021934
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10021957
push str.OpenService_failed_n
call fcn.100035a0
add esp, 4
xor eax, eax
jmp 0x1002196d
jmp 0x1002196a
push str.OpenSCManager_failed_n
call fcn.100035a0
add esp, 4
xor eax, eax
jmp 0x1002196d
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10021980
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101fd024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10021a0b
push 0xf01ff
push str.ATSZIO
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x28], 0
je 0x10021a05
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x100219ec
mov dword [ebp - 0x2c], 0
jmp 0x100219f3
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10021a09
xor eax, eax
jmp 0x10021a12
jmp 0x10021a0f
xor eax, eax
jmp 0x10021a12
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021a20
mov esp, ebp
pop ebp
ret
Function at 0x1002eda0
Capabilities:
Initialize winsock library

Disassembly:
cmp dword [0x101ff898], 0
jne 0x1002ee39
push 0x190
push 0
push 0x101ff8a0
mov dword [0x101ff898], 1
call fcn.10146e60
add esp, 0xc
push 0x101ff8a0
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1002ee39
call fcn.1002efd0
push str.BIO_sock_init
push 0x94
push str.crypto_bio_bio_sock.c
call fcn.1002f0d0
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.1002f180
call fcn.1002efd0
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.1002f0d0
push 0
push 0x7a
push 0x20
call fcn.1002f180
add esp, 0x24
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x1002ee40
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x1002ee95
call fcn.1002efd0
push str.BIO_socket_ioctl
push 0xd1
push str.crypto_bio_bio_sock.c
call fcn.1002f0d0
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.1002f180
add esp, 0xc
xor eax, eax
test esi, esi
pop esi
sete al
ret

Function at 0x1002eea0
Capabilities:
Get socket status

Disassembly:
mov eax, 0x110
call fcn.10022920
mov eax, dword [0x101fd024]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x11c]
cmp edi, 0x3f
ja 0x1002ef8d
push esi
mov esi, dword [esp + 0x128]
mov eax, esi
or eax, dword [esp + 0x12c]
jne 0x1002ef01
pop esi
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10021a20
add esp, 0x110
ret
push 0
call fcn.10155b7b
add esp, 4
cmp dword [esp + 0x12c], edx
jg 0x1002ef34
jl 0x1002ef1a
cmp esi, eax
jae 0x1002ef34
pop esi
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10021a20
add esp, 0x110
ret
sub esi, eax
mov dword [esp + 0x18], edi
xor ecx, ecx
mov dword [esp + 0x14], 1
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
test ebp, ebp
mov dword [esp + 0x10], esi
push 0
lea eax, [esp + 0x1c]
cmovne eax, ecx
test ebp, ebp
push eax
lea eax, [esp + 0x20]
cmove eax, ecx
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10021a20
add esp, 0x110
ret
mov ecx, dword [esp + 0x114]
or eax, 0xffffffff
pop edi
pop ebp
xor ecx, esp
call fcn.10021a20
add esp, 0x110
ret