joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f5a0
Capabilities:
Modify service

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x1000f6ab
mov eax, dword [esp + 0x10]
push esi
push 2
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x1000f5e1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
push str.DISABLED
push ebp
call ebx
add esp, 8
test eax, eax
jne 0x1000f61d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop esi
pop edi
pop ebp
pop ecx
ret
push str.AUTOMATIC
push ebp
call ebx
add esp, 8
test eax, eax
jne 0x1000f652
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop esi
pop edi
pop ebp
pop ecx
ret
push str.MANUAL
push ebp
call ebx
add esp, 8
test eax, eax
jne 0x1000f687
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop esi
pop edi
pop ebp
pop ecx
ret
lea ecx, [esp + 0x10]
push ecx
push 3
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop esi
pop edi
pop ebp
pop ecx
ret
Function at 0x1000f6b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x25c
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x258], eax
push esi
push 0x1f3
lea eax, [esp + 0x6d]
push 0
push eax
mov byte [esp + 0x74], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea esi, [esp + 0x68]
call fcn.1000c340
push 0x104
mov ecx, esi
push ecx
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov eax, esi
dec eax
pop esi
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f700
mov ecx, dword [str.StartWebProt.ini]
mov edx, dword [0x1001e1cc]
mov dword [eax], ecx
mov ecx, dword [0x1001e1d0]
mov dword [eax + 4], edx
mov edx, dword [0x1001e1d4]
mov dword [eax + 8], ecx
mov cx, word [0x1001e1d8]
mov dword [eax + 0xc], edx
push 0x63
lea edx, [esp + 5]
push 0
push edx
mov word [eax + 0x10], cx
mov byte [esp + 0xc], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x64]
push eax
push 0x64
lea ecx, [esp + 8]
push ecx
push str.NPAV
push str.spread
push str.data2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp]
push str.NPAV
push edx
call dword [sym.imp.MSVCR90.dll__stricmp]
mov ecx, dword [esp + 0x260]
add esp, 8
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.100195d2
add esp, 0x25c
ret

Function at 0x1000f7a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x16c
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x168], eax
push 0x103
lea eax, [esp + 0x69]
push 0
push eax
mov byte [esp + 0x70], 0
call sub.MSVCR90.dll_memset
lea ecx, [esp + 0x70]
push ecx
call fcn.10007090
lea eax, [esp + 0x74]
add esp, 0x10
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f7e0
mov edx, dword [str.LaunchMgr.ini]
mov ecx, dword [0x1001b908]
mov dword [eax], edx
mov edx, dword [0x1001b90c]
mov dword [eax + 4], ecx
mov cx, word [0x1001b910]
mov dword [eax + 8], edx
push 0x63
lea edx, [esp + 5]
push 0
push edx
mov word [eax + 0xc], cx
mov byte [esp + 0xc], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x64]
push eax
push 0x64
lea ecx, [esp + 8]
push ecx
push str.NPAV
push str.installed
push str.WEBPROT2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp]
push str.TRUE
push edx
call dword [sym.imp.MSVCR90.dll__stricmp]
mov ecx, dword [esp + 0x170]
add esp, 8
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.100195d2
add esp, 0x16c
ret
Function at 0x1000f970
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x1000f991
pop edi
add esp, 0x1c
ret
mov eax, dword [esp + 0x24]
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x1000f9b8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
xor eax, eax
lea ecx, [esp + 8]
push ecx
push 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1000fa14
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret

Function at 0x1000fde0
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ecx
mov eax, str.ZeroVProtect
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000fdf0
sub eax, edx
jne 0x1000fdfd
pop ecx
ret
push edi
push 6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x1000fe75
mov eax, dword [esp + 0xc]
push esi
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push pe_nt_image_headers32
push 0xf01ff
push str.Zero_V_AntiVirus_Protection
push str.ZeroVProtect
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x1000fe65
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
pop ecx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, 1
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x1000ff20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call sub.MSVCR90.dll_memset
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call sub.MSVCR90.dll_memset
lea edx, [esp + 0x18]
push edx
call fcn.10007090
lea eax, [esp + 0x1c]
add esp, 0x1c
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000ff78
mov ecx, dword [str.PVCN.ini]
mov edx, dword [0x1001e2b4]
mov dword [eax], ecx
mov cl, byte [0x1001e2b8]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
cmp byte [esp], 0
je 0x1000ffe1
lea edx, [esp]
push edx
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0x1001cc54
push str.webtrackp
push str.Status
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x104]
push 0x1001e2c8
push ecx
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.100195d2
add esp, 0x20c
ret

Function at 0x10012040
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10022b00
push 0x104
lea ecx, [esp + 8]
push ecx
push str.NPAV
push str.installed
push str.ConLogger
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp]
push str.TRUE
push edx
call dword [sym.imp.MSVCR90.dll__stricmp]
mov ecx, dword [esp + 0x10c]
add esp, 8
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.100195d2
add esp, 0x108
ret

Function at 0x100120c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x1f8
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x1f4], eax
push esi
push 0x1f3
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea esi, [esp + 4]
call fcn.1000c340
push str.LANMONNP2120CL.EXE
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
mov edx, esi
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x1f8]
pop esi
xor ecx, esp
call fcn.100195d2
add esp, 0x1f8
ret
Function at 0x10012540
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x10022b00]
mov byte [esp + eax], cl
inc eax
test cl, cl
jne 0x10012570
lea ecx, [esp]
push 0x5c
push ecx
call dword [sym.imp.MSVCR90.dll_strrchr]
add esp, 8
test eax, eax
je 0x100125da
mov byte [eax], 0
lea eax, [esp]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10012598
mov edx, dword [str.emlscn.ini]
mov ecx, dword [0x1001e4d4]
mov dword [eax], edx
mov edx, dword [0x1001e4d8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp]
push eax
push 0x64
push 0x10023888
push str.NPAV
push 0x1001e4dc
push str.USID
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100195d2
add esp, 0x108
ret

Function at 0x10012e20
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows

Disassembly:
push esi
push str.GlobalMTX_NP2178NI
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
test esi, esi
jne 0x10012e71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10012e71
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10012e78
push esi
push esi
push esi
push edi
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esi + 1]
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x10012e80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x548
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x540], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x25]
push ebx
push eax
mov byte [esp + 0x2c], bl
call sub.MSVCR90.dll_memset
push 0x103
lea ecx, [esp + 0x139]
push ebx
push ecx
mov byte [esp + 0x140], bl
call sub.MSVCR90.dll_memset
push 0x103
lea edx, [esp + 0x355]
push ebx
push edx
mov byte [esp + 0x35c], bl
call sub.MSVCR90.dll_memset
push 0x103
lea eax, [esp + 0x259]
push ebx
push eax
mov byte [esp + 0x260], bl
call sub.MSVCR90.dll_memset
xor ecx, ecx
add esp, 0x30
xor eax, eax
mov word [esp + 0x10], cx
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov word [esp + 0x1e], ax
jmp 0x10012f20
mov cl, byte [eax + 0x10022b00]
mov byte [esp + eax + 0x20], cl
inc eax
cmp cl, bl
jne 0x10012f20
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, dword [sym.imp.MSVCR90.dll__stricmp]
cmp byte [esp + 0x20], bl
je 0x10013043
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x20]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x10012f55
mov ecx, dword [str.NP2178NI.INI]
mov edx, dword [0x1001e58c]
mov dword [eax], ecx
mov ecx, dword [0x1001e590]
mov dword [eax + 4], edx
mov dx, word [0x1001e594]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x20]
push eax
push 0x104
lea ecx, [esp + 0x130]
push ecx
push str.TRUE
push str.VCRED
push str.AppData
call esi
lea edx, [esp + 0x128]
push str.FALSE
push edx
call edi
add esp, 8
test eax, eax
jne 0x10013043
lea eax, [esp + 0x20]
push eax
push 0x104
lea ecx, [esp + 0x238]
push ecx
push str.NPAV
push str.retrydate
push str.AppData
call esi
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x10]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0x16]
push eax
push ecx
push edx
lea eax, [esp + 0x344]
push str._02d__02d__04d
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea ecx, [esp + 0x34c]
push ecx
lea edx, [esp + 0x248]
push edx
call edi
add esp, 0x1c
test eax, eax
jne 0x10013043
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x540]
xor ecx, esp
call fcn.100195d2
add esp, 0x548
ret
push 0x103
lea eax, [esp + 0x445]
push ebx
push eax
mov byte [esp + 0x44c], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10022b00
push 0x104
lea ecx, [esp + 0x448]
push ecx
push str.NPAV
push str.installed
push str.NpdScan
call esi
lea edx, [esp + 0x440]
push str.TRUE
push edx
call edi
mov ecx, dword [esp + 0x554]
add esp, 8
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.100195d2
add esp, 0x548
ret
Function at 0x100130c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, edi
mov esi, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100130e8
sub eax, edx
cmp eax, 0xc
jne 0x10013241
cmp byte [edi + 1], 0x2d
jne 0x10013241
push ebp
push edi
call dword [sym.imp.MSVCR90.dll__strupr]
add esp, 4
push esi
push ebx
push str.LENGTH
add edi, 2
push str.SHELL
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
lea eax, [ebp - 1]
cmp eax, 9
ja 0x1001322c
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push 0xa
lea ecx, [esp + 0x28]
push ecx
xor eax, eax
push 0x1001d248
push str.STARTX
push str.SHELL
mov byte [esp + 0x38], bl
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov byte [esp + 0x41], al
mov byte [esp + 0x44], bl
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov byte [esp + 0x4d], al
call edi
push esi
push 0xa
lea edx, [esp + 0x34]
push edx
push 0x1001d248
push str.ENDX
push str.SHELL
call edi
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10013197
sub eax, edx
cmp eax, ebp
jne 0x1001322c
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100131b0
sub eax, edx
cmp eax, ebp
jne 0x1001322c
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.MSVCR90.dll_sscanf]
lea ecx, [esp + 0x10]
push ecx
push 0x1001e5e4
push eax
mov byte [eax + ebp], bl
call esi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push 0x1001e5e4
push eax
call esi
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x48]
push 0x1001e5e4
push edx
call esi
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
add esp, 0x24
cmp ecx, eax
jb 0x1001322c
mov edx, dword [esp + 0x10]
cmp edx, eax
jb 0x1001322c
cmp edx, ecx
ja 0x1001322c
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100195d2
add esp, 0x2c
ret
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100195d2
add esp, 0x2c
ret
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100195d2
add esp, 0x2c
ret
Function at 0x10014550
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x230
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x13d]
push 0
push eax
mov byte [esp + 0x144], 0
call sub.MSVCR90.dll_memset
xor eax, eax
add esp, 0xc
push 0x10022d10
push eax
push str.count
push str.RESTART_EXES
mov byte [esp + 0x20], 0
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
mov ebp, eax
mov edi, 1
cmp ebp, edi
jl 0x10014628
push edi
lea ecx, [esp + 0x14]
push 0x1001c394
push ecx
call ebx
add esp, 0xc
push 0x10022d10
push 0x104
lea edx, [esp + 0x140]
push edx
push str.NPAV
lea eax, [esp + 0x20]
push eax
push str.RESTART_EXES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [esp + 0x138]
call fcn.1000dd90
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, ebp
jle 0x100145d5
push 0x103
lea ecx, [esp + 0x39]
push 0
push ecx
mov byte [esp + 0x40], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10022d10
push 0
push str.count
push str.RESTART_SERVICE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
mov esi, 1
cmp edi, esi
jl 0x100146bd
push esi
lea edx, [esp + 0x14]
push 0x1001c394
push edx
call ebx
add esp, 0xc
push 0x10022d10
push 0x104
lea eax, [esp + 0x3c]
push eax
push str.NPAV
lea ecx, [esp + 0x20]
push ecx
push str.RESTART_SERVICE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x34]
push edx
call fcn.1000f970
add esp, 4
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x34]
call fcn.10008660
inc esi
cmp esi, edi
jle 0x10014663
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100195d2
add esp, 0x230
ret
Function at 0x10015b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x10016921
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.100146ff
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x10015b9b
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x10015be4
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x10015b8e
call fcn.1001478e
cwde
mov dl, 0x27
das
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1001478e
stosb byte es:[edi], al
test byte [ebp - 0x2b7a7209], bh
clc
invalid
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10016950
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1001478e
add eax, 0x8b62adc6
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1001478e
stc
cmp byte [edi + 2], 0x49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x1001697b
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1001697b
call fcn.1001478e
cmp byte [edx + ebx*4 + 0x245a8b63], 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.1001478e
mov bh, byte [edi + 0x75ffc052]
or bh, bh
jne 0x100169c4
push dword [ebp]
call fcn.10014f8e
add byte [eax], al
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
test eax, eax
je 0x100169de
invalid
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x100195d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022018]
jne 0x100195dc
repz ret
jmp fcn.10019ac2
Function at 0x402a36
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423f50]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402aca
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a87
cmp dword [ebp + 0x10], ebx
jne 0x402abe
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a36
test eax, eax
jne 0x402a99
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a6e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405e88
cmp eax, ebx
je 0x402ad1
push ebx
push dword [0x423f50]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402aca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x423f50], ebx
jne 0x402ac7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ac7
jmp 0x402aca
Function at 0x402f18
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f45
mov ecx, dword [0x423ef8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x417044], eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403043
cmp eax, edi
jl 0x40303c
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409018]
call ebx
test eax, eax
je 0x403039
cmp dword [ebp - 4], esi
jne 0x403039
push dword [ebp + 8]
add dword [0x417044], esi
call fcn.00403043
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x40303c
cmp dword [ebp + 0x10], edi
jne 0x403008
cmp dword [ebp + 8], edi
jle 0x403034
mov esi, 0x413040
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fb8
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409018]
call ebx
test eax, eax
je 0x403039
cmp edi, dword [ebp - 4]
jne 0x403039
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403004
cmp dword [ebp + 0x14], edi
jne 0x403004
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417044], eax
cmp dword [ebp + 8], 0
jg 0x402fab
jmp 0x403034
push 0xfffffffffffffffe
jmp 0x40303b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403013
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409018]
call ebx
test eax, eax
je 0x403039
mov eax, dword [ebp - 4]
add dword [0x417044], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40303c
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10