joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2103c44d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x2103c462
jmp 0x2103c4e8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x406
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0x404
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edx, dword [ebp + 8]
push edx
push 0x402
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp + 8], 0
jne 0x2103c4cf
cmp dword [ebp + 0xc], 0
jne 0x2103c4cf
cmp dword [ebp + 0x10], 0
jne 0x2103c4cf
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x2103c4de
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x2103c4ee
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x2103c500
jmp 0x2103c550
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x406
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp + 8], 0
jne 0x2103c537
cmp dword [ebp + 0xc], 0
jne 0x2103c537
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x2103c546
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 1
mov esp, ebp
pop ebp
ret 8

Function at 0x2103c794
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
je 0x2103c7b7
jmp 0x2103c7f8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], 0
push 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov esp, ebp
pop ebp
ret 8
Function at 0x2104065d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 0x114], ecx
cmp dword [ebp + 8], 0
je 0x21040678
mov eax, dword [ebp + 8]
mov byte [eax], 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push str.ProfileImagePath
mov ecx, dword [ebp - 0x114]
call fcn.2104244a
test eax, eax
jne 0x2104069d
xor eax, eax
jmp 0x2104076b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
je 0x210406dc
cmp dword [ebp - 0x118], 2
je 0x210406bd
jmp 0x21040769
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x110]
mov dword [ebp - 8], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push str.ntuser.dat
mov edx, dword [ebp - 8]
push edx
call fcn.210134f1
push 0
push 0xffffffffffffffff
push 0x5c
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 4]
push ecx
call fcn.210314b4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x21040722
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
jmp 0x2104072b
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x21040741
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.210537b0
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
jne 0x21040769
mov eax, dword [ebp - 0xc]
push eax
call fcn.21053c40
add esp, 4
jmp 0x2104076b
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x21041673
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
jne 0x21041689
xor eax, eax
jmp 0x210416dd
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.2104244a
test eax, eax
jne 0x210416a9
xor eax, eax
jmp 0x210416dd
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x210416d0
xor eax, eax
jmp 0x210416dd
mov ecx, dword [ebp - 0x10]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x21041857
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x2104186b
xor eax, eax
jmp 0x21041891
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x21041884
xor eax, eax
jmp 0x21041891
mov ecx, dword [ebp - 4]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x21041ace
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x21041afe
xor eax, eax
jmp 0x21041b0d
cmp dword [ebp - 4], 3
je 0x21041b08
xor eax, eax
jmp 0x21041b0d
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x21041cc3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x21041cef
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x24], 0
je 0x21041cef
cmp dword [ebp + 8], 0
jl 0x21041cef
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x10]
jl 0x21041cf3
xor eax, eax
jmp 0x21041d2e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x21041d28
xor eax, eax
jmp 0x21041d2e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
mov esp, ebp
pop ebp
ret 4

Function at 0x21041d34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
je 0x21041d4c
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0x14], 0
je 0x21041d5b
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
je 0x21041d87
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x28], 0
je 0x21041d87
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x2c], 0
je 0x21041d87
cmp dword [ebp + 8], 0
jl 0x21041d87
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x18]
jl 0x21041d8b
xor eax, eax
jmp 0x21041e05
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x21041dd2
xor eax, eax
jmp 0x21041e05
cmp dword [ebp + 0xc], 0
je 0x21041de3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
mov dword [eax], edx
cmp dword [ebp + 0x10], 0
je 0x21041df1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
cmp dword [ebp + 0x14], 0
je 0x21041dff
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x28]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x21041e0b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
jne 0x21041e24
xor eax, eax
jmp 0x21041f8d
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x21041e5c
xor eax, eax
jmp 0x21041f8d
mov edx, dword [ebp - 4]
lea eax, [edx + edx + 1]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + ecx + 1]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
lea ecx, [eax + eax + 1]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x14]
jbe 0x21041ee2
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.210636ec
add esp, 4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.210636c3
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x24], eax
cmp dword [ebp - 0x1c], 0
jne 0x21041ee2
mov ecx, dword [ebp - 0x30]
call fcn.210419da
xor eax, eax
jmp 0x21041f8d
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x1c]
jbe 0x21041f35
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.210636ec
add esp, 4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.210636c3
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x28], ecx
cmp dword [ebp - 0x24], 0
jne 0x21041f35
mov ecx, dword [ebp - 0x30]
call fcn.210419da
xor eax, eax
jmp 0x21041f8d
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0x20]
jbe 0x21041f88
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.210636ec
add esp, 4
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x20], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.210636c3
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ecx + 0x2c], edx
cmp dword [ebp - 0x2c], 0
jne 0x21041f88
mov ecx, dword [ebp - 0x30]
call fcn.210419da
xor eax, eax
jmp 0x21041f8d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x210423ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0
je 0x210423d2
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x2c], 0
jne 0x210423d6
xor eax, eax
jmp 0x21042444
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x21042403
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
xor eax, eax
jmp 0x21042444
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 1
je 0x21042417
cmp dword [ebp - 0x10], 2
je 0x21042419
jmp 0x2104242e
jmp 0x21042438
cmp dword [ebp + 0x14], 0
je 0x2104242c
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.2104e8ba
jmp 0x21042438
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
xor eax, eax
jmp 0x21042444
mov eax, dword [ebp + 0xc]
push eax
call fcn.21053c40
add esp, 4
mov esp, ebp
pop ebp
ret 0x10

Function at 0x2104244a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0
je 0x21042462
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 0x10], 0
je 0x21042471
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp dword [ebp + 0x14], 0
je 0x21042480
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0
je 0x21042492
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x2c], 0
jne 0x21042496
xor eax, eax
jmp 0x210424fb
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2c]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x210424c9
xor eax, eax
jmp 0x210424fb
cmp dword [ebp + 0xc], 0
je 0x210424da
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov dword [edx], ecx
cmp dword [ebp + 0x10], 0
je 0x210424e8
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [edx], eax
cmp dword [ebp + 0x14], 0
je 0x210424f6
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2104296e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x21042982
xor eax, eax
jmp 0x210429b4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x210429a7
xor eax, eax
jmp 0x210429b4
mov ecx, dword [ebp - 4]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x210429ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x210429ce
xor eax, eax
jmp 0x21042a17
cmp dword [ebp + 8], 0
jne 0x210429db
mov dword [ebp + 8], 0x2108b81c
mov ecx, dword [ebp + 8]
push ecx
call fcn.21053c40
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x21042a0a
xor eax, eax
jmp 0x21042a17
mov ecx, dword [ebp - 4]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x21042a1d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x21042a31
xor eax, eax
jmp 0x21042a61
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x21042a54
xor eax, eax
jmp 0x21042a61
mov ecx, dword [ebp - 4]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x21042a67
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x21042a82
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.21041857
jmp 0x21042ad3
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
jne 0x21042a8f
xor eax, eax
jmp 0x21042ad3
cmp dword [ebp + 0x10], 0
jne 0x21042aa1
mov edx, dword [ebp + 0xc]
push edx
call fcn.2103055b
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x21042ac6
xor eax, eax
jmp 0x21042ad3
mov ecx, dword [ebp - 4]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x21042ad9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x21042af4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.21041857
jmp 0x21042b41
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
jne 0x21042b01
xor eax, eax
jmp 0x21042b41
mov edx, dword [ebp + 0xc]
push edx
call fcn.21053c40
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x21042b34
xor eax, eax
jmp 0x21042b41
mov ecx, dword [ebp - 4]
call fcn.21041e0b
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x210454f5
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0xc
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
jne 0x2104553b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x2104553b
push 0x210851c4
call fcn.210107ec
xor eax, eax
jmp 0x210455b8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call fcn.210636ec
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.210636c3
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
cmp dword [ebp - 0xc], 0
jne 0x2104557c
push str.could_not_allocate_service_list
call fcn.21010778
xor eax, eax
jmp 0x210455b8
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
push 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
jne 0x210455b3
push str.EnumDependentServices
call fcn.210107ec
xor eax, eax
jmp 0x210455b8
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x210455bc
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jne 0x210455d2
xor eax, eax
jmp 0x210455fe
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x210455f5
push 0x21085214
call fcn.210107ec
xor eax, eax
jmp 0x210455fe
xor eax, eax
cmp dword [ebp - 0x18], 4
sete al
mov esp, ebp
pop ebp
ret
Function at 0x21045795
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x7530
mov dword [ebp - 0x24], eax
cmp dword [0x2108b8c4], 0
je 0x210457c3
mov ecx, dword [0x2108b8c4]
call fcn.2103bfe5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x24]
jbe 0x210457ec
push 0x21085228
push str.MyStartService
push 0x2729
call fcn.210106a9
add esp, 0xc
xor eax, eax
jmp 0x21045875
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x2104580c
push str.QueryServiceStatus
call fcn.210107ec
xor eax, eax
jmp 0x21045875
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
je 0x21045820
cmp dword [ebp - 0x28], 4
je 0x21045842
jmp 0x21045854
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x21045840
push str.StartService
call fcn.210107ec
xor eax, eax
jmp 0x21045875
jmp 0x21045854
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x21045875
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x2108b8c4], 0
je 0x21045870
mov ecx, dword [0x2108b8c4]
call fcn.2103bfe5
jmp 0x210457c3
mov esp, ebp
pop ebp
ret 4

Function at 0x21045a22
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x21045a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x426
je 0x21045a50
jmp 0x21045a57
mov eax, 1
jmp 0x21045a82
push str.ControlService
call fcn.210107ec
xor eax, eax
jmp 0x21045a82
push 0x7530
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.21045ab6
test eax, eax
jne 0x21045a7d
xor eax, eax
jmp 0x21045a82
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x21045ab6
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x7530
mov dword [ebp - 0x28], eax
cmp dword [0x2108b8c4], 0
je 0x21045ae4
mov ecx, dword [0x2108b8c4]
call fcn.2103bfe5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x28]
jbe 0x21045b0a
push str.__timed_out_waiting_for_service
push str.WaitService
push 0x2729
call fcn.210106a9
add esp, 0xc
xor eax, eax
jmp 0x21045b5a
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x21045b1e
jmp 0x21045ae4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x21045b33
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x21045b49
cmp dword [0x2108b8c4], 0
je 0x21045b47
mov ecx, dword [0x2108b8c4]
call fcn.2103bfe5
jmp 0x21045ae4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x21046408
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x21046432
xor eax, eax
jmp 0x2104644f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
add eax, 2
mov esp, ebp
pop ebp
ret 8