joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1030f53
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1099a38]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x1030f98
push eax
push dword [ebp + 0xc]
push 0x100a144
call fcn.01071ac0
add esp, 0xc
xor eax, eax
jmp 0x10310f9
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], bl
jne 0x1030fb2
cmp dword [ebp + 0x14], ebx
jne 0x1030fb2
cmp dword [ebp + 0x18], ebx
jne 0x1030fb2
xor eax, eax
inc eax
jmp 0x10310f8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0xc], ebx
call esi
cmp eax, ebx
je 0x1030fdb
cmp eax, 0xea
jne 0x10310f5
cmp dword [ebp + 0x14], ebx
jne 0x1030fe8
xor eax, eax
inc eax
jmp 0x10310f7
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x10310eb
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 0x14]
call esi
cmp eax, ebx
je 0x1031022
push eax
push 0x100a110
call fcn.01071ac0
pop ecx
jmp 0x10310cc
cmp dword [ebp + 0x18], ebx
je 0x10310d6
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 0x18], eax
jne 0x10310cf
cmp eax, 3
jne 0x1031072
mov edi, dword [ebp + 0x1c]
cmp dword [ebp - 0xc], edi
je 0x103104b
push 0x100a0d0
jmp 0x10310c7
xor esi, esi
cmp edi, ebx
jbe 0x1030fe0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dl, byte [ecx + eax]
cmp dl, byte [eax]
jne 0x103106b
inc esi
inc eax
cmp esi, edi
jb 0x1031059
jmp 0x1030fe0
push 0x100a094
jmp 0x10310c7
cmp eax, 1
je 0x1031081
cmp eax, 7
je 0x1031081
cmp eax, 2
jne 0x10310a3
push dword [ebp - 8]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1030fe0
push 0x100a060
call fcn.01071ac0
mov eax, dword [ebp - 0x10]
pop ecx
cmp eax, 4
je 0x10310b2
cmp eax, 0xb
je 0x10310b2
cmp eax, 5
jne 0x10310f5
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
cmp eax, dword [ecx]
je 0x1030fe0
push 0x100a024
call fcn.01071ac0
pop ecx
jmp 0x10310f5
push 0x1009ff0
jmp 0x10310c7
push dword [ebp - 8]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10310f5
jmp 0x1030fe0
push 0x1009fbc
call fcn.01071aad
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0106bc50
leave
ret 0x18
Function at 0x1033265
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp byte [eax], 0
mov dword [ebp - 0x210], eax
je 0x103335f
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1033292
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
lea eax, [ebp - 0x108]
push eax
call esi
mov ebx, dword [sym.imp.msvcrt.dll_strrchr]
lea eax, [ebp - 0x108]
push 0x2e
push eax
call ebx
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1033353
lea eax, [ebp - 0x108]
push eax
mov byte [edi + 1], 0x70
call esi
mov esi, 0x100a6b8
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
push 0x5c
push eax
movsb byte es:[edi], byte [esi]
call ebx
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1033353
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100a5dc
push 0x10c64c0
call fcn.01070fc9
push esi
lea eax, [ebp - 0x20c]
push eax
inc edi
push edi
push eax
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1033338
push edi
call fcn.0107c693
jmp 0x1033353
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100a678
call fcn.01071ac0
add esp, 0xc
mov eax, dword [ebp - 0x210]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0106bc50
leave
ret 8

Function at 0x10333b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1099a38]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
je 0x1033417
cmp esi, ebx
jne 0x10333e1
mov dword [edi], 0x57
jmp 0x1033417
lea ecx, [ebp - 0x110]
push ecx
push 0x10008
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 0x118], eax
je 0x103341e
push eax
push esi
push 0x100a6f8
call fcn.01071ac0
mov eax, dword [ebp - 0x118]
add esp, 0xc
mov dword [edi], eax
xor eax, eax
jmp 0x10334be
mov dword [ebp - 0x114], ebx
xor esi, esi
lea eax, [ebp - 0x124]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x114]
mov dword [ebp - 0x11c], 0x105
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
jne 0x103349e
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x110]
call fcn.010333b0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
mov dword [ebp - 0x118], eax
je 0x1033426
inc dword [ebp - 0x114]
mov esi, eax
jmp 0x1033426
cmp eax, 0x103
je 0x10334a7
mov esi, eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
je 0x10334bd
mov dword [edi], esi
jmp 0x10334be
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0xc
Function at 0x10334cd
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010333b0
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 4]
cmp eax, 2
je 0x10334f5
cmp eax, 3
jne 0x10334f7
xor eax, eax
test eax, eax
jne 0x1033513
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, 2
je 0x1033511
cmp eax, 3
jne 0x1033513
xor eax, eax
leave
ret 8

Function at 0x1033661
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1099a38]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x1009220
push esi
push 0x100a850
mov dword [ebp - 4], eax
call fcn.0107230a
test eax, eax
jne 0x103369c
push 0x100a808
call fcn.01071aad
jmp 0x1033748
push eax
lea eax, [ebp - 0x20c]
push 0x100a7e0
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0107230a
test eax, eax
jne 0x10336d8
lea eax, [ebp - 0x20c]
push eax
push 0x100a7a8
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1033748
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1033704
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x100a770
jmp 0x1033740
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.01072fa8
add esp, 0xc
push 1
lea eax, [ebp - 0x310]
push eax
call fcn.0107245e
test eax, eax
jne 0x103374c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x310]
push eax
push 0x100a740
call fcn.01071ac0
add esp, 0xc
xor eax, eax
jmp 0x103374f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0106bc50
leave
ret 4
Function at 0x1033977
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 2
xor esi, esi
push esi
push 0x100a9a4
push SysStringLen
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1033a46
push ebx
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_strrchr]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x1033a00
mov esi, dword [sym.imp.msvcrt.dll__strcmpi]
push edi
lea edi, [ebx + 1]
push edi
push 0x100a99c
call esi
test eax, eax
pop ecx
pop ecx
je 0x10339fc
push edi
push 0x100a994
call esi
test eax, eax
pop ecx
pop ecx
je 0x10339fc
push edi
push 0x100a98c
call esi
test eax, eax
pop ecx
pop ecx
je 0x10339fc
push edi
push 0x100a984
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10339ff
mov byte [ebx], 0
pop edi
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1033a06
sub eax, edx
inc eax
push eax
push dword [ebp + 8]
xor esi, esi
inc esi
push esi
push 0
push 0x100a96c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1033a2f
mov dword [ebp - 8], esi
test ebx, ebx
je 0x1033a36
mov byte [ebx], 0x5c
cmp dword [ebp - 4], 0
pop ebx
je 0x1033a46
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret 4
Function at 0x1033a4e
Capabilities:
Get disk information
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x1099a38]
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov ecx, 0x410
mov dword [ebp - 4], eax
mov dword [ebp - 0x520], ecx
je 0x1033a87
mov eax, edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1033a7a
sub eax, esi
cmp eax, ecx
jae 0x1033a9a
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1033a8d
sub eax, esi
cmp eax, ecx
jb 0x1033aa1
xor eax, eax
jmp 0x1033c57
lea eax, [ebp - 0x51c]
push eax
push 2
push 0
push 0x100aa44
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1033c50
test edi, edi
lea edx, [ebp - 0x518]
je 0x1033ae0
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1033ad4
jmp 0x1033aef
mov eax, dword [ebp + 8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1033ae5
mov edi, dword [sym.imp.msvcrt.dll_strrchr]
lea eax, [ebp - 0x518]
push 0x5c
push eax
call edi
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1033b71
cmp byte [esi + 1], 0
jne 0x1033b20
lea eax, [ebp - 0x518]
push 0x5c
push eax
mov byte [esi], 0
call edi
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x1033b71
mov edi, dword [sym.imp.msvcrt.dll__strnicmp]
push 5
push 0x100aa3c
push esi
call edi
add esp, 0xc
test eax, eax
je 0x1033b6e
push 6
push 0x100aa34
push esi
call edi
add esp, 0xc
test eax, eax
je 0x1033b6e
push 6
push 0x100aa2c
push esi
call edi
add esp, 0xc
test eax, eax
je 0x1033b6e
push 5
push 0x100aa24
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x1033b71
mov byte [esi], 0
cmp byte [ebp - 0x518], 0x5c
jne 0x1033b87
cmp byte [ebp - 0x517], 0x5c
je 0x1033c12
push 1
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x107], 0x3a
mov byte [ebp - 0x106], 0x5c
mov byte [ebp - 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x1033c12
push dword [ebp - 0x520]
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
je 0x1033c08
lea eax, [ebp - 0x520]
push eax
push esi
push 1
lea eax, [ebp - 0x518]
push eax
call sub.MPR.dll_WNetGetUniversalNameA
test eax, eax
jne 0x1033c12
mov ecx, dword [esi]
lea edx, [ebp - 0x518]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x1033bfc
jmp 0x1033c12
push 0x100a9ec
call fcn.01071aad
lea eax, [ebp - 0x518]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1033c1b
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x518]
push eax
push 1
push 0
push 0x100a9d4
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x51c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0106bc50
leave
ret 8
Function at 0x1033d05
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
cmp byte [0x10c6040], 0
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
je 0x1033d68
push esi
mov esi, dword [0x10c5bb8]
jmp 0x1033d63
mov eax, dword [esi + 0x10]
test al, 4
je 0x1033d61
and eax, 0xfffffffb
mov dword [esi + 0x10], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [esi + 0x17c]
push eax
push 0x10c6040
call fcn.01070fc9
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [esi]
test esi, esi
jne 0x1033d2a
pop esi
mov ecx, dword [ebp - 4]
call fcn.0106bc50
leave
ret 4
Function at 0x10342ca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, 0x104
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x1034303
push 0x100ac60
mov dword [ebp - 8], 8
call fcn.01071aad
jmp 0x10343b6
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x100ac48
push dword [ebp + 8]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
test eax, eax
je 0x10343ac
push ebx
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextA]
test eax, eax
je 0x10343ac
push esi
mov esi, 0x1106960
push 0xfffa
push esi
push dword [ebp - 4]
mov byte [0x1106960], bl
push 0x10c64c0
mov byte [0x10f6960], bl
call fcn.01070fc9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1034386
push esi
push 0x100ac38
push 0x10f6960
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push ebx
push 1
push 0x10f6960
call fcn.01070db7
lea eax, [ebp - 0x18]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
test eax, eax
je 0x10343ab
push ebx
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextA]
test eax, eax
jne 0x103433a
pop esi
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
xor eax, eax
cmp dword [ebp - 8], ebx
pop edi
sete al
pop ebx
leave
ret 4

Function at 0x10343c4
Capabilities:
Parse pe header

Disassembly:
push 0x20
push 0x100acd0
call fcn.0106bf63
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0106e19f
test eax, eax
je 0x1034432
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
cmp word [ecx], 0x5a4d
jne 0x1034413
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x30], eax
cmp dword [eax], 0x4550
jne 0x1034413
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
jmp 0x1034427
push ecx
push dword [ebp - 0x24]
call fcn.010718f1
jmp 0x1034445
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100ac94
call fcn.01071ac0
pop ecx
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.0106bf9e
ret 4
Function at 0x1034450
Capabilities:
Pause service
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1099a38]
push ebx
push esi
mov esi, dword [0x109a08c]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], ebx
jne 0x1034487
xor eax, eax
jmp 0x10346bf
cmp dword [ebp + 0xc], ebx
push edi
je 0x10344a7
cmp dword [0x10bcec0], ebx
je 0x10344c5
push 0x100ad18
call fcn.01071aad
cmp dword [0x10bcec0], ebx
je 0x10344c5
push 0xfffa
mov edi, 0x1106960
push edi
push 0xf0b0
push ebx
call fcn.01031fb1
push 0x12
push edi
call fcn.01046c95
push 8
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x218], eax
jne 0x10344f5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x100ace8
call fcn.01071ac0
pop ecx
pop ecx
call esi
jmp 0x10346be
mov ebx, dword [sym.imp.msvcrt.dll_sprintf]
mov edi, 0x10bd980
cmp dword [esi + 0xc], 0
je 0x1034526
push 0
push dword [esi + 0x10]
push dword [esi]
push dword [ebp - 0x218]
call fcn.01074a4e
test eax, eax
mov dword [ebp - 0x214], eax
jne 0x10346be
cmp dword [ebp + 0xc], 0
je 0x1034539
cmp dword [0x10bcec0], 0
je 0x103469a
cmp dword [esi + 8], 1
je 0x103469a
push 0xe0000000
push dword [esi]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0x208
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push 0xf0b1
push 0
call fcn.010312a2
push dword [esi + 4]
lea eax, [ebp - 0x20c]
push eax
push 0x1106960
call ebx
add esp, 0xc
push 0x1106960
call fcn.01045583
cmp dword [ebp - 0x210], 0
je 0x103469a
push 0
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x10345b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10bf564]
lea eax, [ebp - 0x23c]
push 4
push eax
push dword [ebp - 0x210]
call fcn.01074953
cmp dword [ebp - 0x238], 4
mov dword [ebp - 0x214], eax
jne 0x10345f3
and dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
jne 0x1034673
push 0x1388
push edi
push 0xf060
push 0
call fcn.010312a2
push dword [esi + 4]
push edi
push 0x10bfce0
call ebx
add esp, 0xc
push 0x1388
push edi
push 0xf00f
push 0
call fcn.010312a2
push 0x10bfce0
call fcn.01071aad
push dword [ebp - 0x214]
push 0x100acdc
push 0x1116960
call ebx
add esp, 0xc
push 0x1116960
call fcn.01071aad
cmp dword [0x109ab70], 0
jne 0x1034673
push 0
push edi
push 0x10bfce0
push dword [ebp - 0x220]
call fcn.0107473f
cmp dword [esi + 8], 7
jne 0x103468e
lea eax, [ebp - 0x23c]
push eax
push 2
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esi + 0x18]
push 1
call fcn.01046c4d
test esi, esi
jne 0x1034500
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x214]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0106bc50
leave
ret 8
Function at 0x103499d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1099a38]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 0x100ae4c
push SysStringLen
mov dword [ebp - 0x5c], 0x4f
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x100ae40
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x54]
push eax
push 0x100ae38
mov byte [ebp - 5], 0
call esi
test eax, eax
jne 0x1034a0d
mov al, 1
jmp 0x1034a22
lea eax, [ebp - 0x54]
push eax
push 0x100ae2c
call esi
test eax, eax
setne al
dec al
and eax, 2
mov ecx, dword [ebp - 4]
pop esi
call fcn.0106bc50
leave
ret
Function at 0x1034a2d
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x1099a38]
push ebx
push esi
push edi
push 0x40
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x13c], bl
lea edi, [ebp - 0x13b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xd
pop ecx
lea eax, [ebp - 0x2dc]
mov esi, 0x100af40
lea edi, [ebp - 0x38]
push eax
mov dword [ebp - 0x2f0], 0x104
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2ec], 0x1000
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2dc], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1034ae9
mov esi, dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x2c8]
push eax
mov edi, 0x100af08
lea eax, [ebp - 0x240]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x2e0]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x38]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x1034af8
push eax
push 0x100aedc
call fcn.01071ac0
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret
push 0x1001
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x2e4], eax
jne 0x1034b1d
push 0x100aea4
call fcn.01071aad
jmp 0x1034ba9
lea ecx, [ebp - 0x2f8]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2ec]
push ecx
push eax
push ebx
jmp 0x1034b7a
push 0x10f55e0
push dword [ebp - 0x2e4]
call dword [sym.imp.msvcrt.dll_strstr]
test eax, eax
pop ecx
pop ecx
jne 0x1034c32
inc dword [ebp - 0x2e8]
lea eax, [ebp - 0x2f8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2ec]
push eax
push dword [ebp - 0x2e4]
mov dword [ebp - 0x2ec], 0x1000
push dword [ebp - 0x2e8]
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1034b32
push 0x10f55e0
lea eax, [ebp - 0x240]
push edi
push eax
call esi
add esp, 0xc
push dword [ebp - 0x2e4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2e0]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x240]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1034ae9
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
push ebx
push 0x100ae94
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x13c]
push 0x100ae7c
push eax
call dword [sym.imp.msvcrt.dll__mbslwr]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_strstr]
cmp eax, ebx
pop ecx
pop ecx
je 0x1034c1f
mov byte [eax], bl
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.msvcrt.dll__strdup]
pop ecx
jmp 0x1034aeb
push dword [ebp - 0x2e4]
jmp 0x1034b8f
Function at 0x1034ccb
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x10c5bb8]
test ebx, ebx
je 0x1034d3a
push esi
push edi
mov esi, dword [ebx + 0x60]
jmp 0x1034d2e
mov ecx, dword [esi + 0xc]
mov eax, 0x20100
and ecx, eax
cmp ecx, eax
jne 0x1034d2c
push esi
call fcn.01042c4f
cmp eax, 2
jne 0x1034d2c
push 0x80
lea edi, [esi + 0x78]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp + 8]
push edi
call fcn.0107c243
test eax, eax
jne 0x1034d2c
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100b0d4
call fcn.01071ac0
add esp, 0xc
mov esi, dword [esi]
test esi, esi
jne 0x1034ce2
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1034cdd
pop edi
pop esi
xor eax, eax
inc eax
pop ebx
pop ebp
ret 4

Function at 0x1034f31
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1034f6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1034f66
cmp eax, 2
je 0x1034f66
push 4
push 0
push dword [ebp + 8]
inc esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x1034f69
xor eax, eax
inc eax
test eax, eax
je 0x1034f76
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1034f76
mov dword [ecx], esi
pop esi
pop ebp
ret 8