joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009070
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x10009087
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146a8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146ac], eax
push 0
push 0
push 0x10009680
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push 0x100143b4
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10009119
push 0
mov ecx, dword [0x10014864]
push ecx
push 0x10008d20
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x1000913d
push 0
mov edx, dword [0x10014864]
push edx
push 0x10008c40
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push 0x10014348
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009164
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10009188
push 0
mov ecx, dword [0x10014864]
push ecx
push 0x10008f30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100091a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x100091b7
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100091e1
xor eax, eax
jmp 0x10009229
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a1fa
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a22b
xor eax, eax
jmp 0x1000a2be
mov byte [ebp - 0x10c], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a285
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
xor eax, eax
jmp 0x1000a2be
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a2b9
xor eax, eax
jmp 0x1000a2be
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a360
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000a377
sub dword [edx], ebp
sub ebx, dword [eax - 0x73]
inc ebp
in al, dx
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push 0x100144ec
push 0
call dword [sym.imp.ADVAPI32.DLL_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.DLL_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a497
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 3], ch
pop eax
push 0
push 0x80
push 3
push 0
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a4c1
xor eax, eax
jmp 0x1000a4ef
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a500
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a517
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
or byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_DeleteFileA
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a54b
xor eax, eax
jmp 0x1000a579
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a690
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a6a7
sub dword [edx], ebp
sub ebx, dword [eax + 0x68]
aas
add byte [edi], cl
add byte [edx], ch
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a6c2
jmp 0x1000a70c
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.DLL_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a6ea
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
jmp 0x1000a70c
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a830
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a847
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a873
or eax, 0xffffffff
jmp 0x1000a8bd
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a89d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
xor eax, eax
jmp 0x1000a8bd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.DLL_DeleteService]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a8d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a8ea
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a92e
jmp 0x1000a99c
mov byte [ebp - 0x10c], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 2
push 0
push 0x10014512
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a9b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000a9c7
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000aa05
jmp 0x1000aa34
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push 0x10014020
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b150
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001179c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x100123b8
mov dword [ebp - 4], 0
push eax
xor eax, eax
xor eax, eax
je 0x1000b18f
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
dec ebp
in al, dx
pop eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
je 0x1000b1b9
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x14]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10003810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b458
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
cld
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b510
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b52a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b54e
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cda0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000cdba
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [ebp - 4], eax
call fcn.1000a360
mov eax, dword [ebp - 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000cdf9
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b6a
jmp 0x1000ce29
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1000ce1f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b6a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000ce29
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d050
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d06a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
in al, dx
pop eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.1000a360
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000d09d
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0x1b5d
jmp 0x1000d100
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.DLL_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d0cf
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x1b5d
jmp 0x1000d100
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_DeleteService]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
cmp dword [ebp - 8], 0
jne 0x1000d100
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], 0x1b5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d350
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d36a
sub dword [edx], ebp
sub ebx, dword [eax + 0x68]
inc dword [ecx]
str word [ebx - 0x3f7cf3bb]
adc byte [eax - 0x75], dl
dec ebp
or byte [ecx - 1], dl
adc eax, sym.imp.ADVAPI32.DLL_OpenServiceA
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.DLL_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d38f
jmp 0x1000d4b7
mov dword [ebp - 8], 0
push 0x2000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov ecx, 0x800
xor eax, eax
mov edi, dword [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x2000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_QueryServiceConfigA]
test eax, eax
je 0x1000d49b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x448
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x848
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x648
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0xc48
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0x10
push ecx
push 0x10014634
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x1048
push eax
push 0x10014520
mov ecx, dword [ebp - 0x10]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1000a1e0
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d56a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d5af
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d60a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1200]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xa00
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1204]
push edx
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x800
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d600
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b67
jmp 0x1000d60a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d620
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d63a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d67f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d6bc
mov ecx, dword [ebp - 0xc]
add ecx, 0x800
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d6b2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1b64
jmp 0x1000d6bc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d6d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000d6ea
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d72f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d767
push 0x100146b0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d75d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b64
jmp 0x1000d767
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000db40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000db5a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 8]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret