joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21039823
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x21039853
xor eax, eax
jmp 0x21039862
cmp dword [ebp - 4], 3
je 0x2103985d
xor eax, eax
jmp 0x21039862
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x21039a18
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x21039a44
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x24], 0
je 0x21039a44
cmp dword [ebp + 8], 0
jl 0x21039a44
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x10]
jl 0x21039a48
xor eax, eax
jmp 0x21039a83
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x21039a7d
xor eax, eax
jmp 0x21039a83
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
mov esp, ebp
pop ebp
ret 4

Function at 0x21039a89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
je 0x21039aa1
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0x14], 0
je 0x21039ab0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
je 0x21039adc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x28], 0
je 0x21039adc
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x2c], 0
je 0x21039adc
cmp dword [ebp + 8], 0
jl 0x21039adc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x18]
jl 0x21039ae0
xor eax, eax
jmp 0x21039b5a
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x21039b27
xor eax, eax
jmp 0x21039b5a
cmp dword [ebp + 0xc], 0
je 0x21039b38
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
mov dword [eax], edx
cmp dword [ebp + 0x10], 0
je 0x21039b46
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
cmp dword [ebp + 0x14], 0
je 0x21039b54
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x28]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x21039b60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
jne 0x21039b79
xor eax, eax
jmp 0x21039ce2
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x21039bb1
xor eax, eax
jmp 0x21039ce2
mov edx, dword [ebp - 4]
lea eax, [edx + edx + 1]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + ecx + 1]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
lea ecx, [eax + eax + 1]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x14]
jbe 0x21039c37
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.21058751
add esp, 4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.21058728
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x24], eax
cmp dword [ebp - 0x1c], 0
jne 0x21039c37
mov ecx, dword [ebp - 0x30]
call fcn.2103972f
xor eax, eax
jmp 0x21039ce2
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x1c]
jbe 0x21039c8a
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.21058751
add esp, 4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.21058728
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x28], ecx
cmp dword [ebp - 0x24], 0
jne 0x21039c8a
mov ecx, dword [ebp - 0x30]
call fcn.2103972f
xor eax, eax
jmp 0x21039ce2
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0x20]
jbe 0x21039cdd
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.21058751
add esp, 4
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x20], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.21058728
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ecx + 0x2c], edx
cmp dword [ebp - 0x2c], 0
jne 0x21039cdd
mov ecx, dword [ebp - 0x30]
call fcn.2103972f
xor eax, eax
jmp 0x21039ce2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x2103a100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0
je 0x2103a127
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x2c], 0
jne 0x2103a12b
xor eax, eax
jmp 0x2103a199
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x2103a158
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
xor eax, eax
jmp 0x2103a199
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 1
je 0x2103a16c
cmp dword [ebp - 0x10], 2
je 0x2103a16e
jmp 0x2103a183
jmp 0x2103a18d
cmp dword [ebp + 0x14], 0
je 0x2103a181
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.21044cc6
jmp 0x2103a18d
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
xor eax, eax
jmp 0x2103a199
mov eax, dword [ebp + 0xc]
push eax
call fcn.21049450
add esp, 4
mov esp, ebp
pop ebp
ret 0x10

Function at 0x2103a19f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0
je 0x2103a1b7
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 0x10], 0
je 0x2103a1c6
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp dword [ebp + 0x14], 0
je 0x2103a1d5
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0
je 0x2103a1e7
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x2c], 0
jne 0x2103a1eb
xor eax, eax
jmp 0x2103a250
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2c]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x2103a21e
xor eax, eax
jmp 0x2103a250
cmp dword [ebp + 0xc], 0
je 0x2103a22f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov dword [edx], ecx
cmp dword [ebp + 0x10], 0
je 0x2103a23d
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [edx], eax
cmp dword [ebp + 0x14], 0
je 0x2103a24b
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2103a6c3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x2103a6d7
xor eax, eax
jmp 0x2103a709
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2103a6fc
xor eax, eax
jmp 0x2103a709
mov ecx, dword [ebp - 4]
call fcn.21039b60
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x2103a70f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x2103a723
xor eax, eax
jmp 0x2103a76c
cmp dword [ebp + 8], 0
jne 0x2103a730
mov dword [ebp + 8], 0x2107c1d4
mov ecx, dword [ebp + 8]
push ecx
call fcn.21049450
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2103a75f
xor eax, eax
jmp 0x2103a76c
mov ecx, dword [ebp - 4]
call fcn.21039b60
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x2103a772
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x2103a786
xor eax, eax
jmp 0x2103a7b6
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2103a7a9
xor eax, eax
jmp 0x2103a7b6
mov ecx, dword [ebp - 4]
call fcn.21039b60
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x2103a7bc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x2103a7d7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.21039697
jmp 0x2103a828
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
jne 0x2103a7e4
xor eax, eax
jmp 0x2103a828
cmp dword [ebp + 0x10], 0
jne 0x2103a7f6
mov edx, dword [ebp + 0xc]
push edx
call fcn.2102b0bb
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2103a81b
xor eax, eax
jmp 0x2103a828
mov ecx, dword [ebp - 4]
call fcn.21039b60
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x2103a82e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x2103a849
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.21039697
jmp 0x2103a896
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
jne 0x2103a856
xor eax, eax
jmp 0x2103a896
mov edx, dword [ebp + 0xc]
push edx
call fcn.21049450
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2103a889
xor eax, eax
jmp 0x2103a896
mov ecx, dword [ebp - 4]
call fcn.21039b60
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x2103d26c
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0xc
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
jne 0x2103d2b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x2103d2b2
push 0x21076a8c
call fcn.2100dfb1
xor eax, eax
jmp 0x2103d32f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call fcn.21058751
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.21058728
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
cmp dword [ebp - 0xc], 0
jne 0x2103d2f3
push str.could_not_allocate_service_list
call fcn.2100df3d
xor eax, eax
jmp 0x2103d32f
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
push 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
jne 0x2103d32a
push str.EnumDependentServices
call fcn.2100dfb1
xor eax, eax
jmp 0x2103d32f
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x2103d333
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jne 0x2103d349
xor eax, eax
jmp 0x2103d375
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x2103d36c
push 0x21076adc
call fcn.2100dfb1
xor eax, eax
jmp 0x2103d375
xor eax, eax
cmp dword [ebp - 0x18], 4
sete al
mov esp, ebp
pop ebp
ret
Function at 0x2103d4f4
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x7530
mov dword [ebp - 0x24], eax
cmp dword [0x2107c1dc], 0
je 0x2103d522
mov ecx, dword [0x2107c1dc]
call fcn.210345bb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x24]
jbe 0x2103d54b
push 0x21076af0
push str.MyStartService
push 0x2729
call fcn.2100de6e
add esp, 0xc
xor eax, eax
jmp 0x2103d5d4
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x2103d56b
push str.QueryServiceStatus
call fcn.2100dfb1
xor eax, eax
jmp 0x2103d5d4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
je 0x2103d57f
cmp dword [ebp - 0x28], 4
je 0x2103d5a1
jmp 0x2103d5b3
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x2103d59f
push str.StartService
call fcn.2100dfb1
xor eax, eax
jmp 0x2103d5d4
jmp 0x2103d5b3
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x2103d5d4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x2107c1dc], 0
je 0x2103d5cf
mov ecx, dword [0x2107c1dc]
call fcn.210345bb
jmp 0x2103d522
mov esp, ebp
pop ebp
ret 4

Function at 0x2103d781
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x2103d7c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x426
je 0x2103d7af
jmp 0x2103d7b6
mov eax, 1
jmp 0x2103d7e1
push str.ControlService
call fcn.2100dfb1
xor eax, eax
jmp 0x2103d7e1
push 0x7530
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.2103d815
test eax, eax
jne 0x2103d7dc
xor eax, eax
jmp 0x2103d7e1
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x2103d815
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x7530
mov dword [ebp - 0x28], eax
cmp dword [0x2107c1dc], 0
je 0x2103d843
mov ecx, dword [0x2107c1dc]
call fcn.210345bb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x28]
jbe 0x2103d869
push str.__timed_out_waiting_for_service
push str.WaitService
push 0x2729
call fcn.2100de6e
add esp, 0xc
xor eax, eax
jmp 0x2103d8b9
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x2103d87d
jmp 0x2103d843
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jne 0x2103d892
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2103d8a8
cmp dword [0x2107c1dc], 0
je 0x2103d8a6
mov ecx, dword [0x2107c1dc]
call fcn.210345bb
jmp 0x2103d843
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x2103e13c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x2103e166
xor eax, eax
jmp 0x2103e183
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
add eax, 2
mov esp, ebp
pop ebp
ret 8
Function at 0x2103f709
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
push edi
mov dword [ebp - 8], 0
mov byte [ebp - 0x110], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], pe_nt_image_headers32
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x2103f782
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x2103f782
xor eax, eax
jmp 0x2103f8a2
mov edx, dword [ebp - 8]
push edx
call fcn.21058728
add esp, 4
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x2103f7b4
push str.GetCurrentSid:_could_not_allocate_SID
call fcn.2100df3d
xor eax, eax
jmp 0x2103f8a2
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x2103f7e3
jmp 0x2103f8a0
cmp dword [ebp - 0x114], 1
je 0x2103f86b
cmp dword [ebp - 0x114], 3
jne 0x2103f869
push 0xffffffffffffffff
push 0x21076c64
mov ecx, dword [ebp + 8]
push ecx
call fcn.2102b9d4
test eax, eax
jne 0x2103f869
lea edx, [ebp - 0x314]
push edx
call fcn.21044e55
test eax, eax
jne 0x2103f81e
jmp 0x2103f89e
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x314]
push ecx
call fcn.21049450
add esp, 4
lea edx, [ebp + eax - 0x314]
push edx
call fcn.21048f5f
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
push ecx
call fcn.21058751
add esp, 4
mov edx, dword [ebp + 8]
push edx
call fcn.2103f709
jmp 0x2103f8a2
jmp 0x2103f89c
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jne 0x2103f897
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x320], eax
mov ecx, dword [ebp - 0x320]
push ecx
call fcn.21058751
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
jmp 0x2103f8a2
jmp 0x2103f872
jmp 0x2103f872
jmp 0x2103f872
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x2104062c
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push 0x21076c98
lea ecx, [ebp - 8]
push ecx
call fcn.2104b654
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x2104066d
xor eax, eax
jmp 0x21040681
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x2104067c
xor eax, eax
jmp 0x21040681
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x21042172
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.21041f8b
test eax, eax
jne 0x2104218d
jmp 0x21042217
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x2c], eax
jne 0x210421c3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x21042217
mov ecx, dword [ebp - 0x14]
call fcn.21041f5c
test eax, eax
je 0x210421d1
jmp 0x21042217
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.210037f9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 8], edx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea ecx, [ebp - 4]
call fcn.21003822
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x210433b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 5
mov eax, dword [ebp + 0xc]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x210433db
xor eax, eax
jmp 0x21043400
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x210433f6
xor eax, eax
jmp 0x21043400
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret 8