joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100022e2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100022f5
xor eax, eax
jmp 0x10002303
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x100023cf
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x100023fb
push esi
push esi
push ebx
call fcn.10001a7e
test eax, eax
jne 0x100023fb
pop esi
pop ebx
leave
ret 0xc
push edi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1000241a
cmp eax, 0xffffffff
jne 0x10002433
cmp dword [ebp - 4], esi
jne 0x10002426
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
call fcn.10001336
mov eax, esi
pop edi
jmp 0x100023f5
mov edi, dword [ebp + 0x10]
push esi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10002457
cmp dword [ebp + 8], edi
jne 0x10002457
xor esi, esi
inc esi
jmp 0x10002426
cmp dword [ebp - 4], esi
jne 0x10002426
lea ecx, [ebp - 8]
call fcn.10001336
jmp 0x1000241f

Function at 0x10002466
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x10002492
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x1006f000]
inc ecx
cmp ecx, dword [esp + 0xc]
jl 0x10002473
pop esi
not eax
ret 0xc
Function at 0x10002860
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 4], eax
movsx eax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x5c]
push str.__c:
push eax
call fcn.10004219
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x10002891
mov eax, dword [eax + 4]
jmp 0x10002894
add eax, 4
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov ebx, eax
push 1
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x3c], ebx
call fcn.1000585c
cmp ebx, esi
je 0x100028c4
cmp ebx, 0xffffffff
jne 0x100028dd
lea ecx, [ebp - 0x3c]
call fcn.10001336
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
leave
ret
push edi
push 0x28
pop edx
push 9
pop ecx
xor eax, eax
push esi
mov dword [ebp - 0x38], edx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push edx
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0x40], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
test eax, eax
jne 0x1000292b
or esi, 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10001336
mov eax, esi
jmp 0x100028cf
mov esi, dword [ebp - 0x1c]
jmp 0x1000291f

Function at 0x10002930
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x218], edi
test ebx, ebx
je 0x10002a06
test edi, edi
je 0x10002a06
mov esi, str.deviceMup_
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
jne 0x10002984
push edi
push 0x1005d2f8
push esi
mov eax, ebx
call fcn.10004012
xor eax, eax
inc eax
jmp 0x10002a08
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x21c], eax
xor esi, esi
xor eax, eax
inc eax
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0x21c]
test ecx, eax
je 0x10002a00
push 0x3a
lea eax, [esi + 0x61]
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
push 0x206
lea edi, [ebp - 8]
push eax
stosd dword es:[edi], eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.1003c230
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x10002a00
push 0
lea eax, [ebp - 0x214]
push eax
push ebx
call fcn.1000410e
test eax, eax
jne 0x10002a16
inc esi
cmp esi, 0x1a
jl 0x10002992
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003b874
leave
ret
push dword [ebp - 0x218]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
jmp 0x10002975
Function at 0x10002daa
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x1006d144]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.10003823
push esi
test eax, eax
je 0x10002e37
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1003c230
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x10002e2e
cmp esi, 0xffffffff
je 0x10002e2e
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x10002e2a
push edi
lea eax, [esp + 0xc]
push eax
call fcn.10003823
test eax, eax
je 0x10002e2e
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10002e10
lea ecx, [esp + 4]
call fcn.10001336
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.1003b874
mov esp, ebp
pop ebp
ret 4

Function at 0x10002e4c
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 8
mov eax, 0x1005237e
call fcn.1003b883
mov eax, dword [ebp + 0x238]
mov dword [ebp - 0x14], eax
test edi, edi
je 0x10002ee1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x10002ed9
cmp esi, 0xffffffff
je 0x10002ed9
push 0x228
lea eax, [ebp + 4]
push 0
push eax
mov dword [ebp], 0x22c
call fcn.1003c230
add esp, 0xc
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10002ed5
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x10002ed9
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10002ebe
lea ecx, [ebp - 0x10]
call fcn.10001336
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.1003b874
add ebp, 0x230
leave
ret 4
Function at 0x10002f06
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x10002f1b
xor eax, eax
jmp 0x10002fac
push esi
push edi
push 0x40
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x54], 0x44
call fcn.1003c230
mov esi, dword [ebp + 0x10]
add esp, 0xc
cmp esi, ebx
jne 0x10002f47
xor eax, eax
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], ax
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10001606
mov edi, eax
lea eax, [ebp - 0x10]
push eax
neg esi
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
sbb esi, esi
and esi, 0xf8000000
add esi, 0x8000000
push esi
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10002fa0
push dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x10002fa2
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x10002fa2
mov esi, ebx
push edi
call fcn.1000163b
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100032a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100032b5
xor eax, eax
jmp 0x100032da
push edi
call fcn.100031c8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov edi, 0x100033c9
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.10002e4c
cmp dword [ebp - 0x10], esi
jne 0x100032df
xor eax, eax
pop edi
pop esi
leave
ret 8
push dword [ebp - 0x14]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x100032fa
cmp eax, 0xffffffff
jne 0x10003306
lea ecx, [ebp - 0xc]
call fcn.10001336
mov eax, esi
jmp 0x100032d9
lea ecx, [ebp - 4]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100032fa
push ebx
push esi
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100033be
push dword [ebp + 8]
call fcn.10001606
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 0x6c], 0x44
call fcn.1003c230
add esp, 0xc
mov dword [ebp - 0x40], 1
cmp dword [ebp + 0xc], esi
je 0x1000336f
push 5
pop eax
jmp 0x10003371
xor eax, eax
mov word [ebp - 0x3c], ax
xor eax, eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 8]
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x100033ad
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
call ebx
push dword [ebp + 8]
call fcn.1000163b
push dword [ebp - 8]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 4]
call ebx
pop ebx
jmp 0x100032fa

Function at 0x100035c5
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 4], eax
test edi, edi
jne 0x100035ec
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b874
leave
ret 4
push esi
push dword [ebp + 8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
je 0x1000360e
cmp esi, 0xffffffff
jne 0x10003620
xor esi, esi
lea ecx, [ebp - 0x210]
call fcn.10001336
mov eax, esi
pop esi
jmp 0x100035de
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1003c230
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jbe 0x1000360e
push ebx
mov ecx, edi
lea ebx, [ebp - 0x20c]
call fcn.10002930
xor esi, esi
inc esi
pop ebx
jmp 0x10003610
Function at 0x10003993
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
or dword [esi], 0xffffffff
push ebx
push dword [esp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10003a28
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10003a28
push edi
lea edi, [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10003a27
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov edx, ecx
or edx, eax
je 0x10003a27
cmp eax, ebx
jl 0x100039fc
mov eax, 0x400000
jg 0x100039f8
cmp ecx, eax
jbe 0x100039fc
mov edi, eax
jmp 0x100039fe
mov edi, ecx
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi]
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x10003a27
push dword [esi + 0x18]
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop ebx
ret 4

Function at 0x10004329
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x4f90]
mov eax, 0x5010
call fcn.1003c2b0
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x4f8c], eax
cmp dword [ebp + 0x4fa8], 0
mov eax, dword [ebp + 0x4fa4]
push ebx
mov ebx, dword [ebp + 0x4fa0]
push esi
mov esi, dword [ebp + 0x4f98]
push edi
mov edi, dword [ebp + 0x4f9c]
mov dword [ebp - 0x78], eax
je 0x100043c1
xor eax, eax
push 0x4ffe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.1003c230
and dword [ebp - 0x7c], 0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x80], 0x5000
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x7c], 1
jne 0x100043c1
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x100043c1
inc eax
jmp 0x100043e9
xor eax, eax
cmp dword [ebp - 0x78], eax
je 0x100043d1
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x78]
push 1
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x4f8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
add ebp, 0x4f90
leave
ret 0x14
Function at 0x10004533
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053b5c
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.1003c2b0
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x2028], ecx
mov dword [ebp - 0x2018], eax
mov dword [ebp - 0x202c], edi
call fcn.10004bc0
push dword [ebp - 0x2018]
xor ebx, ebx
push esi
inc ebx
lea esi, [ebp - 0x2024]
mov dword [ebp - 0x202c], ebx
call fcn.10001350
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2020], edi
je 0x1000465f
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.1003c230
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x10004649
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
push eax
lea ecx, [ebp - 0x2048]
call fcn.10004b06
lea eax, [ebp - 0x2048]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2028]
push eax
call fcn.10004f6a
push edi
push ebx
lea ecx, [ebp - 0x2048]
mov byte [ebp - 4], bl
call fcn.10005a6e
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x2020]
mov dword [ebp - 0x201c], 0x1000
call esi
test eax, eax
je 0x100045f3
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x2020], edi
je 0x1000467d
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003b874
leave
ret

Function at 0x1000469d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push 1
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100046ea
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x100047b5
Capabilities:
Check if file exists
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0xc], 3
jbe 0x100047c9
cmp dword [ebp + 0xc], esi
ja 0x10004837
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004837
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0xf003f
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1000482f
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov eax, str.gxdte
push 1
push dword [ebp + 0xc]
push 2
push 0xf01ff
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.10004795
xor eax, eax
cmp dword [ebp - 4], esi
setne al
jmp 0x10004839
lea eax, [ebp - 8]
call fcn.10004795
xor eax, eax
pop esi
leave
ret 8

Function at 0x1000494d
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push 4
push edi
push edi
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x100049a7
push 4
push str.gxdte
lea esi, [ebp - 8]
call fcn.10004767
cmp dword [ebp - 8], edi
je 0x100049a7
push 6
mov dword [ebp - 0x24], edi
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100049a7
cmp dword [ebp - 0x20], 4
jne 0x100049a7
inc ebx
lea eax, [ebp - 8]
call fcn.10004795
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x100049b6
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x23
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x10004a23
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.1003c230
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10004a23
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc ebx
cmp dword [ebp - 0x80], 0
je 0x10004a32
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp + 0x18c]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1003b874
add ebp, 0x190
leave
ret
Function at 0x1000a8be
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x5c
lea edi, [ebp - 0x11]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1000a903
cmp eax, 3
jne 0x1000a91b
push ebx
call fcn.10002860
pop ecx
cmp eax, 0xffffffff
je 0x1000a928
cmp eax, 7
jne 0x1000a91b
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x1000a92a
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
leave
ret
Function at 0x1001a669
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x1001a6a1
push dword [ebp + 0x10]
push dword [ebp - 4]
push str.thread__d_created:__s
call fcn.1001a248
add esp, 0xc
mov eax, edi
pop edi
leave
ret 0xc
Function at 0x1001a6a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100559d5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1006d144]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov eax, dword [0x1006d144]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [esp + 0x14], eax
cmp esi, edi
jne 0x1001a6fe
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1001a881
cmp dword [ebp + 8], 1
push 2
pop ebx
je 0x1001a70c
cmp dword [ebp + 8], ebx
jne 0x1001a6ef
cmp dword [0x1006f9c4], 0xffffffff
jne 0x1001a780
push edi
push ebx
push ebx
call sub.WS2_32.dll_socket
mov dword [0x1006f9c4], eax
cmp eax, 0xffffffff
je 0x1001a768
cmp dword [ebp + 8], 1
mov dword [esp + 0x18], edi
mov eax, str.127.0.0.2
je 0x1001a73b
mov eax, str.127.0.0.3
lea ecx, [esp + 0x18]
push ecx
call fcn.10002a93
mov eax, dword [esp + 0x18]
mov dword [0x10072c24], eax
mov eax, ebx
push 0x32e9
mov word [0x10072c20], ax
call sub.WS2_32.dll_htons
mov word [0x10072c22], ax
jmp 0x1001a773
push str.PpSendExternalMessage:_create_socket_failed
call fcn.10022250
pop ecx
cmp dword [0x1006f9c4], 0xffffffff
je 0x1001a6f7
push edi
push edi
lea eax, [esp + 0x24]
call fcn.100105d7
sub esp, 0x18
mov dword [esp + 0x78], ebx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.1000f5bb
push str.message
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 3
call fcn.10010909
mov ecx, eax
mov byte [esp + 0x78], bl
call fcn.1000f8d5
mov eax, dword [esp + 0x14]
cmp eax, edi
jne 0x1001a7c9
mov eax, 0x1005dee5
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.1000f5bb
push str.content
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 4
call fcn.10010909
mov ecx, eax
mov byte [esp + 0x78], bl
call fcn.1000f8d5
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x2c], esp
push dword [ebp + 0x14]
call fcn.1000f559
push str.broadcast
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 5
call fcn.10010909
mov ecx, eax
mov byte [esp + 0x78], bl
call fcn.1000f8d5
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
call fcn.10010d78
cmp dword [esp + 0x4c], 0x10
mov eax, dword [esp + 0x38]
jae 0x1001a842
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x48]
push 0x10
push 0x10072c20
push edi
inc ecx
push ecx
push eax
push dword [0x1006f9c4]
call sub.WS2_32.dll_sendto
xor ecx, ecx
test eax, eax
setg cl
push edi
push 1
mov esi, ecx
lea ecx, [esp + 0x3c]
call fcn.1000585c
or dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.1000f850
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1003b874
mov esp, ebp
pop ebp
ret 0x10