joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008560
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
push ecx
lea eax, [esi + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edi, [esi + 0x18]
lea ebp, [esi + 0x10]
lea ebx, [esi + 8]
push edi
push ebp
lea eax, [esi + 0x220]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x100085ac
mov dword [ebp], eax
mov dword [ebx], eax
mov dword [edi], eax
mov dword [ebp + 4], eax
mov dword [ebx + 4], eax
mov dword [edi + 4], eax
jmp 0x100085ae
xor eax, eax
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x15], edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x19], edx
mov dword [esp + 0x1d], edx
push eax
mov dword [esp + 0x25], edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x29], edx
push 0x1000f600
mov word [esp + 0x31], dx
push ecx
mov byte [esp + 0x20], 0
mov byte [esp + 0x37], dl
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esi + 0x120]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x10]
push 0x80
push edx
push eax
push ecx
push 0
lea edx, [esi + 0x20]
push 0x80
lea eax, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8

Function at 0x100086a0
Capabilities:
Get disk information
Write file on windows

Disassembly:
sub esp, 0x374
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.1000a080
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
jne 0x100086ce
mov dword [esi + 4], 0x1b69
pop esi
pop ebx
add esp, 0x374
ret
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
xor ebp, ebp
test edi, edi
mov dword [esp + 0x18], edi
jbe 0x1000877b
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + ebp + 0x20]
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
mov al, byte [esi]
cmp al, 0x41
je 0x10008770
cmp al, 0x42
je 0x10008770
mov ecx, 0x96
xor eax, eax
lea edi, [esp + 0x12c]
mov dword [esp + 0x124], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x124]
push ecx
mov ecx, dword [esp + 0x20]
push esi
call fcn.10008560
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x12c]
push 0x260
push eax
push ecx
mov dword [esp + 0x28], 0
call ebx
mov edi, dword [esp + 0x18]
add ebp, 4
cmp ebp, edi
jb 0x10008707
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x374
ret
Function at 0x10008790
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x228
push esi
mov esi, dword [esp + 0x234]
push edi
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
push esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
pop edi
pop esi
test eax, eax
je 0x100087fb
mov ecx, dword [esp + 0x22c]
lea edx, [esp]
push 0
push edx
lea eax, [esp + 0xc]
push 0x224
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x228
ret 8

Function at 0x10008810
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x450
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x259]
mov byte [esp + 0x258], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x155]
mov byte [esp + 0x154], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x154]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x154]
lea eax, [esp + 0x258]
push edx
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x258]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x100088bf
mov dword [esi + 4], 0x1b58
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x450
ret
mov ecx, esi
call fcn.1000a080
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x100088e8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x1b69
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x450
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35d]
mov byte [esp + 0x35c], bl
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [esp + 0x40]
push 0x1000f610
push eax
call edi
test eax, eax
je 0x10008965
lea ecx, [esp + 0x40]
push 0x1000f60c
push ecx
call edi
test eax, eax
je 0x10008965
lea edx, [esp + 0x40]
lea eax, [esp + 0x154]
push edx
push eax
lea ecx, [esp + 0x364]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x20]
add esp, 0x10
lea edx, [esp + 0x35c]
mov ecx, esi
push edx
push eax
call fcn.10008790
lea ecx, [esp + 0x14]
push ecx
push ebp
call ebx
test eax, eax
jne 0x1000890e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x450
ret
Function at 0x10008ac0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x454
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x361]
mov byte [esp + 0x360], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x159]
mov byte [esp + 0x158], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x468]
lea ecx, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x158]
lea eax, [esp + 0x360]
push edx
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp + 0x24]
sub byte [ecx - 0xcdbdba4], cl
stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x360]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x10008b74
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x454
ret 0x10
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25d]
mov byte [esp + 0x25c], bl
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x474]
mov ebp, dword [esp + 0x46c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x470]
lea eax, [esp + 0x44]
push 0x1000f610
push eax
call ebx
test eax, eax
je 0x10008c30
lea ecx, [esp + 0x44]
push 0x1000f60c
push ecx
call ebx
test eax, eax
je 0x10008c30
lea edx, [esp + 0x44]
lea eax, [esp + 0x158]
push edx
push eax
lea ecx, [esp + 0x264]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [esp + 0x28]
add esp, 0x10
test al, 0x10
je 0x10008c15
mov ecx, dword [ebp]
push esi
inc ecx
push edi
lea edx, [esp + 0x264]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x1c]
push ebp
push edx
call fcn.10008ac0
test eax, eax
je 0x10008c5e
jmp 0x10008c30
mov eax, dword [edi]
mov ecx, dword [esp + 0x34]
inc eax
mov dword [edi], eax
mov eax, dword [esp + 0x38]
mov edx, dword [esi]
add edx, eax
mov dword [esi], edx
mov eax, dword [esi + 4]
adc eax, ecx
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10008ba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10008c6d
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x454
ret 0x10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x454
ret 0x10

Function at 0x10008c90
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xc]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x10008fa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x230
push esi
mov esi, dword [esp + 0x23c]
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x10009026
mov edx, dword [esp + 0x2c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x38]
push esi
push eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x23c]
lea ecx, [esp + 8]
push 0
push ecx
lea edx, [esp + 0x38]
push 0x208
push edx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x230
ret 8

Function at 0x100090c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x44c
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x359]
mov byte [esp + 0x358], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x255]
mov byte [esp + 0x254], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x460]
lea ecx, [esp + 0x254]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x254]
lea eax, [esp + 0x358]
push edx
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x358]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10009170
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44c
ret 8
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x151]
mov byte [esp + 0x150], bl
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x464]
lea eax, [esp + 0x3c]
push 0x1000f610
push eax
call ebx
test eax, eax
je 0x10009208
lea ecx, [esp + 0x3c]
push 0x1000f60c
push ecx
call ebx
test eax, eax
je 0x10009208
lea edx, [esp + 0x3c]
lea eax, [esp + 0x254]
push edx
push eax
lea ecx, [esp + 0x158]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [esp + 0x20]
add esp, 0x10
test al, 0x10
je 0x100091f8
lea edx, [esp + 0x150]
push edi
push edx
mov ecx, ebp
call fcn.100090c0
test eax, eax
je 0x1000922e
jmp 0x10009208
lea eax, [esp + 0x150]
mov ecx, ebp
push eax
push edi
call fcn.10008fa0
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009197
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
push esi
je 0x1000923d
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44c
ret 8
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44c
ret 8
Function at 0x10009550
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
sub esp, 0x338
push ebx
push ebp
push esi
push edi
push 0
mov ebp, ecx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
jne 0x1000957d
pop edi
mov dword [ebp + 4], 0x1b59
pop esi
pop ebp
pop ebx
add esp, 0x338
ret
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x100095ba
push esi
mov dword [ebp + 4], 0x1b59
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x338
ret
call fcn.10007710
mov ecx, ebp
call fcn.1000a080
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100095df
pop edi
mov dword [ebp + 4], 0x1b69
pop esi
pop ebp
pop ebx
add esp, 0x338
ret
mov edx, dword [esp + 0x30]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x144], ecx
mov dword [esp + 0x140], edx
lea ecx, [esp + 0x38]
lea edx, [esp + 0x148]
push ecx
push edx
mov dword [esp + 0x144], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
lea eax, [esp + 0x14c]
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x10009651
mov edx, dword [esp + 0x13c]
lea ecx, [esp + 0x148]
push ecx
push edx
call fcn.100076a0
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x144]
push 0x20c
push ecx
push ebx
mov dword [esp + 0x24], 0
call ebp
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10009725
mov ecx, 0x83
xor eax, eax
lea edi, [esp + 0x13c]
mov edx, dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x144], eax
mov dword [esp + 0x140], ecx
lea eax, [esp + 0x38]
lea ecx, [esp + 0x148]
push eax
push ecx
mov dword [esp + 0x144], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
lea edx, [esp + 0x14c]
push 0
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
test eax, eax
jne 0x100096fb
mov ecx, dword [esp + 0x13c]
lea eax, [esp + 0x148]
push eax
push ecx
call fcn.100076a0
add esp, 8
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x144]
push 0x20c
push eax
push ebx
call ebp
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10009689
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x338
ret
Function at 0x10009740
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov esi, eax
call fcn.10007710
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10009770
mov dword [edi + 4], 0x1b6a
pop edi
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x10009784
mov dword [edi + 4], 0x1b6a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x10009840
Capabilities:
Start service
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebx, dword [edi + 0xc]
call fcn.10007710
push 0xe00f003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x10009879
mov dword [edi + 4], 0x1b5b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0xf01ff
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x100098a2
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi + 4], 0x1b5b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ebx, dword [ebx + 0x400]
sub ebx, eax
je 0x100098d4
dec ebx
jne 0x10009902
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x100098df
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x10009902
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ecx + 4], 0
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edx + 4], 0x1b5b
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x100099a0
Capabilities:
Enumerate services
Write file on windows

Disassembly:
mov eax, 0x1468
call fcn.1000c4f0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
call fcn.10007710
xor ebp, ebp
push 0xe00f003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x18], ebx
jne 0x100099e4
mov dword [edi + 4], 0x1b5a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1468
ret
push 0xffff
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x28], ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
push 0xfffe
push esi
push 3
push 0x30
push ebx
mov dword [esp + 0x48], esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x10009a49
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi + 4], 0x1b5a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1468
ret
mov ecx, edi
call fcn.1000a080
mov edx, eax
cmp edx, 0xffffffff
mov dword [esp + 0x14], edx
jne 0x10009a76
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [edi + 4], 0x1b69
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1468
ret
mov ecx, 0x511
xor eax, eax
lea edi, [esp + 0x34]
mov dword [esp + 0x30], ebp
rep stosd dword es:[edi], eax
cmp dword [esp + 0x10], ebp
jbe 0x10009b18
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xc
mov ecx, 0x512
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esi - 0xc]
lea ecx, [esp + 0x40]
push eax
push ecx
call ebx
mov edx, dword [esi - 8]
lea eax, [esp + 0x248]
push edx
push eax
call ebx
mov ecx, dword [esi]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x30]
mov dword [esp + 0x450], ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
call fcn.10009b40
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x38]
push 0x1448
push edx
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
inc ebp
add esi, 0x24
cmp ebp, eax
jb 0x10009a9a
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1468
ret
Function at 0x10009b40
Capabilities:
Query service configuration

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push 0xf01ff
lea eax, [ebx + 0x10]
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
je 0x10009c2a
push esi
push edi
push 0x2000
mov dword [esp + 0x1c], 0
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov ecx, 0x800
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
add esp, 4
lea ecx, [esp + 0x18]
push ecx
push 0x2000
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x10009c18
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebx + 8], edx
mov eax, dword [esi]
mov dword [ebx], eax
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov edx, dword [esi + 0x14]
mov dword [ebx + 0xc], edx
mov eax, dword [esi + 0xc]
lea ecx, [ebx + 0x448]
push eax
push ecx
call edi
mov edx, dword [esi + 0x18]
lea eax, [ebx + 0x848]
push edx
push eax
call edi
mov ecx, dword [esi + 0x10]
lea edx, [ebx + 0x648]
push ecx
push edx
call edi
mov eax, dword [esi + 0x1c]
lea ecx, [ebx + 0xc48]
push eax
push ecx
call edi
lea eax, [ebx + 0x10]
push eax
push str.SYSTEMCONTROLSET001Services_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add ebx, 0x1048
push ebx
push str.Description
push esi
push reloc.WS2_32.dll_bind
call fcn.100075d0
add esp, 0x1c
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x10009c30
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call fcn.1000a080
mov edi, eax
cmp edi, 0xffffffff
jne 0x10009c4c
mov dword [esi + 4], 0x1b69
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
lea eax, [esp + 8]
push 0
push eax
push ecx
push edx
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
jne 0x10009c80
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x1b69
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x10009c90
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
mov esi, dword [edi + 0xc]
push 0xf003f
push 0
push esi
mov ecx, dword [esi + 0x1208]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10009cc9
mov dword [edi + 4], 0x1b68
pop edi
pop esi
pop ecx
ret
mov edx, dword [esi + 0x1200]
mov ecx, dword [esi + 0x1204]
lea eax, [esi + 0xa00]
push edx
mov edx, dword [esp + 0xc]
push eax
push ecx
add esi, 0x800
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10009d0c
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 4], 0x1b67
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x10009d20
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
mov esi, dword [edi + 0xc]
push 0xf003f
push 0
push esi
mov ecx, dword [esi + 0x1208]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10009d59
mov dword [edi + 4], 0x1b68
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 8]
add esi, 0x800
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x10009d85
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 4], 0x1b64
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret

Function at 0x10009da0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 4], 0
mov eax, dword [esi + 0xc]
push ecx
push 0xf003f
push 0
mov edx, dword [eax + 0x1208]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10009dd7
mov dword [esi + 4], 0x1b68
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
push 0x1000f6d0
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
je 0x10009e00
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 4], 0x1b64
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret