joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fb6e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f483
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
mov eax, dword [eax + 0x38]
call eax
test al, al
je 0x100fb72c
mov eax, 0xc0000022
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
mov ecx, ebx
push 1
push 1
call dword [eax + 0x48]
test eax, eax
js 0x100fb81d
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.10045960
mov esi, eax
test esi, esi
jns 0x100fb7a5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10045960
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.10045960
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.10045960
mov esi, dword [ebp - 0x10]
cmp esi, dword [eax]
setne al
test al, al
je 0x100fb80c
lea esp, [esp]
mov eax, dword [esi]
mov edx, dword [0x101cabb4]
add eax, 0xc
mov ecx, dword [ebx + 4]
push eax
push ecx
test edx, edx
je 0x100fb7e8
call edx
jmp 0x100fb7ee
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov edi, eax
test edi, edi
js 0x100fb82f
mov esi, dword [esi + 0xc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.10045960
cmp esi, dword [eax]
setne al
test al, al
jne 0x100fb7d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10045960
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10045960
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100fbb30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x101caba8]
test eax, eax
je 0x100fbbaa
lea ecx, [ebp - 0x30]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
call eax
jmp 0x100fbbba
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
test esi, esi
js 0x100fbc88
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [0x101cabac]
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x2c]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x100fbbf9
lea esi, [ebp - 0x10]
push esi
push ecx
push edx
push 0
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
call eax
jmp 0x100fbc0e
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, 0xc0000034
je 0x100fbc86
test esi, esi
jns 0x100fbcae
cmp esi, 0x80000005
je 0x100fbc30
cmp esi, 0xc0000023
jne 0x100fbc88
push dword [ebp - 0x10]
lea ecx, [edi + 0x24]
call fcn.10045960
mov esi, eax
test esi, esi
js 0x100fbc88
mov eax, dword [0x101cabac]
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x2c]
test eax, eax
je 0x100fbc63
lea esi, [ebp - 0x10]
push esi
push ecx
push edx
push 0
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
call eax
jmp 0x100fbc78
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test esi, esi
jns 0x100fbcae
cmp esi, 0xc0000034
jne 0x100fbc88
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x100fbcce
cmp byte [0x101ca990], 0
jne 0x100fbcce
mov ecx, dword [0x101cab8c]
push eax
test ecx, ecx
je 0x100fbcc1
call ecx
jmp 0x100fbcc7
mov eax, dword [edi + 0x2c]
test dword [eax + 4], 0x10000
je 0x100fbc86
mov esi, 0xc0000034
jmp 0x100fbc88
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp + 8], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101116cd
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x10151d44
call fcn.10119a04
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x101117c5
cmp byte [esi + 0x46], bl
je 0x101117c5
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x10111709
xor al, al
jmp 0x101117c7
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.10045960
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x10111736
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1011175d
dec eax
je 0x10111761
dec eax
dec eax
je 0x101117b3
xor bl, bl
jmp 0x101117b5
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x10111771
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x10111799
cmp eax, 0x10
jae 0x10111780
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.1011d718
add esp, 0x10
cmp ebx, eax
jne 0x10111759
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x101117b3
test ebx, ebx
jne 0x1011172a
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.10045960
jmp 0x10111724
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10045960
mov al, bl
jmp 0x101117c7
mov al, 1
call fcn.101199c2
ret
Function at 0x10111be0
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10151d96
call fcn.10119a04
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, 0xffff
cmp si, bx
jne 0x10111c02
xor eax, eax
jmp 0x10111d8a
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10111c2e
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10111c2e
dec dword [edx]
mov ax, bx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x10111d8a
cmp dword [edi + 0x50], 0
je 0x10111d87
mov ecx, edi
call fcn.1011186e
xor ecx, ecx
cmp dword [edi + 0x40], ecx
jne 0x10111c61
push dword [edi + 0x50]
push ebx
call fcn.10045960
pop ecx
pop ecx
test al, al
je 0x10111d87
movzx esi, bx
jmp 0x10111d87
push ecx
movzx eax, bx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xf
call fcn.10045960
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jae 0x10111c94
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp ecx, 0x10
jae 0x10111ca2
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [edi + 0x40]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x32]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x48]
push eax
call dword [edx + 0x1c]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x10111d7b
cmp eax, 1
jg 0x10111d5f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jb 0x10111cef
mov dword [ebp - 0x2c], eax
jmp 0x10111cf5
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
je 0x10111d27
cmp ecx, 0x10
jae 0x10111d08
lea eax, [ebp - 0x28]
push dword [edi + 0x50]
push edx
push 1
push eax
call fcn.1011d718
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x10111d57
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea ebx, [ebp - 0x34]
mov byte [edi + 0x46], 1
cmp dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 8]
jne 0x10111d54
test edx, edx
jne 0x10111c8c
cmp dword [ebp - 0x18], 0x20
jae 0x10111d5a
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.10045960
jmp 0x10111c83
movzx esi, bx
movzx esi, si
movzx esi, si
jmp 0x10111d78
cmp eax, 3
jne 0x10111d7b
push dword [edi + 0x50]
push dword [ebp - 0x34]
call fcn.10045960
pop ecx
pop ecx
test al, al
je 0x10111d78
movzx esi, bx
movzx esi, si
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10045960
mov ax, si
call fcn.101199c2
ret 4
Function at 0x40519b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e2a8]
jne 0x4051a5
repz ret
jmp fcn.0040b4a7

Function at 0x40bf1a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407c7c
and dword [ebp - 4], 0
cmp dword [0x458a04], 0
mov ebx, eax
jne 0x40bfcb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c07c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c07c
push eax
call fcn.00407c0a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x458a04], eax
call esi
push eax
call fcn.00407c0a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x458a08], eax
call esi
push eax
call fcn.00407c0a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x458a0c], eax
call esi
push eax
call fcn.00407c0a
pop ecx
mov dword [0x458a14], eax
test eax, eax
je 0x40bfcb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407c0a
pop ecx
mov dword [0x458a10], eax
mov eax, dword [0x458a10]
cmp eax, ebx
je 0x40c023
cmp dword [0x458a14], ebx
je 0x40c023
push eax
call fcn.00407c85
push dword [0x458a14]
mov esi, eax
call fcn.00407c85
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c023
test edi, edi
je 0x40c023
call esi
test eax, eax
je 0x40c01a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c01a
test byte [ebp - 0xc], 1
jne 0x40c023
or dword [ebp + 0x10], 0x200000
jmp 0x40c05c
mov eax, dword [0x458a08]
cmp eax, ebx
je 0x40c05c
push eax
call fcn.00407c85
pop ecx
test eax, eax
je 0x40c05c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c05c
mov eax, dword [0x458a0c]
cmp eax, ebx
je 0x40c05c
push eax
call fcn.00407c85
pop ecx
test eax, eax
je 0x40c05c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x458a04]
call fcn.00407c85
pop ecx
test eax, eax
je 0x40c07c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c07e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x403e59
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7d2ae620
add dword [ebp - 0x44], 0xd1275f2b
mov dword [ebp - 0x40], 0x848d54f4
sub dword [ebp - 0x40], 0x525a08af
mov dword [ebp - 0x3c], 0x99de44b4
sub dword [ebp - 0x3c], 0x4d920086
mov dword [ebp - 0x38], 0x6446e9e8
add dword [ebp - 0x38], 0x9bb91618
lea eax, [ebp - 0x44]
push eax
mov eax, 0x36c75c09
add eax, 0xc9792483
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xac0a82fb
add dword [ebp - 0x44], 0xc867e65b
mov dword [ebp - 0x40], 0x3a1668
add dword [ebp - 0x40], 0x41324b0d
mov dword [ebp - 0x3c], 0xc84fdd4d
add dword [ebp - 0x3c], 0x9b1f8f1f
mov dword [ebp - 0x38], 0xf63879cd
sub dword [ebp - 0x38], 0xf63879cd
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x65a650eb
add eax, 0x9a9a2fe9
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35a3d
push 0
call eax
mov ecx, 0xe6338262
sub ecx, 0xe6333ed0
mov edi, eax
mov ebx, 0xec90a3a4
sub ebx, 0xec4f93a4
add ebx, dword [ebp - 0x34]
mov esi, 0xf61612c5
add esi, 0x56f7c7c5
xor dword [ebp - 4], esi
mov edx, dword [ebx]
sub dword [ebp - 0x1c], eax
sub edx, esi
mov dword [ebp - 0x18], 0x50d9ef9b
mov dword [edi], edx
xor dword [ebp - 4], 0x8f4b304
add edi, 0x5c80c1f2
sub edi, 0x5c80c1ee
add ebx, 0xe3d52ce2
add ebx, 0x1c2ad322
loop 0x403f76
add eax, 0x1011b
mov ebx, eax
add eax, 0x99bc99f1
add eax, 0x66436614
mov ecx, 0xfa9ca20
add ecx, 0xf09635e0
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10001c60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [esp + 0xc], 0x4028
cmp dword [esp + 0xc], 0x42ee
push 0
pop ebx
jle 0x10001ced
push ebx
push ebx
push ebx
push ebx
push 0x862
push 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, ebx
mov edi, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
shl eax, cl
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001cbb
mov eax, dword [eax]
push eax
call fcn.1004823d
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10006cdf
inc ebx
cmp ebx, 0x1d64
jl 0x10001c9a
inc edi
push 0
pop ebx
cmp edi, 0x3541
jl 0x10001c9a
inc esi
cmp esi, 0x2e43
jl 0x10001c98
cmp byte [ebp + 0xc], 0
je 0x10001d02
push ebx
push ebx
push 0x42f
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x10001d0b
mov eax, dword [ebp + 8]
mov dword [eax], 0x91a049fe
cmp dword [esp + 0xc], 0x3f29
jge 0x10001d20
push str.uxcgvqqul_bfweo_qht_aiv_iwm_fvgangh_cpcib_jfpom_spn_zbkmv_bpqw_ctbqr_athf_ebc
call fcn.1004823d
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004a0e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006094d
call fcn.10060104
sub esp, 0x40
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
mov ebx, ecx
je 0x10004bea
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x28]
call fcn.1000627f
lea ecx, [ebp - 0x34]
call fcn.100040b3
add esp, 0x18
xor ebx, ebx
mov esi, 0x1007b9d8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0x4cd1
cmp dword [ebp - 0x28], 0x4d8c
jle 0x10004abe
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x20], 0x2079
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0x24], eax
mov dword [ebp - 0x18], 0x7ae0
mov edi, ebx
mov ebx, dword [ebp + 0x24]
mov eax, ebx
mov ecx, esi
or eax, edi
cdq
push edx
push eax
call fcn.1000616a
inc edi
cmp edi, 0x3b9d
jl 0x10004a7f
dec ebx
dec dword [ebp - 0x18]
push 0
mov dword [ebp + 0x24], ebx
pop ebx
jne 0x10004a7a
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
add eax, edi
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x10004a70
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x63bf
jl 0x10004a64
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x30]
je 0x10004bac
mov dword [ebp + 0x24], 0x2b92
cmp dword [ebp + 0x24], 0x2e61
jle 0x10004b16
push 0x1e1c
push ebx
push ebx
push ebx
push 0x2419
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov ecx, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000616a
inc ebx
cmp ebx, 0x331c
jl 0x10004af3
inc edi
push 0
pop ebx
cmp edi, 0x2312
jl 0x10004af0
push dword [ebp + 0x24]
xor eax, eax
mov dword [ebp - 0x38], 7
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], ebx
push dword [ebp - 0x34]
mov word [ebp - 0x4c], ax
call fcn.10009648
mov byte [ebp - 4], 2
cmp dword [ebp + 0x24], 0x29d1
jge 0x10004b73
mov edx, str.oplkwjarz_esgiden_wzihohbw_zuo_wazwnswfn_zthll_dwwz_giiqtwy_oryacnkcq_ppka_hkbewvviq
mov ecx, esi
call fcn.10008de6
jmp 0x10004b73
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x4c]
mov dword [ebp - 4], 1
call fcn.100049bd
lea ecx, [ebp - 0x4c]
push ebx
push 1
test eax, eax
jns 0x10004ba7
mov eax, dword [ebp + 0x20]
mov byte [eax], 1
call fcn.10006fda
lea ecx, [ebp - 0x34]
call fcn.10007293
jmp 0x10004c36
call fcn.10006fda
mov byte [ebp - 4], 4
cmp dword [ebp - 0x28], 0x4abf
jge 0x10004be3
mov edx, str.wxiiqm_gzfohvt_avwuasoxb_ured_xuvorlmp_saufzxarx_mzdkt_txq_jswazft_ymjd
mov ecx, esi
call fcn.10008de6
jmp 0x10004be3
mov eax, dword [ebp + 0x20]
mov byte [eax], bl
jmp 0x10004b9a
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x10004c31
mov edx, dword [ebp + 0x14]
sub esp, 0xc
push dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x2c]
push esi
call fcn.10005cfd
push dword [ebp + 0x1c]
xor dl, dl
xor cl, cl
push 0x21c
push dword [ebp + 0x18]
push 0x3bab
push edi
push 0x7441
push ebx
push esi
push dword [ebp + 0x2c]
call fcn.100026bb
add esp, 0x3c
inc dword [esi]
cmp dword [esi], 2
jle 0x10004bf5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dc3b
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000dc8a
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x1ce5
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push dword [eax]
push 1
mov eax, dword [ebp - 0x14]
push dword [eax]
push 0x1ff5
call fcn.1000dd60
add esp, 0x1c
jmp 0x1000dd5c
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000dd52
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000dd20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x1000dd50
push 0xd70
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 4]
push dword [ebp - 0x5c]
push 0
push 0x4cb6
call fcn.100144d2
add esp, 0x24
jmp 0x1000dd15
jmp 0x1000dd5c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret
Function at 0x10010210
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x10010292
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10010287
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10010268
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10010285
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100067a4
mov dword [eax], 5
jmp 0x1001025d
jmp 0x1001028d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x10010321
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10010319
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x54]
mov dword [eax], 1
jmp 0x10010321
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esp, ebp
pop ebp
ret
Function at 0x100109c7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060d46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10010ae6
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10010a19
push 0x1fc6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x10010ae4
mov dword [ebp - 0x20], 0x5c4
mov dword [ebp - 0x28], str.hwrjr_vlrbhsp_frzqmbqw
cmp dword [ebp - 0x20], 0x96d
jle 0x10010a9c
and dword [ebp - 0x14], 0
jmp 0x10010a3d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x29fb
jge 0x10010a9c
and dword [ebp - 0x18], 0
jmp 0x10010a53
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19ab
jge 0x10010a9a
and dword [ebp - 0x1c], 0
jmp 0x10010a69
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2eb5
jge 0x10010a98
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x1007b9d8
call fcn.1000616a
jmp 0x10010a62
jmp 0x10010a4c
jmp 0x10010a36
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x56c
jge 0x10010abe
mov edx, dword [ebp - 0x28]
mov ecx, 0x1007b9d8
call fcn.10008de6
jmp 0x10010ada
or dword [ebp - 4], 0xffffffff
jmp 0x10010ae4
jmp 0x10010b35
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
push 0x37af
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x262e
push dword [ebp - 0x38]
push 0x7d89
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
call fcn.1000cee3
add esp, 0x28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret