joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106d9b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 3], 0
xor eax, eax
mov word [ebp - 8], ax
mov ecx, dword [0x10b4de8]
mov dx, word [ecx + 6]
mov word [ebp - 0xc], dx
mov eax, dword [0x10b4de8]
add eax, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], 0
jne 0x106da02
mov eax, 0x20
jmp 0x106daf1
cmp dword [ebp + 0xc], 0
jne 0x106da12
mov eax, 0x20
jmp 0x106daf1
call fcn.010633c0
mov byte [ebp - 2], al
mov byte [ebp - 1], 0
jmp 0x106da29
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movsx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
cmp edx, eax
jge 0x106daef
cmp dword [ebp + 8], 0
je 0x106daea
movsx ecx, byte [ebp - 1]
imul edx, ecx, 0x22
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx + 0x14]
mov dword [ebp - 0x18], ecx
movsx edx, byte [ebp - 1]
imul eax, edx, 0x22
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x1c], edx
movsx eax, byte [ebp - 1]
imul ecx, eax, 0x22
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx + 0x18]
mov dword [ebp - 0x14], eax
push 0x19
call fcn.0107ca40
add esp, 4
mov dword [ebp - 0x10], eax
push 0x19
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0108de20
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x15], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x11], 1
movzx edx, byte [0x10afba9]
test edx, edx
je 0x106dac4
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x13], 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0105c9b0
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.0108de60
add esp, 0xc
jmp 0x106da20
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x106e160
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 3], 0
xor eax, eax
mov word [ebp - 8], ax
mov ecx, dword [0x10b4de8]
mov dx, word [ecx + 6]
mov word [ebp - 0xc], dx
mov eax, dword [0x10b4de8]
add eax, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], 0
jne 0x106e1b2
mov eax, 0x20
jmp 0x106e2f0
cmp dword [ebp + 0xc], 0
jne 0x106e1c2
mov eax, 0x20
jmp 0x106e2f0
call fcn.010633c0
mov byte [ebp - 2], al
call fcn.01061310
mov byte [ebp - 4], al
mov byte [ebp - 1], 0
jmp 0x106e1e1
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movsx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
cmp edx, eax
jge 0x106e2ee
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp + 0x18]
movzx eax, byte [edx + ecx]
test eax, eax
jne 0x106e202
jmp 0x106e1d8
cmp dword [ebp + 8], 0
je 0x106e2e9
movsx ecx, byte [ebp - 1]
imul edx, ecx, 0x22
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx + 0x14]
mov dword [ebp - 0x18], ecx
movsx edx, byte [ebp - 1]
imul eax, edx, 0x22
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
je 0x106e254
call fcn.0105b9e0
movzx ecx, al
test ecx, ecx
jne 0x106e24e
call fcn.0105b9c0
movzx edx, al
test edx, edx
je 0x106e254
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x19
call fcn.0107ca40
add esp, 4
mov dword [ebp - 0x10], eax
push 0x19
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0108de20
add esp, 0xc
movsx edx, byte [ebp - 1]
imul eax, edx, 0x22
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + eax + 0x14]
mov dword [ecx], eax
movsx ecx, byte [ebp - 1]
imul edx, ecx, 0x22
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + edx + 0x18]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x15], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x11], 1
movzx edx, byte [0x10afba9]
test edx, edx
je 0x106e2b8
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x13], 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0105c9b0
add esp, 4
movsx edx, byte [ebp - 1]
imul eax, edx, 0x22
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax + 0x18]
push edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.0108de60
add esp, 0xc
jmp 0x106e1d8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x107cda0
Capabilities:
Create process on windows
Get common file path
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x10a4ce0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0107f410
movzx eax, al
test eax, eax
je 0x107cf73
lea ecx, [ebp - 0x2a8]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x107cdec
mov dword [0x10b31a8], 0x91
jmp 0x107cfe6
lea edx, [ebp - 0x2b0]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x107ce13
mov dword [0x10b31a8], 0x91
jmp 0x107cfe6
mov dword [ebp - 0x29c], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x2b0]
mov dword [ebp + ecx - 0x298], edx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + ecx - 0x294], eax
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 0x290], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x29c]
push eax
push 0
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push str.WARNING_:_System_must_reboot_to_have_the_changes_take_effect__Starting_Reboot_
call dword [0x10ba828]
add esp, 4
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0107d420
movzx eax, al
test eax, eax
je 0x107cf71
push 0x104
lea ecx, [ebp - 0x28c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x28c]
push edx
call fcn.01026be0
add esp, 4
movsx eax, byte [ebp + eax - 0x28d]
cmp eax, 0x5c
je 0x107cee5
push 0x109b0f8
lea ecx, [ebp - 0x28c]
push ecx
call fcn.010718d0
add esp, 8
push str.NTDLL.DLL
lea edx, [ebp - 0x28c]
push edx
call fcn.010718d0
add esp, 8
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x107cf71
push str.NtShutdownSystem
mov ecx, dword [ebp - 0x2a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x107cf40
push 1
call dword [ebp - 0x2a4]
jmp 0x107cf62
push 0x164
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsOsHook.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d___GetProcAddress_Fail_n
push 2
call fcn.0108d340
add esp, 0x10
mov edx, dword [ebp - 0x2a0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x107cfe6
jmp 0x107cfe6
push 0x104
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x148]
push ecx
call fcn.01026be0
add esp, 4
movsx edx, byte [ebp + eax - 0x149]
cmp edx, 0x5c
je 0x107cfb5
push 0x109b0f8
lea eax, [ebp - 0x148]
push eax
call fcn.010718d0
add esp, 8
push str.RUNDLL32.EXE
lea ecx, [ebp - 0x148]
push ecx
call fcn.010718d0
add esp, 8
push 0
push 0
push str.shell32.dll_SHExitWindowsEx_2
lea edx, [ebp - 0x148]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01026ff0
mov esp, ebp
pop ebp
ret
Function at 0x107d780
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push str.AFUWIN.5b5b8120_cd0e_11d9_b61b_0001294c3bd8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x107d7a6
mov eax, 0x61
jmp 0x107d7ee
call fcn.0107d490
mov dword [0x10b319c], eax
cmp dword [0x10b319c], 5
ja 0x107d7c6
push 0x80000001
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
jmp 0x107d7d1
push 0x80000041
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.0107f540
movzx eax, al
test eax, eax
je 0x107d7e7
mov dword [0x10ba828], 0x107d720
call fcn.0107e270
xor eax, eax
pop ebp
ret

Function at 0x107d7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x80000000
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
cmp dword [0x10b3450], 0
je 0x107d85a
mov dword [0x10b3450], 0
call fcn.0107e140
test eax, eax
je 0x107d83b
push 0x52
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsWindows.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______Restore_the_action_setting_of_Power_Button_..._successful_n
push 2
call fcn.0108d340
add esp, 0x10
jmp 0x107d85a
push 0x54
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsWindows.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______Restore_the_action_setting_of_Power_Button_..._failure_n
push 2
call fcn.0108d340
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.010242d3
pop ebp
ret
Function at 0x107d9b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10a4ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0
mov byte [ebp - 0x104], 0
push 0xfe
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.01027af0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.01026be0
add esp, 4
add eax, 0x100
push eax
call fcn.0107ca40
add esp, 4
mov dword [ebp - 0x108], eax
push 0x109e3bc
mov edx, dword [ebp + 0xc]
push edx
call fcn.01039970
add esp, 8
mov dword [ebp - 0x10c], eax
push str..EXE
mov eax, dword [ebp + 0xc]
push eax
call fcn.01039970
add esp, 8
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], 0
jne 0x107da87
cmp dword [ebp - 0x110], 0
jne 0x107da87
lea ecx, [ebp - 0x104]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x104]
push eax
push str._s_s.exe
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.01071ae4
add esp, 0x10
jmp 0x107da9a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x108]
push eax
call fcn.010718c0
add esp, 8
mov ecx, dword [ebp - 0x108]
push ecx
push 0x9d
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsWindows.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______szFullName_:__s_n
push 2
call fcn.0108d340
add esp, 0x14
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01026ff0
mov esp, ebp
pop ebp
ret
Function at 0x107dc70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x107dd29
cmp dword [0x10b319c], 5
ja 0x107dcc3
cmp dword [0x10b3410], 0
jne 0x107dcc3
push 0
push 0
push 0x10ab63c
push 0x107e900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10b340c], eax
cmp dword [0x10b340c], 0
jne 0x107dcc3
push str._nERROR:_Could_not_Create_the_Thread_handler_n
call dword [0x10ba828]
add esp, 4
cmp dword [0x10b3450], 0
je 0x107dcd1
jmp 0x107ddba
call fcn.0107ddc0
mov dword [0x10b3450], eax
cmp dword [0x10b3450], 0
je 0x107dd05
push 0x45
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsPowerScheme.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______Destroy_the_action_setting_of_Power_Button_..._successful_n
push 2
call fcn.0108d340
add esp, 0x10
jmp 0x107dd24
push 0x47
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsPowerScheme.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______Destroy_the_action_setting_of_Power_Button_..._failure_n
push 2
call fcn.0108d340
add esp, 0x10
jmp 0x107ddba
cmp dword [0x10b3450], 0
je 0x107ddba
cmp dword [0x10b319c], 5
ja 0x107dd67
cmp dword [0x10b3410], 0
jne 0x107dd67
cmp dword [0x10b340c], 0
je 0x107dd67
mov eax, dword [0x10b340c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10b340c], 0
mov dword [0x10b3450], 0
call fcn.0107e140
test eax, eax
je 0x107dd9b
push 0x59
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsPowerScheme.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______Restore_the_action_setting_of_Power_Button_..._successful_n
push 2
call fcn.0108d340
add esp, 0x10
jmp 0x107ddba
push 0x5b
push str.e:_ami_code_flash_afu3.15.00_afu5.15.01gdkappafu_5.15.01.0075_eip642622_labelversionGdkCoreSourcePkgPlatformLibWindowsPowerScheme.cpp
call fcn.0107c950
add esp, 4
push eax
push str.__s__d______Restore_the_action_setting_of_Power_Button_..._failure_n
push 2
call fcn.0108d340
add esp, 0x10
pop ebp
ret
Function at 0x107e590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x10a4ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14c], 0
push 0x104
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x148]
push ecx
call fcn.01026be0
add esp, 4
movsx edx, byte [ebp + eax - 0x149]
cmp edx, 0x5c
je 0x107e5ef
push 0x109b0f8
lea eax, [ebp - 0x148]
push eax
call fcn.010718d0
add esp, 8
push str.PowrProf.dll
lea ecx, [ebp - 0x148]
push ecx
call fcn.010718d0
add esp, 8
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10b3404], eax
cmp dword [0x10b3404], 0
je 0x107e6b2
push str.SetSuspendState
mov eax, dword [0x10b3404]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10b3448], eax
cmp dword [0x10b3448], 0
jne 0x107e656
push str.__GetProcAddress__SetSuspendState__failure_n
call dword [0x10ba828]
add esp, 4
xor eax, eax
jmp 0x107e6fe
movsx ecx, byte [ebp + 8]
cmp ecx, 1
jne 0x107e684
push str._Run_Hibernate__n
call dword [0x10ba828]
add esp, 4
push 0
push 0
push 1
call dword [0x10b3448]
movzx edx, al
mov dword [ebp - 0x14c], edx
jmp 0x107e6b0
movsx eax, byte [ebp + 8]
cmp eax, 2
jne 0x107e6b0
push str._Run_Suspended__n
call dword [0x10ba828]
add esp, 4
push 0
push 0
push 0
call dword [0x10b3448]
movzx ecx, al
mov dword [ebp - 0x14c], ecx
jmp 0x107e6c4
push str.__LoadLibrary_failure_n
call dword [0x10ba828]
add esp, 4
xor eax, eax
jmp 0x107e6fe
cmp dword [ebp - 0x14c], 0
jne 0x107e6f8
mov dword [ebp - 0x150], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x150], eax
mov edx, dword [ebp - 0x150]
push edx
push str._LastError__0x_x___d_n
call dword [0x10ba828]
add esp, 8
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01026ff0
mov esp, ebp
pop ebp
ret
Function at 0x107e710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x10a4ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14c], 0
push 0x104
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x148]
push ecx
call fcn.01026be0
add esp, 4
movsx edx, byte [ebp + eax - 0x149]
cmp edx, 0x5c
je 0x107e76f
push 0x109b0f8
lea eax, [ebp - 0x148]
push eax
call fcn.010718d0
add esp, 8
push str.Kernel32.dll
lea ecx, [ebp - 0x148]
push ecx
call fcn.010718d0
add esp, 8
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10b3408], eax
cmp dword [0x10b3408], 0
je 0x107e7ef
push str.SetSystemPowerState
mov eax, dword [0x10b3408]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10b344c], eax
cmp dword [0x10b344c], 0
jne 0x107e7cf
push str.__GetProcAddress__SetSystemPowerState__failure_n
call dword [0x10ba828]
add esp, 4
xor eax, eax
jmp 0x107e83b
push str._Run_System_Suspended__n
call dword [0x10ba828]
add esp, 4
push 0
push 1
call dword [0x10b344c]
mov dword [ebp - 0x14c], eax
jmp 0x107e801
push str.__LoadLibrary_failure_n
call dword [0x10ba828]
add esp, 4
xor eax, eax
jmp 0x107e83b
cmp dword [ebp - 0x14c], 0
jne 0x107e835
mov dword [ebp - 0x150], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
push ecx
push str._LastError__0x_x___d_n
call dword [0x10ba828]
add esp, 8
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01026ff0
mov esp, ebp
pop ebp
ret

Function at 0x107f580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x107f597
xor al, al
jmp 0x107f5d4
push 0
lea eax, [ebp - 8]
push eax
push 0x105
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x10ab64c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 2], al
movzx eax, byte [ebp - 2]
test eax, eax
je 0x107f5cd
cmp dword [ebp - 8], 0x105
jne 0x107f5cd
mov byte [ebp - 1], 1
jmp 0x107f5d1
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x107f6b0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x107f6d6
xor al, al
jmp 0x107f712
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x107f6fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x107f6fb
mov byte [ebp - 1], 0
jmp 0x107f6ff
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov byte [ebp - 2], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret
Function at 0x107f720
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x10a4ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp + 8]
push eax
push str..Global_s
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
jne 0x107f7ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
je 0x107f785
xor al, al
jmp 0x107f7ca
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
jne 0x107f7ae
xor al, al
jmp 0x107f7ca
cmp dword [ebp + 0xc], 0
je 0x107f7be
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
jmp 0x107f7c8
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01026ff0
mov esp, ebp
pop ebp
ret

Function at 0x107f7e0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10a4ce0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x107f810
xor al, al
jmp 0x107f840
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x2c], 1
jne 0x107f839
mov byte [ebp - 0x21], 1
jmp 0x107f83d
mov byte [ebp - 0x21], 0
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01026ff0
mov esp, ebp
pop ebp
ret

Function at 0x107f850
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x107f876
xor al, al
jmp 0x107f8a0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xc], 1
jne 0x107f899
mov byte [ebp - 1], 1
jmp 0x107f89d
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x108d4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.01073764
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.010725a7
add esp, 0x10
pop ebp
ret
Function at 0x108d4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.01073764
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.010727ac
add esp, 0x10
pop ebp
ret

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219