joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
clc
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
mov bh, 0x40
add byte [ebx + 0x4f88302], cl
mov eax, dword [edx]
cmp eax, 4
cmp dword ds:[edi + 0xc], 4
cmp byte [edi], cl
test ah, dh
or eax, 0x8b660000
add byte [esi + 0x3b], ah
add bl, byte [ebx]
rol byte [ebx - 0x7abf0120], 0xc0
add byte [eax], al
add byte [eax], al
add bh, al
add eax, 0x4c745c
add byte [eax], al
add byte [eax], al
and al, 0x3c
or al, 0xff
or byte [ebx + 0x38830c46], cl
add byte [edi], cl
test byte [ecx], ah
pop esi
add eax, dword [eax]
test byte [esi + 0xb], dl
add byte [eax], al
inc esp
and al, 0x68
dec esp
add byte [edx + 0x10], ch
push es
and al, 8
or cl, ch
pop ss
out dx, al
invalid
test byte [ebp - 0x16000003], ah
adc eax, 0x8d000350
lea eax, [ecx + 1]
mov esi, 5
add byte [eax], al
add byte [ebx + 0x1890c4d], cl
add byte [ebx + 0x47c704c4], al
add al, 0xc7
inc edi
or byte [eax], al
add byte [eax], al
add cl, ch
hlt

Function at 0x40a005
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
clc
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
mov bh, 0x40
add byte [ebx + 0x4f88302], cl
mov eax, dword [edx]
cmp eax, 4
cmp dword ds:[edi + 0xc], 4
cmp byte [edi], cl
test ah, dh
or eax, 0x8b660000
add byte [esi + 0x3b], ah
add bl, byte [ebx]
rol byte [ebx - 0x7abf0120], 0xc0
add byte [eax], al
add byte [eax], al
add bh, al
add eax, 0x4c745c
add byte [eax], al
add byte [eax], al
and al, 0x3c
or al, 0xff
or byte [ebx + 0x38830c46], cl
add byte [edi], cl
test byte [ecx], ah
pop esi
add eax, dword [eax]
test byte [esi + 0xb], dl
add byte [eax], al
inc esp
and al, 0x68
dec esp
add byte [edx + 0x10], ch
push es
and al, 8
or cl, ch
pop ss
out dx, al
invalid
test byte [ebp - 0x16000003], ah
adc eax, 0x8d000350
lea eax, [ecx + 1]
mov esi, 5
add byte [eax], al
add byte [ebx + 0x1890c4d], cl
add byte [ebx + 0x47c704c4], al
add al, 0xc7
inc edi
or byte [eax], al
add byte [eax], al
add cl, ch
hlt
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.00416f34
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00416f34
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00416f34
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x1000ee21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1000ee30
pop dword [ebp - 4]
mov eax, 0x404231a6
add eax, 0xcfbebc8a
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x34fdc
push 0
mov eax, 0xc8ef64fe
sub eax, 0xb8ed64ba
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x5b7e4ee4
add ecx, 0xa481e8f8
mov edx, eax
mov ebx, 0x1d963baf
sub ebx, 0xd92d1af
add ebx, dword [ebp - 4]
mov esi, 0x9ab4522f
mov edi, dword [ebx]
xor edi, esi
mov dword [edx], edi
add edx, 4
add ebx, 0xf7feeb7b
sub ebx, 0xf7feeb77
loop 0x1000ee89
add eax, 0xfc28a001
add eax, 0x3d83242
xor ebx, ebx
add ebx, eax
add eax, 0x20a13b51
add eax, 0xdf5ec4b4
mov ecx, 0x469cd4c6
sub ecx, 0x369cd4c6
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x10011126
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011130
lea esi, [ecx - 0x78]
jmp 0x10011132
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x1001114e
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x10011201
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x10011213
add eax, 0xffffff84
jmp 0x10011215
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x1002244c
lea ecx, [eax + 4]
call fcn.1000d84d
test eax, eax
js 0x1001127e
cmp dword [ebp + 8], 0
je 0x1001127b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x10011253
inc edi
push 0x11
call esi
test ax, ax
jns 0x1001125f
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x1001126b
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x1001127e
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x10011294
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x2e00ad6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2e00ad7e
pop dword [ebp - 0x2c]
mov eax, 0x66a984a6
add eax, 0xc75728d8
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x999cbbaf
add dword [ebp - 0x3c], 0xb4b5899c
mov dword [ebp - 0x38], 0x129ca07f
sub dword [ebp - 0x38], 0xe069543a
mov dword [ebp - 0x34], 0x4e57c501
add dword [ebp - 0x34], 0xfdf47f2d
mov dword [ebp - 0x30], 0x91168903
sub dword [ebp - 0x30], 0x91168903
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x6dc67716
add eax, 0xc03ca9b2
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x1518f37f
add dword [ebp - 0x3c], 0x5f5975d7
mov dword [ebp - 0x38], 0xd5729f4
sub dword [ebp - 0x38], 0xcbeac87f
mov dword [ebp - 0x34], 0x19bc1bc8
add dword [ebp - 0x34], 0x49b350a4
mov dword [ebp - 0x30], 0xb20bdab0
sub dword [ebp - 0x30], 0xb20bdab0
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xe4a2d519
sub eax, 0xb69fb45d
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x411e6
push 0
call eax
mov ecx, 0x489f
mov esi, eax
mov edx, 0xbfe75517
add edx, 0x6e1e18e9
add edx, dword [ebp - 0x2c]
mov ebx, 0xb2f817d
add ebx, 0x8c0322e5
xor dword [ebp - 0x18], edi
mov edi, dword [edx]
xor dword [ebp - 0x10], 0xd4852ce8
add edi, ebx
sub dword [ebp - 4], 0x614e6372
mov dword [esi], edi
sub dword [ebp - 0x10], eax
add esi, 0x7b326061
add esi, 0x84cd9fa3
add edx, 4
loop 0x2e00ae9a
add eax, 0x2f524bf2
add eax, 0xd0aec95d
mov ebx, eax
add eax, 0x316a406d
add eax, 0xce95bf98
mov ecx, 0xa66199e5
add ecx, 0x879e661b
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e00ad6f
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e00ad6f
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402ee4
pop dword [ebp - 0x44]
mov eax, 0x23c97892
add eax, 0xdc76b652
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x18b69428
sub dword [ebp - 0x54], 0xca644edd
mov dword [ebp - 0x50], 0x94fd04b6
sub dword [ebp - 0x50], 0x62c9b871
mov dword [ebp - 0x4c], 0x177ebebc
sub dword [ebp - 0x4c], 0xcb327a8e
mov dword [ebp - 0x48], 0x88cdf130
sub dword [ebp - 0x48], 0x88cdf130
lea eax, [ebp - 0x54]
push eax
mov eax, 0xeec8203a
sub eax, 0xee879f36
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x680fe078
sub dword [ebp - 0x54], 0xf39d7722
mov dword [ebp - 0x50], 0xa3478265
sub dword [ebp - 0x50], 0x61db20f0
mov dword [ebp - 0x4c], 0xcfdfc07a
sub dword [ebp - 0x4c], 0x6c70540e
mov dword [ebp - 0x48], 0xe36e1dd9
add dword [ebp - 0x48], 0x1c91e227
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x390ab
push 0
call eax
mov ecx, 0xb9ff995f
add ecx, 0x4600b6a7
mov edi, eax
mov ebx, 0x5737e9e5
add ebx, 0xa90efa1b
add ebx, dword [ebp - 0x44]
mov edx, 0x2080ed03
sub edx, 0x3f3525be
add dword [ebp - 0x38], edx
mov esi, dword [ebx]
add dword [ebp - 0x30], 0x95270bc
xor esi, edx
xor dword [ebp - 0x38], edi
mov dword [edi], esi
add dword [ebp - 4], 0x91f86d0d
add edi, 4
add ebx, 0x7e71e2b6
sub ebx, 0x7e71e2b2
loop 0x403001
add eax, 0x89309f3a
add eax, 0x76d093b1
mov ebx, eax
add eax, 0xb978698c
add eax, 0x46879679
mov ecx, 0xa60d71fa
sub ecx, 0xa5cd71fa
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x668a6396
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6e466ef7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
jmp loc.00410000

Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
mov dword [esp + 0xc], 2
jmp 0x403382
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4
Function at 0x18028232
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov bl, cl
push edi
mov byte [ebp - 0x31], bl
call fcn.18026170
test al, al
je 0x1802825d
mov eax, 0x80004005
jmp 0x18028406
xor edi, edi
mov dword [ebp - 0x28], 0x181944d0
lea edx, [ebp - 0x28]
mov dword [ebp - 0x24], edi
mov cl, bl
call fcn.18027d0b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], edi
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], edi
call fcn.1801548d
mov dword [ebp - 0x20], 0x1819440c
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x200
call fcn.1801f60c
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
test bl, bl
jne 0x180282a9
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push edi
push ecx
push 0xf003f
push ecx
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.18019dc8
mov ebx, eax
test ebx, ebx
js 0x180283c6
push edi
push edi
push edi
push edi
push 0x1819d728
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180282e2
mov ebx, edi
jmp 0x180283c6
mov dword [ebp - 8], edi
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
lea ecx, [ebp - 8]
call fcn.1800e9b8
mov esi, dword [ebp - 8]
test eax, eax
js 0x180283b8
xor ebx, ebx
lea ecx, [ebp - 0x20]
inc ebx
push ebx
push esi
push 0x1819d728
call fcn.1801a6b2
test eax, eax
js 0x180283b8
mov ecx, 0x181c71e0
call fcn.180262d2
lea ecx, [ebp - 0x20]
call fcn.180281c7
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.18027a38
mov edi, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
js 0x18028378
cmp edi, eax
je 0x18028378
sub esp, 0xc
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.18024d54
mov cl, byte [ebp - 0x31]
call fcn.18027d80
mov edi, dword [ebp - 0x14]
mov ebx, eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x38], eax
test edi, edi
je 0x180283bc
cmp edi, eax
je 0x1802839a
mov esi, dword [ebp - 0x38]
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.18007012
add edi, 4
cmp edi, esi
jne 0x18028383
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
sub eax, edi
and eax, 0xfffffffc
push eax
push edi
call fcn.1800a288
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
jmp 0x180283be
mov ebx, eax
jmp 0x180283be
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.18007012
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x1819440c
je 0x180283e6
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x200
lea ecx, [ebp - 0x30]
call fcn.180154b8
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x181944d0
je 0x18028404
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1803f47a
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18153500
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.180159b1
test al, al
je 0x1803f66b
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812c700
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.180400a0
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x1803f501
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803f66b
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803f513
mov eax, edi
jmp 0x1803f66d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1803f538
call fcn.1801b6cc
mov esi, eax
jmp 0x1803f667
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.1808128c
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1803f56e
call fcn.1801b6cc
mov esi, eax
jmp 0x1803f652
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18041bf6
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x1803f5e1
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x1803f5a0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a1a30
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803f635
call fcn.1801b6cc
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x1803f640
push esi
call fcn.18118303
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1803f66d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1803f94b
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18153500
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.180159b1
test al, al
je 0x1803fb3c
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812c700
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18040509
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x1803f9d2
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803fb3c
mov ecx, edi
call fcn.1801ccd7
test edi, edi
jns 0x1803f9e4
mov eax, edi
jmp 0x1803fb3e
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1803fa09
call fcn.1801b6cc
mov esi, eax
jmp 0x1803fb38
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.180811cf
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1803fa3f
call fcn.1801b6cc
mov esi, eax
jmp 0x1803fb23
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18041bf6
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x1803fab2
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x1803fa71
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a1a30
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803fb06
call fcn.1801b6cc
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x1803fb11
push esi
call fcn.18118303
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1803fb3e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret