joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c520
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100bead8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x1007c552
call fcn.1004bf80
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x1007c563
mov ecx, 0x80000000
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x1007c5b8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1007c59e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x1007c6e4
cmp dword [esp + 0x18], ebx
jne 0x1007c5b8
cmp dword [esp + 0x14], ebx
je 0x1007c6e4
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x1007c5c9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.1003cfa0
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1007c60f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x1007c60f
call fcn.1006c580
test eax, eax
je 0x1007c60f
push str.Global_
lea ecx, [esp + 0x14]
call fcn.1003dc20
push ebx
lea ecx, [esp + 0x14]
call fcn.1003e650
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x1007c6be
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x1007c64b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1007c6be
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x1007c699
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1007c69c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x1007c694
mov dword [esi + 0x10], ebx
jmp 0x1007c69c
mov dword [esi + 0x10], ecx
jmp 0x1007c69c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.1003d9a0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.1003d9a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1007cc62
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push 0x80000000
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1007ccf2
cmp eax, ebx
je 0x1007ccf2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1007ccfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1007cea5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1007cff7
xor edx, edx
cmp eax, edx
je 0x1007cff7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x1007ceda
cmp eax, ecx
jb 0x1007ceda
xor ecx, ecx
jmp 0x1007cedf
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x1007cef9
jg 0x1007cff7
cmp eax, dword [esi + 8]
ja 0x1007cff7
cmp ecx, edx
jne 0x1007cf13
cmp eax, dword [esi + 0x42c]
ja 0x1007cf13
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x1007cf58
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x1007cf33
cmp edi, edx
jb 0x1007cf33
xor edx, edx
jmp 0x1007cf38
mov edx, 1
cmp ecx, ebx
ja 0x1007cf58
cmp dword [esp + 0x14], edx
jg 0x1007cf58
jl 0x1007cf48
cmp eax, edi
ja 0x1007cf58
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.1007d010
test eax, eax
je 0x1007cff7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x1007cfa6
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7fffffff
push ecx
call edi
cmp eax, 0xffffffff
je 0x1007cfe7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x1007cfe7
jmp 0x1007cfb6
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1007cfe7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007cfe7
cmp dword [edi], ebp
jne 0x1007cfe7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x1007d700
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100bee48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x100c1a60
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x1007d741
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.100432d0
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.100432d0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.1003d9a0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.1003d9a0
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.1003d9a0
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.1003d9a0
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.1003d9a0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.1003d9a0
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.1003d9a0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1007eda0
Capabilities:
Delete service

Disassembly:
sub esp, 0x20
push edi
call fcn.1006c4b0
test eax, eax
je 0x1007edbe
mov dword [0x100fadec], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x1007edd9
mov dword [0x100fadec], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
push esi
push 0xf003f
push edi
push edi
mov dword [0x100fadec], edi
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x1007ee0e
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x1007ee16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp esi, edi
je 0x1007ee3b
mov eax, dword [esp + 0x34]
push 0xf01ff
push eax
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x1007ee8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x1007eea8
jne 0x1007ee8e
test esi, esi
jne 0x1007ee73
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x1007ee67
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x1007ee6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x1007ee8e
mov ecx, dword [esp + 0x34]
push 0xf01ff
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x1007ee8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, eax
test ebp, ebp
jne 0x1007eecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100fadec], eax
jmp 0x1007eeac
mov ebp, dword [esp + 0x10]
mov eax, dword [0x100fadec]
test eax, eax
jne 0x1007eecc
test ebx, ebx
je 0x1007eec1
mov dword [0x100fadec], ebx
jmp 0x1007eecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100fadec], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1007eed9
push edi
call ebx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1007eee8
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test esi, esi
je 0x1007eeef
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x1007ef00
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.1006c4b0
test eax, eax
je 0x1007ef1e
mov dword [0x100fadec], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x1007ef39
mov dword [0x100fadec], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push esi
push 2
push edi
push edi
mov dword [0x100fadec], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x1007ef68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
je 0x1007ef8a
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1007efc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x1007efff
jne 0x1007efc8
test esi, esi
jne 0x1007efae
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x1007efae
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x1007efc8
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1007efc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
jne 0x1007f01f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x100fadec], eax
jne 0x1007f008
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x1007f01f
mov eax, dword [0x100fadec]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x1007f01f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1007f01a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100fadec], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1007f02c
push edi
call ebx
test esi, esi
je 0x1007f033
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x1007f240
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.1006c4b0
test eax, eax
je 0x1007f25c
mov dword [0x100fadec], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x100fadec], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebp
jne 0x1007f29b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x1007f2b9
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x1007f2f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x1007f30f
jne 0x1007f2f3
test esi, esi
jne 0x1007f2dd
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1007f2dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x1007f2f3
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x1007f2f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x1007f32c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1007f313
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x1007f31f
mov dword [0x100fadec], ebx
jmp 0x1007f336
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100fadec], eax
jmp 0x1007f336
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1007f343
push edi
call ebx
test esi, esi
je 0x1007f34a
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1007fc10
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x100bef9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.100432c0
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x1007fc57
push eax
lea ecx, [esp + 0x18]
call fcn.10043510
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x1007fc6c
push eax
lea ecx, [esp + 0x18]
call fcn.10043510
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x1007fcd7
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.10036f80
add esp, 0x10
test eax, eax
jne 0x1007fcd0
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.100432d0
xor eax, eax
jmp 0x1007fda5
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x1007fd8e
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x1007fd8e
test esi, esi
je 0x1007fd8e
call fcn.10029990
mov eax, dword [0x100f37e4]
test eax, eax
je 0x1007fd8e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.100345c0
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x100f37e4]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.100432d0
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x100805e0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x100805fd
cmp edi, 4
jbe 0x100805fd
mov dword [0x100fadf0], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x1008061c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.100499c0
cmp edi, 0xffffffff
je 0x10080630
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.100499c0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x10080648
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.100499c0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1008065e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.10049b70
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10080675
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.10049b70
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1008069d
push edi
call fcn.1004e37e
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100806b4
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.10049b70
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100806cb
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.1004a000
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100806e1
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.1004a000
pop esi
pop ebx
mov eax, 1
pop edi
ret

Function at 0x10081590
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100bf1a8
push eax
mov dword fs:[0], esp
sub esp, 8
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x100815c3
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
call fcn.1004e37e
add esp, 4
test eax, eax
jne 0x100815e0
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
lea ecx, [esp + 8]
xor esi, esi
call fcn.10048730
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push 0x80000002
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], esi
call fcn.100488a0
test eax, eax
je 0x10081626
push edi
lea ecx, [esp + 0xc]
call fcn.1004abe0
lea ecx, [esp + 8]
mov esi, eax
call fcn.100488f0
test esi, esi
jne 0x10081659
mov ecx, dword [str.SystemCurrentControlSetServicesVxD]
push 0x2001f
push ecx
push 0x80000002
lea ecx, [esp + 0x14]
call fcn.100488a0
test eax, eax
je 0x10081659
push edi
lea ecx, [esp + 0xc]
call fcn.1004abe0
lea ecx, [esp + 8]
mov esi, eax
call fcn.100488f0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.10048820
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10081680
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100bf1e0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x100816b3
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x100816cb
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.10048730
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push 0x80000002
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.100488a0
test eax, eax
je 0x10081777
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.1004ada0
test eax, eax
jne 0x1008172c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10048820
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x1008175f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.10048ed0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.1003db30
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.1003d9a0
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1008183e
mov dword [eax], 0x10
jmp 0x1008183e
mov edx, dword [0x100c08b8]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x100e22d0
push ecx
mov byte [esp + 0x24], 2
call fcn.10040920
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push 0x80000002
call fcn.100488a0
test eax, eax
jne 0x100817eb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.1003d9a0
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10048820
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x10081822
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10048ed0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.1003db30
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.1003d9a0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10081830
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.1003d9a0
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10048820
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10081870
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100bf208
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x10081981
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x10081981
cmp word [edi], bx
je 0x10081981
cmp word [esi], bx
je 0x10081981
lea ecx, [esp + 0xc]
call fcn.10048730
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1008191f
cmp eax, 1
je 0x1008191f
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.100488a0
test eax, eax
jne 0x1008190d
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.10048910
test eax, eax
je 0x10081970
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.10049b70
mov esi, eax
jmp 0x10081a06
mov edx, dword [0x100c08b8]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x100e22d0
push ecx
mov byte [esp + 0x2c], 1
call fcn.10040920
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push 0x80000002
call fcn.100488a0
test eax, eax
jne 0x10081995
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.1003d9a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10048820
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x100c08b8]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.1004e33e
add esp, 8
cmp eax, ebx
je 0x100819bf
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.1003dc20
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x100819d8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.1003d9a0
jmp 0x10081963
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.10049b70
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.1003d9a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.1003d9a0
lea ecx, [esp + 0xc]
call fcn.100488f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10048820
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret