joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e344f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x7fb710
call fcn.006d5b34
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x979de8], edi
jne 0x6e3493
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6e347e
mov dword [0x979de8], ebx
jmp 0x6e3493
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x6e3493
mov dword [0x979de8], 2
mov eax, dword [0x979de8]
cmp eax, ebx
jne 0x6e34b3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x6e3576
cmp eax, 2
je 0x6e34bc
cmp eax, edi
jne 0x6e34e4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x6e34cf
mov eax, dword [0x979d04]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x6e34eb
xor eax, eax
jmp 0x6e3576
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.006d05d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x6e351e
cmp esi, edi
jne 0x6e3534
push dword [ebp - 0x20]
call fcn.006d0da2
pop ecx
mov esi, eax
cmp esi, edi
je 0x6e34e4
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x6e3567
cmp dword [ebp + 0x14], edi
jne 0x6e3551
push edi
push edi
jmp 0x6e3557
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x6e3573
push esi
call fcn.006d0db4
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.006d5b6f
ret
Function at 0x6e357f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x7fb720
call fcn.006d5b34
xor esi, esi
cmp dword [0x979dec], esi
jne 0x6e35c3
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6e35ae
mov dword [0x979dec], edi
jmp 0x6e35c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x6e35c3
mov dword [0x979dec], 2
mov eax, dword [0x979dec]
cmp eax, 2
je 0x6e36a4
cmp eax, esi
je 0x6e36a4
cmp eax, 1
jne 0x6e3608
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x6e35f1
mov eax, dword [0x979d04]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x6e360f
xor eax, eax
jmp 0x6e36b6
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.006d05d0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x6e3645
cmp edi, esi
jne 0x6e3660
lea eax, [ebx + ebx]
push eax
call fcn.006d0da2
pop ecx
mov edi, eax
cmp edi, esi
je 0x6e3608
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6e3693
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x6e367d
push esi
push esi
jmp 0x6e3683
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x6e369f
push edi
call fcn.006d0db4
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x6e36b6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.006d5b6f
ret

Function at 0x6e3f26
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6e3f53
test byte [esp + 8], 0x80
je 0x6e3f41
and eax, 0xfffffffe
jmp 0x6e3f44
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x6e3f64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006ceeb0
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x6e4353
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x6e4374
lea eax, [ebp - 4]
push eax
call fcn.006d15df
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call fcn.006d4013
test eax, eax
pop ecx
jne 0x6e4395
call fcn.006cee9e
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x6e4496
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x6e4487
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x6e4487
push edi
call fcn.006d4013
test eax, eax
pop ecx
je 0x6e4487
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x6e4487
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x6e4487
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call fcn.006d3694
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x6e4487
xor eax, eax
jmp 0x6e4495
call fcn.006cee9e
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x6e44d8
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x7fb780
call fcn.006d5b34
mov eax, dword [0x93e25c]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x6e45e5
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x6e4596
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.006d05d0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x6e4583
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x6e45e5
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x6e45e5
mov al, byte [edi]
cmp al, 0x5c
je 0x6e45a4
cmp al, 0x2f
jne 0x6e45a9
cmp al, byte [edi + 1]
je 0x6e45df
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.006e4b2b
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x6e45e5
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006ceeb0
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x6e4601
push edi
call fcn.006d0db4
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
call fcn.006cedd0
call fcn.006d5b6f
ret
Function at 0x41fd42
Capabilities:
Authenticate hmac

Disassembly:
jecxz 0x41fd46
pop edi
sub edx, dword [ebx + 0x4f]
push ebx
dec edi
inc ecx
nop
dec ecx
xor dh, ah
mov byte [0x132a109e], al
pop edx
and ah, 0x42
invalid

Function at 0x41fd8e
Capabilities:
Authenticate hmac

Disassembly:
dec esp
lea ebx, [ebp - 0x23d08386]
invalid
dec ebx
sub bh, ah
mov eax, dword [0xab6e3b1a]
push 0x6f
ficom word [ebx + edi]
xchg esi, eax
xor eax, 0xca668b45
in eax, dx
jg 0x41fd71
mov cl, 0xcc
js 0x41fdd4
out dx, eax
adc al, 0x14
xchg dword [edi], ebp
mov al, 6
mov ecx, 0xce8e17d
add eax, 0x9f0350fe
xor al, dl
dec dword [esi - 0x6243b8be]
in al, dx
wait
sbb dword [esi], esp
xchg ebp, eax
xchg edx, eax
cmc
xlatb
dec esi
std

Function at 0x44a231
Capabilities:
Encode data using xor

Disassembly:
xlatb
fdivr qword [0x7dbcbd3c]
cld
add eax, dword [edx]
outsd dx, dword [esi]
pop es
add eax, 0xfe224313
mov eax, 0xdef23773
std
test al, 0xb8
clc
xchg dword [ecx], ecx
mov dword [edi + eax*2 - 0x2d3036b7], edx
xor esi, dword [edx]
mov bl, 0xb2
jae 0x44a248
dec edx
dec edx
retf
xchg esi, eax
cmp byte [ecx + 0x7e], 0xfd
stc
jg 0x44a1ad
xlatb
jp 0x44a243
xor byte [edi + 0x583d906f], ch
mov cs, esp
imul ecx, ecx, 0x37
scasd eax, dword es:[edi]
outsd dx, dword [esi]
nop
cmp eax, 0x6bcc8e58
leave
aaa
inc ecx
enter 0xffffffffffffd60b, 0x7f
sti
fisttp qword [esi - 0x63c93403]
mov al, 0x5c
jle 0x44a212
out 0xc6, al
popfd
pop es
invalid
jle 0x44a22e
jle 0x44a208
leave
fdiv dword [edx + 0xf342b57]
pop edx
int 0xa9
pop esi
mov ebp, 0xb372b6d5
xchg esi, eax
mov dh, 0x72
mov bl, 0x96
shl dword [eax - 0x6566e8ca], 0x72
invalid
mov al, byte [0x9a991736]
jb 0x44a2b5
invalid
rol bl, cl
out dx, al
arpl dx, ax
invalid

Function at 0x45d063
Capabilities:
Encode data using xor

Disassembly:
push 0x71
movsd dword es:[edi], dword [esi]
invalid
push ecx
push ss
outsb dx, byte [esi]
jo 0x45cffd
add eax, 0x70b01e6d
mov al, 0x70
xor al, 0x87
ja 0x45d028
invalid
arpl bp, dx
adc al, 0x82
push es
push ebp
add byte [esi], 0x55
mov gs, word [esp + edx*4 - 0x17]
cmp eax, 0xdf226225
jl 0x45d021
mov ah, 0xc6
mov bl, byte [esi]
mov cl, 0xab
sub dword [0xe5ba600e], edi
or dword [esi - 0x36], esp
xor al, 0xd2
shl byte [ecx + 0x1cd272b1], 1
shl dword [edx - 6], 0xd8
daa
mov dword [bx + di - 0x1066], ebx
jnp 0x45d020
sbb bl, ch
jecxz 0x45d066
mov eax, dword [0xcc08ca9e]
add byte [esi - 0x40], bl
mov dword [ebx + 0x4b], edi

Function at 0x476653
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edi - 0x5b], ah
jp 0x476664
mov ah, 0x29
pop es
mov bl, 0x7a
rcr byte [esi + 0x4ed27fba], cl
xor esi, ebp
adc ch, byte [ebx - 0x4b]
movsd dword es:[edi], dword [esi]
jmp 0x4765f3
Function at 0x496514
Capabilities:
Encode data using xor

Disassembly:
ficom dword [edi + esi*4 - 0x8632acc]
inc esi
xor ecx, dword [esi]
inc edx
insd dword es:[edi], dx
test eax, 0xe79be515
add esi, dword [edx + 0x499f94c5]
ja 0x49653f
push ebx
pop ebp
daa
dec eax
les ebx, [0xf241ccc4]
jle 0x49656d
mov ebp, 0x3c44bc6a
adc eax, 0x5d3a80fd
sbb dword [esi], esi
sbb al, 0x8c
sti
xor al, 0x1b
leave
je 0x496576
int1
mov bl, 0x22
mov eax, gs
and ch, byte [ebx - 0x5cb268fe]
adc ch, byte [ecx + esi + 0x6b]
push edx
insb byte es:[edi], dx
xor dword [ebx + 0x52], ebp
in al, 0x4c
loopne 0x49651f
sub al, 0xc2
mov ch, dl
pushfd
lodsb al, byte [esi]
xchg ebp, eax
stosd dword es:[edi], eax
sub al, 0x49
lds esi, [edx - 0x39]
sahf
jbe 0x4964da
idiv byte [edi]
push esi
jo 0x496511
insd dword es:[edi], dx
mov ch, 0x64
push 0x2a
and esp, esp
dec eax
cwde
add dl, byte [edi]
adc dword [ebx - 0x16], eax
sub byte [edi - 0x1b], cl
cmp al, 0x23
pop ecx
leave
movsd dword es:[edi], dword [esi]
mov edi, 0x83c2dc76
push eax
call 0x416a2c5b
les ecx, [esi + 0x90f1367]
aaa
push edi
jo 0x4965ba
sti
rep outsb dx, byte [esi]
or esp, dword [ebp - 0x5843ec9b]
out dx, al
into
invalid
sub dh, byte [esi]
mov ebx, 0x426da065
push esp
xor bh, 0xb7
iret

Function at 0x49e888
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xc6
mov ebp, 0x12cc86ff
inc dword [esi + 0xda312cc]
push ss
cmpsd dword [esi], dword es:[edi]
jge 0x49e8a5
salc
cmpsb byte [esi], byte es:[edi]
les esi, [ebp - 0x80546f4]
inc edi
aaa
movsb byte es:[edi], byte [esi]
sti
add al, 0x91
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
fidivr dword [esi - 0x68]
das
xor eax, 0x270c9d41
xchg edi, eax
movsd dword es:[edi], dword [esi]
and eax, 0x95b8c422
xor dh, byte [edi - 0x3b]
loopne 0x49e867
invalid

Function at 0x49f5ff
Capabilities:
Encode data using xor

Disassembly:
cmp edx, esi
xchg edx, eax
xchg edi, eax
xor bl, byte [ebx + 0x167bf8da]
xchg dword [edx + ebx*8 - 0x74], ebp
in al, dx
mov word [eax - 0x3f04e15c], es
push ebx
loop 0x49f602
xchg ecx, eax
mov ebp, 0x1666864f
loop 0x49f602
ljmp 0x4472:0xd6b1294b
Function at 0x4ac415
Capabilities:
Encode data using xor

Disassembly:
fld xword [esi + 0x7ed0cfce]
pop eax
mov fs, word [ecx + 0x51b7d4d5]
mov dh, 0xbf
int 0xbc
mov ebx, 0x18d23c2f
adc byte [eax - 0x5ced10c6], dl
invalid
fisttp qword [ebp + 0x6785691a]
int 0x7a
sub dword [edx + 0x88c54b1], ebx
inc edi
cmp dword [ecx - 0x61b30072], esi
in al, 0x55
cmp ebx, dword [ecx + edx + 0x61]
dec esi
jle 0x4ac491
sbb edi, dword [edx + 0x52]
jle 0x4ac42a
adc al, 0x55
insb byte es:[edi], dx
push ss
pop esp
rcr ebx, 1
xor al, 0x4b
sar dword [edi], 0x76
xchg edi, eax
mov edx, 0x112d3df9
mov bl, 0xf
pop eax
out 0xc2, al
movsd dword es:[edi], dword [esi]
dec ecx
jb 0x4ac3c7
invalid
imul ebx, dword [ebx - 0x15], 0xfd097900
out 0xed, al
inc ebp
xchg ecx, eax
scasd eax, dword es:[edi]
mov byte [0x6bea9c31], al
mov esi, 0xd79cafa1
sub dword [esi + 0x1112e6ce], esp
jg 0x4ac400
and eax, 0xf43b507d
cmp dword [ebx - 0x706408d8], 0xfffffff7
std
popfd
rol dword [ecx + 0x36], cl
dec eax
mov edi, 0x40ccbaa2
cld
jg 0x4ac4a5
jge 0x4ac4f2
inc eax
adc ebp, ecx
jle 0x4ac4bd
mov ebp, 0x159cacf3
sub edi, dword [ecx]
add eax, 0x54e4a544
mov ah, byte [eax]
out dx, ax
push cs
adc eax, 0xd20a3111
dec ebx
mov cl, byte ds:[eax + 0x53]
mov dword [0x64204202], eax
out dx, eax
insb byte es:[edi], dx
sub byte [eax], cl
cmp dword [ebx - 0x78defef0], eax
dec eax
das
push ecx
mov cl, byte [eax - 0x33]
dec ecx
xor dword [edx], esp
inc edx
xchg esp, eax
sub ah, byte [eax]
or dword [0x520d2129], ebx
push edx
dec eax
jbe 0x4ac4b4
fcomi st(5)
sti
sti
dec edi
and esp, ebp
neg word [ebp - 0x19861989]
popfd
out 0x9d, al
jns 0x4ac4b8
xor dword [esi + 0x4d], edx
and dword [ebx - 0x15ac0b4b], eax
jns 0x4ac4ce
jb 0x4ac4e3
sahf
invalid
pop esi
retf 0xf37a
add dl, byte [ebp + 0x67]
cmp byte [ebp - 0x2a], 0x7e
sahf
daa
xlatb
out dx, eax
punpckldq mm3, dword [ebp - 0x38]
in al, dx
lahf
in eax, dx
adc byte [edi + esi*8 + 0x5c], ah
xchg edx, eax
or byte [eax], dl
lodsb al, byte [esi]
enter 0x19d8, 0x7d
hlt

Function at 0x4b07c0
Capabilities:
Encode data using xor

Disassembly:
fmul dword [edi + 0x79b22d9]
sbb ah, byte [edi]
rcr dword [edx + 0x2c33f709], cl
loop 0x4b083c
or edi, esi
xor ebp, dword [edx]
insb byte es:[edi], dx
pop edi
and ebp, edi
movsd dword es:[edi], dword [esi]
cmp al, 0x63
jp 0x4b07ca
adc dword [ebp + ecx*8 - 0x56], 0x54
ret 0xf544
push 0x1f
test al, 0xd9
mov ebx, edi
mov dword [edx + 0x76], 0xa877e1cc
iretd
Function at 0x40143f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
mov di, dx
mov si, cx
call fcn.00403040
add esp, 0xc
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], 0x41c6c8
push 0x69
pop eax
cmp ax, si
jne 0x4014a0
push 0x64
pop eax
cmp ax, di
jne 0x40148b
mov dword [ebp - 0x28], str._id__r
jmp 0x4014f9
mov eax, str._is__r
mov ecx, str._i__r
push 0x73
pop edx
cmp dx, di
cmovne eax, ecx
jmp 0x4014f6
push 0x75
pop eax
cmp ax, si
jne 0x4014c5
push 0x64
pop eax
cmp ax, di
jne 0x4014b9
mov dword [ebp - 0x28], str._ud__r
jmp 0x4014f9
mov eax, str._us__r
mov ecx, str._u__r
jmp 0x401495
push 0x74
pop eax
cmp ax, si
jne 0x4014d6
mov dword [ebp - 0x28], str._t__r
jmp 0x4014f9
push 0x70
pop eax
cmp ax, si
jne 0x4014e7
mov dword [ebp - 0x28], str._p__r
jmp 0x4014f9
push 0x73
pop ecx
cmp cx, si
mov eax, str._s__r
cmovne eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
test eax, eax
jne 0x40150f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret

Function at 0x401787
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x104
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4017bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40181f
push esi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4017d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40181e
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.Wifi_AutoInstall_Service
push str.WifiAutoInstallSrv
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x40180e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x401815
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004020c3
mov esp, ebp
pop ebp
ret
Function at 0x40182e
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x4018c0
push esi
push 0x10024
push str.WifiAutoInstallSrv
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x4018b8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x4018aa
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x4018aa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x64
jl 0x401888
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004020c3
mov esp, ebp
pop ebp
ret

Function at 0x401c17
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.WifiAutoInstallSrv
xor ebx, ebx
mov edi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x401c99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_failed_with__d
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.00401060
add esp, 0x14
mov dword [ebp - 0xac], str.WifiAutoInstallSrv
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push ebx
push eax
push ebx
push 2
push ebx
push 0xc0020001
push ebx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004020c3
mov esp, ebp
pop ebp
ret
Function at 0x401caa
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
xor esi, esi
xor edi, edi
push esi
inc edi
push esi
mov dword [ebp - 0x38], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x401e5d
push ebx
push 0xf01ff
push str.WifiAutoInstallSrv
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x401e51
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x401d15
mov edi, esi
jmp 0x401e48
cmp dword [ebp - 0x24], edi
je 0x401d91
cmp dword [ebp - 0x24], 3
jne 0x401d0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x401d46
mov eax, ecx
jmp 0x401d50
mov ecx, 0x2710
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x401d0e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jbe 0x401d7d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x401d8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x10]
ja 0x401de7
cmp dword [ebp - 0x24], 3
je 0x401d20
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x401d0e
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x401d0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x24], 2
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
jne 0x401e48
mov edi, ecx
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x401df7
mov eax, ecx
jmp 0x401e01
push str.Timeout_waiting_for_service_to_stop_n
call fcn.00401006
pop ecx
jmp 0x401d0e
mov ecx, 0x2710
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x401e45
cmp dword [ebp - 0x14], edi
jbe 0x401e31
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
jmp 0x401e3f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x10]
ja 0x401e45
cmp dword [ebp - 0x24], 2
je 0x401dd0
mov edi, dword [ebp - 0x38]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, edi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004020c3
mov esp, ebp
pop ebp
ret