joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026ed9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10026efb
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10026efb
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10026efb
ret
cmp word [ebx + 4], 0x14c
jne 0x10026efb
test word [ebx + 0x16], 2
je 0x10026efb
test word [ebx + 0x16], 0x100
je 0x10026efb
cmp word [ebx + 0x18], 0x10b
jne 0x10026efb
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10026efb
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10026f87
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10026f1b
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1000de66
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10026efb
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10026f87
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10026efb
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10026efb
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10026efb
ret
cmp word [ebx + 4], 0x14c
jne 0x10026efb
test word [ebx + 0x16], 2
je 0x10026efb
test word [ebx + 0x16], 0x100
je 0x10026efb
cmp word [ebx + 0x18], 0x10b
jne 0x10026efb
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10026efb
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10026f87
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10026f1b
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1000de66
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10026efb
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1002703e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10027097
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1002703e
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1002704d
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042ccf0
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1002709e
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000df14
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1002713d
add edi, 4
add eax, 2
dec ecx
jne 0x10027083
call 0x100270ea
loope 0x100270e0
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1002713a
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1002714b
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100270fe
cmp eax, ecx
ja 0x100270fe
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10027188
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002717e
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000e3f3
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1002704d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10027097
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1002703e
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1002704d
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042ccf0
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1002709e
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000df14
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1002713d
add edi, 4
add eax, 2
dec ecx
jne 0x10027083
call 0x100270ea
loope 0x100270e0
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1002713a
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1002714b
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100270fe
cmp eax, ecx
ja 0x100270fe
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10027188
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002717e
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000e3f3
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1000d0fe
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000d176
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000d14a
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000d148
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000d174
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000d174
push 0
push 0x27a2
push 0x54a2
call fcn.1000e11a
add esp, 0xc
jmp 0x1000d1b1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push 0
push 0x5819
push 0x6208
push 0x64d0
push 0x3ebc
push 0x1238
push 0x519c
push 0x4b99
push dword [ebp - 0x20]
push 0x44bc
call fcn.1000c21d
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x1000eadc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000eb1b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x76ab
push 0x3ab4
push 0
push dword [ebp - 0x10]
call fcn.1000f72b
add esp, 0x18
jmp 0x1000eb8b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000eb81
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000eb65
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1000eb7f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10017dd6
and dword [eax], 0
jmp 0x1000eb5a
jmp 0x1000eb8b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10012343
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001237a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x82f
push 1
push 0x2b45
push 0x342b
push dword [ebp - 4]
push 0x7253
call fcn.100123ce
add esp, 0x18
jmp 0x100123ca
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100123c0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
shr eax, 1
push eax
mov ecx, dword [ebp - 0x20]
call fcn.10017c46
jmp 0x100123ca
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret

Function at 0x10015529
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100155b4
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100155a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10015581
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001559e
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10017dd6
mov dword [eax], 1
jmp 0x10015576
jmp 0x100155b2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100155e5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0
push 0x303f
push 0x46fd
push 0x4808
push 0x79e2
push dword [ebp - 0x20]
push 0x2f5e
push 0xd9b
call fcn.1000c33c
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x1001560d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100156ab
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001565b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10015659
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100156a6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10015689
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x100156a6
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10017dd6
mov dword [eax], 0x23a55a41
jmp 0x1001567e
jmp 0x10015755
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10015732
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
jmp 0x100156e9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jl 0x10015730
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x10], 1
jmp 0x10015708
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1001572e
mov byte [ebp - 2], 0
push 1
push 0x844
push 1
push 0x6dcc
lea eax, [ebp - 2]
push eax
call fcn.1000d0fe
add esp, 0x14
jmp 0x10015701
jmp 0x100156de
jmp 0x10015755
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10015755
push 0
push 0xdf6
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esp, ebp
pop ebp
ret
Function at 0x10015759
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10015782
push 1
push 0x2e89
push 0xc2a
push 0x76e3
call fcn.100157f2
add esp, 0x10
jmp 0x100157ee
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100157c2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100157c0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100157ee
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100157ee
push 0x5505
push 1
push 0x491f
push 1
push 0x3fc7
push 0x2e1
call fcn.1000c271
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x100162be
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070a47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10016450
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001633a
mov byte [ebp - 0x11], 0
push 0x207b
push 1
push 0x2b34
push 1
push 0x745b
push 0x382c
lea eax, [ebp - 0x11]
push eax
push 0x7580
call fcn.100147dd
add esp, 0x20
jmp 0x1001644e
mov dword [ebp - 0x28], 0x4f11
mov dword [ebp - 0x34], 0x10007920
cmp dword [ebp - 0x28], 0x5289
jle 0x100163c3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
and dword [ebp - 0x24], 0
jmp 0x10016368
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4b31
jge 0x100163c3
and dword [ebp - 0x1c], 0
jmp 0x1001637e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x13c2
jge 0x100163c1
and dword [ebp - 0x20], 0
jmp 0x10016394
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1474
jge 0x100163bf
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x10618758
call fcn.10017a2f
jmp 0x1001638d
jmp 0x10016377
jmp 0x10016361
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4c77
jge 0x100163e3
mov edx, dword [ebp - 0x34]
mov ecx, 0x10618758
call fcn.1001bf11
jmp 0x100163ff
or dword [ebp - 4], 0xffffffff
jmp 0x10016409
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x10016431
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x1001644e
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10017dd6
mov dword [eax], 0xdf75dcec
jmp 0x10016426
jmp 0x1001645e
push 1
push 0x5d15
call fcn.1000df94
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d29e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001d358
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d342
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push dword [eax]
mov eax, dword [ebp - 0x3c]
push dword [eax]
push 0
mov eax, dword [ebp - 0x40]
push dword [eax]
mov eax, dword [ebp - 0x44]
push dword [eax]
push 0x7418
call fcn.1001e79f
add esp, 0x1c
jmp 0x1001d356
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001d356
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001d370
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
push 0
push dword [ebp - 0x48]
push 0xd96
call fcn.1002d6d7
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10021506
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10021554
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10021534
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x10021552
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10021552
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002158a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push 0x46f8
push dword [ebp - 0x14]
push 0x6c6d
push 0x315b
push 0x1d2d
push 0x1365
push 0
push 0x28f3
push 0xcd9
call fcn.10026755
add esp, 0x24
mov esp, ebp
pop ebp
ret

Function at 0x10021950
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10021983
push 0x1fd
push 0
push 0x3be9
push 0xfa2
push 0x4e06
push 0x4ac7
call fcn.1002d4ac
add esp, 0x18
jmp 0x100219cf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100219af
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0
call fcn.10021950
add esp, 0xc
jmp 0x100219cf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100219cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10024dbb
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10024ed2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10024e1c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10024ed0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
xor eax, eax
jne 0x10024e6a
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
jne 0x10024e6a
and dword [ebp - 0xc], 0
jmp 0x10024e71
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jl 0x10024e89
mov dword [ebp - 0x10], 1
jmp 0x10024e8d
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [eax]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax]
jne 0x10024ea5
mov dword [ebp - 8], 1
jmp 0x10024ea9
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 8], eax
jg 0x10024ec4
mov dword [ebp - 0x14], 1
jmp 0x10024ec8
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x10024ef8
lea eax, [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10024ef0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x10024ef8
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov esp, ebp
pop ebp
ret
Function at 0x10027240
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10027282
push 0x60e7
push 0x1015
push 0x19fc
push 0x3919
push 0x5d7b
push 0x179e
push 1
push 0x4643
push 0x4ca6
call fcn.100272f7
add esp, 0x24
jmp 0x100272f3
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100272eb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100272cc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100272e9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10017dd6
mov dword [eax], 9
jmp 0x100272c1
jmp 0x100272f3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret