joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000841e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1000844c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x10008453
cmp ebx, dword [eax + 4]
jae 0x10008453
xor eax, eax
jmp 0x10008643
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x10008464
xor eax, eax
inc eax
jmp 0x10008642
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1000847a
cmp ecx, edx
jae 0x100085bf
cmp dword [eax + 4], 0
je 0x10008483
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x1000846b
cmp dword [ebp + 8], 0
je 0x100084a5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x100085bf
cmp eax, esi
jae 0x100085bf
mov eax, dword [0x176fd48]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x100084ca
cmp dword [esi*4 + 0x176fd50], edi
je 0x100085c3
inc esi
cmp esi, eax
jl 0x100084b8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x176c0c0]
test eax, eax
je 0x1000863f
cmp dword [ebp - 8], 0x1000000
jne 0x1000863f
test byte [ebp - 0xc], 0xcc
je 0x10008548
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x1000863f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000863f
cmp word [eax + 0x18], 0x10b
jne 0x1000863f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x1000863f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x10008548
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x10008548
test byte [ecx + 0x27], 0x80
jne 0x100085bf
push 1
push 0x176fd90
call dword [0x176c0bc]
test eax, eax
jne 0x1000845c
mov ecx, dword [0x176fd48]
test ecx, ecx
mov edx, ecx
jle 0x1000857c
lea eax, [ecx*4 + 0x176fd4c]
cmp dword [eax], edi
je 0x1000857c
dec edx
sub eax, 4
test edx, edx
jg 0x10008570
test edx, edx
jne 0x100085ad
push 0xf
pop ebx
cmp ecx, ebx
jg 0x10008589
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x100085a1
lea eax, [edx*4 + 0x176fd50]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x1000858f
cmp ecx, 0x10
jge 0x100085ad
inc ecx
mov dword [0x176fd48], ecx
push 0
push 0x176fd90
call dword [0x176c0bc]
jmp 0x1000845c
xor eax, eax
jmp 0x10008642
test esi, esi
jle 0x1000845c
mov ebx, dword [0x176c0bc]
push 1
push 0x176fd90
call ebx
test eax, eax
jne 0x1000845c
cmp dword [esi*4 + 0x176fd50], edi
je 0x10008619
mov eax, dword [0x176fd48]
lea esi, [eax - 1]
test esi, esi
jl 0x10008607
cmp dword [esi*4 + 0x176fd50], edi
je 0x10008603
dec esi
jns 0x100085f7
test esi, esi
jge 0x10008617
cmp eax, 0x10
jge 0x10008612
inc eax
mov dword [0x176fd48], eax
lea esi, [eax - 1]
jmp 0x10008619
je 0x10008631
xor ecx, ecx
test esi, esi
jl 0x10008631
lea eax, [ecx*4 + 0x176fd50]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x1000861f
push 0
push 0x176fd90
call ebx
jmp 0x1000845c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101062b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x20]
push ebx
movzx ebx, word [eax]
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0xfffffffffffffffe
inc esi
pop edi
and esi, edi
mov dword [ebp + 0x10], esi
jmp 0x1010659
push dword [ebp + 0x14]
movzx eax, ax
add eax, dword [ebp + 8]
push eax
call fcn.010107df
inc esi
and esi, edi
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x1010647
inc esi
and esi, edi
movzx ecx, word [esi]
inc esi
inc esi
xor ecx, ebx
cmp byte [ebp + 0x28], 0
jne 0x1010693
cmp byte [ebp + 0x24], 0
jne 0x1010693
cmp cx, ax
je 0x10106c8
inc esi
and esi, edi
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x1010681
jmp 0x10106c8
xor edi, edi
jmp 0x10106c2
mov eax, dword [ebp + 0x20]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp + 0x18]
and eax, 0xfffffff0
add eax, edx
push eax
movzx eax, cx
add eax, dword [ebp + 8]
inc edi
push eax
and edi, 3
call fcn.010107df
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
inc esi
xor ecx, ebx
cmp cx, 0xffff
jne 0x1010697
mov ecx, dword [ebp + 0x1c]
push dword [ebp + 0x20]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [esi + 7]
and eax, 0xfffffff8
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
movzx eax, word [ebp + 0xc]
add eax, dword [ebp + 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.01010789
cmp byte [ebp + 0x24], 0
jne 0x1010706
cmp dword [ebp + 0x14], 0
jne 0x101070c
cmp byte [ebp + 0x28], 0
je 0x101077c
mov esi, dword [ebp + 0x10]
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
je 0x101073f
mov edi, dword [ebp + 0x14]
neg edi
movzx eax, ax
add eax, dword [ebp + 8]
push edi
push eax
call fcn.010107df
inc esi
and esi, 0xfffffffe
movzx eax, word [esi]
inc esi
xor eax, ebx
inc esi
cmp ax, 0xffff
jne 0x1010721
cmp byte [ebp + 0x28], 0
je 0x101077c
xor edi, edi
jmp 0x101076b
mov eax, dword [ebp + 0x20]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp + 0x18]
and eax, 0xfffffff0
add eax, edx
neg eax
push eax
movzx eax, cx
add eax, dword [ebp + 8]
inc edi
push eax
and edi, 3
call fcn.010107df
inc esi
and esi, 0xfffffffe
movzx ecx, word [esi]
inc esi
xor ecx, ebx
inc esi
cmp cx, 0xffff
jne 0x1010749
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x24
Function at 0x1017cb3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0x20019
push 0
push 0x10111b4
push dword [eax + 0x68]
xor edi, edi
inc edi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1017d16
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1011194
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1017d0d
cmp dword [ebp - 8], eax
jne 0x1017d0d
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret 4

Function at 0x1018506
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x107342c]
and dword [ebp - 0x78], 0
push esi
mov esi, dword [fcn.0100168c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x74]
push eax
call esi
and dword [ebp - 0x8c], 0
and dword [ebp - 0x80], 0
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x90]
push eax
push 0x20019
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x90], 0x18
mov dword [ebp - 0x84], 0x40
call dword [fcn.01001690]
test eax, eax
jge 0x10185d6
jmp dword [0x1072380]
push edi
lea eax, [ebp - 0x74]
push eax
call esi
lea eax, [ebp - 0x94]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push 2
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x6c]
call dword [fcn.01001694]
test eax, eax
jl 0x101860c
cmp dword [ebp - 0x60], 4
jne 0x101860c
cmp dword [ebp - 0x64], 4
mov esi, dword [ebp - 0x5c]
je 0x101866b
jmp dword [0x1072150]
push dword [ebp - 0x6c]
call dword [fcn.010016c8]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0103e4d8
leave
ret 8
Function at 0x1019ed2
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x107342c]
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
push eax
push esi
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x5c], 0x4c
call fcn.0103eead
test al, al
je 0x101a003
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
mov edi, dword [fcn.01001454]
cmp dword [ebp - 8], esi
je 0x1019f46
cmp dword [ebp - 8], 3
je 0x1019f46
cmp dword [ebp - 8], 4
jne 0x1019fdd
call dword [fcn.010013f4]
mov dword [ebp - 0x68], eax
call dword [0x10013fc]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x78]
push eax
push 0xc
lea eax, [ebp - 0x68]
push eax
push 0xe
push dword [ebp - 0x50]
push esi
call fcn.0103eeb9
test al, al
je 0x1019fdd
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 1
push dword [ebp - 0x60]
call ebx
test eax, eax
jne 0x1019f94
call dword [fcn.0100149c]
cmp eax, 0x7a
je 0x1019f94
push dword [ebp - 0x60]
call edi
jmp 0x1019fdd
push dword [ebp - 0x54]
push esi
call dword [fcn.01001418]
mov esi, eax
test esi, esi
je 0x1019ffc
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 1
push dword [ebp - 0x60]
call ebx
test eax, eax
push dword [ebp - 0x60]
jne 0x1019fbe
call edi
jmp 0x1019fd4
call edi
push dword [esi]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1019fd4
mov eax, dword [ebp - 0x6c]
inc dword [eax]
push esi
call dword [fcn.010014a0]
xor esi, esi
push dword [ebp - 0x74]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.0103eead
test al, al
jne 0x1019f31
jmp 0x101a001
push dword [ebp - 0x60]
call edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
call fcn.0103e4d8
leave
ret 0x10

Function at 0x101a4ba
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1011460
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101a550
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x101142c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101a510
cmp dword [ebp - 0xc], 1
sbb esi, esi
inc esi
jmp dword [0x10726fc]
mov eax, esi
pop esi
leave
ret
Function at 0x101d5dc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
xor eax, eax
test edi, edi
jle 0x101d60b
push ebx
push esi
lea esi, [edx + ecx - 1]
add edi, ecx
movzx edx, byte [edi + eax]
mov dl, byte [edx + ecx]
xor dl, byte [esi]
mov ebx, dword [ebp + 0xc]
mov byte [eax + ebx], dl
inc eax
dec esi
cmp eax, dword [ebp + 8]
jl 0x101d5f3
pop esi
pop ebx
pop edi
pop ebp
ret 8

Function at 0x101d679
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x101d6a3
lea eax, [ebp - 8]
push eax
push 8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x101d6c6
lea eax, [ebp - 0x20]
push eax
call dword [0x1001244]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [0x1001240]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x101d6c9
mov edi, dword [ebp - 8]
cmp dword [ebp + 0xc], esi
mov edx, dword [ebp - 4]
je 0x101d6d9
or edi, 0x10000
jmp 0x101d6df
and edi, 0xfffeffff
cmp dword [ebp + 0x10], esi
je 0x101d6ef
or edi, 0x80000000
or edx, 3
jmp 0x101d70f
mov ecx, 0x80000000
mov eax, edi
mov esi, edx
and eax, ecx
and esi, 3
cmp eax, ecx
jne 0x101d70f
cmp esi, 3
jne 0x101d70f
and edi, 0x7fffffff
and edx, 0xfffffffc
mov eax, edi
pop edi
and edx, 0xfffbffff
pop esi
leave
ret 0xc
Function at 0x101da10
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push 8
pop eax
cmp dword [ebp + 0x1c], eax
jbe 0x101da23
mov dword [ebp + 0x1c], eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
jbe 0x101da3c
lea ecx, [ebp + 0x1c]
add ecx, 4
mov edx, dword [ecx]
mov dword [ebp + eax*4 - 0x20], edx
inc eax
cmp eax, dword [ebp + 0x1c]
jb 0x101da2d
mov eax, dword [0x10743a4]
test eax, eax
jne 0x101da5f
push 0x10116d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
mov dword [0x10743a4], eax
jne 0x101da5f
push 6
pop eax
leave
ret
push dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x101da89
call dword [fcn.0100149c]
leave
ret
xor eax, eax
leave
ret
Function at 0x101eefe
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x107342c]
lea ecx, [ebp - 0x9c]
push ecx
push 0x80
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push ecx
mov dword [ebp - 0x98], eax
mov eax, dword [eax + 8]
push 1
push dword [eax + 0x28]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x101f079
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
push edi
push dword [ebp - 0x84]
call esi
mov al, byte [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov byte [ebp - 0x85], al
xor eax, eax
xor bl, bl
cmp bl, byte [ebp - 0x85]
jae 0x101ef8d
movzx eax, bl
push eax
push dword [ebp - 0x84]
call edi
xor ecx, ecx
cmp dword [eax], 0x1f5
sete cl
inc bl
mov eax, ecx
test eax, eax
je 0x101ef66
test eax, eax
je 0x101f076
lea eax, [ebp - 0x90]
push eax
push 2
push 0
call sub.NETAPI32.dll_NetUserModalsGet
test eax, eax
jne 0x101f076
mov eax, dword [ebp - 0x90]
push dword [eax + 4]
call esi
mov al, byte [eax]
xor ebx, ebx
mov bl, al
inc bl
mov byte [ebp - 0x85], al
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push eax
push 0
mov dword [ebp - 0x94], eax
call dword [fcn.01001418]
test eax, eax
mov dword [ebp - 0x8c], eax
je 0x101f06b
mov ecx, dword [ebp - 0x90]
push dword [ecx + 4]
push eax
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x101f05f
movzx eax, byte [ebp - 0x85]
push eax
push dword [ebp - 0x8c]
call edi
push dword [ebp - 0x8c]
mov dword [eax], 0x1f5
call esi
push dword [ebp - 0x8c]
mov byte [eax], bl
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x101f05f
mov eax, dword [ebp - 0x98]
mov eax, dword [eax + 8]
push 0
add eax, 0x28
push eax
call fcn.010270ab
mov esi, eax
test esi, esi
je 0x101f05f
call fcn.0101eea9
push esi
call fcn.01027188
push dword [ebp - 0x8c]
call dword [fcn.010014a0]
push dword [ebp - 0x90]
call sub.NETAPI32.dll_NetApiBufferFree
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0103e4d8
leave
ret 4

Function at 0x101f085
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
je 0x101f0e2
push edi
push 4
push 0x1011b20
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x101f0de
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x101f0db
cmp dword [ebp - 0x1c], 4
jne 0x101f0db
mov dword [ebp - 4], 1
push edi
call esi
push ebx
call esi
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x10200e4
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push 8
pop eax
cmp dword [ebp + 0x1c], eax
jbe 0x10200f7
mov dword [ebp + 0x1c], eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
jbe 0x1020110
lea ecx, [ebp + 0x1c]
add ecx, 4
mov edx, dword [ecx]
mov dword [ebp + eax*4 - 0x20], edx
inc eax
cmp eax, dword [ebp + 0x1c]
jb 0x1020101
mov eax, dword [0x1076e28]
test eax, eax
jne 0x1020133
push 0x1010d8c
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
mov dword [0x1076e28], eax
jne 0x1020133
push 6
pop eax
leave
ret
push dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x102015d
call dword [fcn.0100149c]
leave
ret
xor eax, eax
leave
ret

Function at 0x102032f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
push 0x1011c48
call fcn.0103e7b6
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
push 4
pop edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push esi
push 0x1011bf0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0x10203aa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x1011be4
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0x10203aa
cmp dword [ebp - 0x30], edi
jne 0x10203aa
cmp dword [ebp - 0x20], 2
je 0x10203a3
cmp dword [ebp - 0x20], 3
jne 0x10203aa
mov dword [ebp - 0x24], 1
or dword [ebp - 4], 0xffffffff
call fcn.010203be
mov eax, dword [ebp - 0x24]
call fcn.0103e7f1
ret
Function at 0x10203cd
Capabilities:
Enumerate services
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
mov dword [ebp - 8], ebx
je 0x10203fb
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, ebx
je 0x10203f3
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esi], ebx
xor eax, eax
inc eax
jmp 0x10204fa
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, ebx
je 0x1020428
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1020421
xor eax, eax
cmp dword [ebp - 0x20], 4
sete al
jmp 0x10204fa
xor eax, eax
jmp 0x10204fa
push edi
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x10204f7
push ebx
mov dword [ebp - 4], ebx
call dword [fcn.01001248]
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push 0x30
push edi
call esi
test eax, eax
je 0x1020472
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10204f7
call dword [fcn.0100149c]
cmp eax, 0xea
je 0x102048b
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
inc eax
jmp 0x10204f9
push dword [ebp - 4]
push 0x40
call dword [fcn.01001418]
mov ebx, eax
test ebx, ebx
je 0x102047f
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 1
push 0x30
push edi
call esi
test eax, eax
je 0x1020511
cmp dword [ebp + 0x10], 0
jbe 0x10204e7
mov eax, dword [ebp + 0x10]
push dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
lea eax, [eax + eax*8]
push dword [ebx + eax*4]
call dword [0x10015e0]
test eax, eax
pop ecx
pop ecx
je 0x1020500
cmp dword [ebp + 0x10], 0
jne 0x10204c1
or dword [ebp + 0x10], 0xffffffff
push ebx
call dword [fcn.010014a0]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push 4
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push ebx
call dword [fcn.010014a0]
jmp 0x102047f
Function at 0x102051d
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 8], esi
push edi
mov dword [ebp - 4], 1
je 0x10205b5
push esi
push esi
push esi
push 0x192
push dword [0x1076d34]
call dword [0x10018c8]
mov ebx, eax
cmp ebx, esi
je 0x10205b5
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [0x100188c]
mov edi, dword [0x1001890]
push 0x41
push esi
push esi
push 0x11
call edi
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xc]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10
call edi
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push 0xffffffffffffffff
push ebx
call dword [fcn.010018ac]
mov edi, dword [fcn.01001894]
jmp 0x10205a6
lea eax, [ebp - 0x34]
push eax
call dword [0x1001898]
push 1
push esi
push esi
lea eax, [ebp - 0x34]
push ebx
push eax
call edi
test eax, eax
jne 0x102059c
push 4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x10205fb
push 0x10
push 0x1011c54
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp + 8], eax
je 0x10205f1
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push dword [ebp + 8]
call edi
jmp 0x10205f4
mov dword [ebp - 4], esi
push dword [ebp - 8]
call edi
jmp 0x10205fe
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x1020609
push ebx
call dword [0x10018cc]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1024757
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x107342c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 4
mov dword [ebp - 0x90c], eax
pop esi
xor eax, eax
mov ecx, 0x23d
lea edi, [ebp - 0x8f8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x8fc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10125b8
push 0x80000002
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x904], esi
mov dword [ebp - 0x900], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x1024833
cmp dword [ebp - 0x8fc], ebx
je 0x10247f6
lea eax, [ebp - 0x908]
push eax
lea eax, [ebp - 0x900]
push eax
lea eax, [ebp - 0x904]
push eax
push ebx
push 0x101259c
push dword [ebp - 0x8fc]
mov dword [ebp - 0x908], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1024833
jmp dword [0x1072700]
jmp dword [0x1072440]

Function at 0x1024f92
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push edi
xor ebx, ebx
push ebx
add eax, 0x28
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
xor edi, edi
call fcn.010270ab
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1025038
push esi
call fcn.01032293
test eax, eax
je 0x1025024
movzx eax, word [ebp + 0x10]
cmp eax, 0xe
jb 0x1024fd3
xor eax, eax
jmp dword [0x1072678]
push dword [ebp - 0xc]
call fcn.01027188
cmp edi, ebx
je 0x1025038
xor eax, eax
inc eax
jmp 0x1025312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push ebx
push dword [eax + 0x18]
call dword [fcn.01001600]
mov esi, eax
cmp esi, ebx
je 0x1025252
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov edi, 0x1076ce0
push edi
mov dword [esi + 8], eax
call dword [fcn.01001674]
mov eax, dword [ebp + 0x10]
cmp eax, dword [0x1076cc8]
jne 0x1025139
jmp dword [0x10724f8]
mov eax, dword [0x1076d04]
mov dword [esi], 0x1076d00
mov dword [esi + 4], eax
mov dword [eax], esi
inc dword [0x1076cf8]
cmp dword [0x1076ccc], ebx
mov dword [0x1076d04], esi
jne 0x102516a
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [0x1076ccc], eax
jmp 0x1025173
push ebx
push ebx
push ebx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov ebx, dword [fcn.01001678]
push edi
call ebx
cmp dword [ebp - 4], 0
je 0x1025235
jmp dword [0x10723a8]
cmp dword [ebp - 8], 0
je 0x1025250
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [fcn.01001668]
xor ebx, ebx
jmp dword [0x10725f8]
jmp dword [0x1072604]