joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100493de
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100bc210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10049461
push 0x228
lea eax, [ebp - 0x22c]
push edi
push eax
call fcn.1008a830
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1004944d
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x10049454
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x10049434
jmp 0x1004945a
mov edi, dword [ebp - 0x218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10086e31
leave
ret 4

Function at 0x100494be
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x1009d5a6
call fcn.10094bba
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10084bc8
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0xc]
push 0x1001d3e4
xor ebx, ebx
mov eax, esi
mov byte [ebp - 4], 1
call fcn.100848f9
mov eax, dword [esi]
mov edx, dword [eax - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [eax - 4]
mov eax, 0x208
sub edx, eax
or ecx, edx
jge 0x10049511
mov ecx, esi
call fcn.10084a51
push dword [esi]
xor ebx, ebx
push ebx
push 0x10018400
push edi
call fcn.100494af
test eax, eax
jne 0x1004952f
lea eax, [edi - 0x10]
call fcn.10084c29
jmp 0x1004954d
or eax, 0xffffffff
call fcn.1008481d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea eax, [edi - 0x10]
je 0x10049528
call fcn.10084c29
mov bl, 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10084c29
mov al, bl
call fcn.10094ca6
ret 8
Function at 0x10049b11
Capabilities:
Enumerate gui resources

Disassembly:
push 0x30
mov eax, 0x100a3bef
call fcn.10094bba
push 0x1000c9d4
lea eax, [ebp - 0x14]
push eax
call fcn.1005f448
and dword [ebp - 4], 0
mov edi, 0x1000ca30
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.1005f448
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push 0x1000c9e8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
mov edi, ebx
call fcn.10062cbe
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 0x10049d8c
mov dword [ebp - 0x30], esi
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x2c]
lea edi, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.10049d20
push ebx
push dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.10049c3a
mov eax, dword [esi]
xor edi, edi
mov ecx, esi
cmp dword [ebx + 4], edi
jne 0x10049be2
push 0x1000ca40
push 2
call dword [eax + 4]
lea edi, [ebp - 0x2c]
call fcn.10062cbe
lea edi, [ebp - 0x3c]
call fcn.10062cbe
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0
call fcn.10026674
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10084c29
xor eax, eax
call fcn.10094ca6
ret 4
push 0x1000ca6c
push 2
call dword [eax + 4]
call fcn.10049ac9
mov eax, dword [eax]
mov edx, dword [esi]
push eax
push 2
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebx + 4]
test eax, eax
jle 0x10049bb0
and dword [ebp + 8], edi
test edi, edi
js 0x10049c2f
cmp edi, eax
jge 0x10049c2f
mov eax, dword [ebx]
add eax, dword [ebp + 8]
mov edx, dword [esi]
mov eax, dword [eax + 0x10]
push eax
push 2
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebx + 4]
add dword [ebp + 8], 0x14
inc edi
cmp edi, eax
jl 0x10049c07
jmp 0x10049bb0
call fcn.10083339
int3
Function at 0x10049da3
Capabilities:
Get graphical window text

Disassembly:
push 0x20
mov eax, 0x100a3ba5
call fcn.10094bba
mov edi, ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x14]
je 0x10049eea
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
mov eax, dword [ebx - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [ebx - 4]
mov esi, 0x200
sub eax, esi
or eax, ecx
jge 0x10049e09
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.10084a51
mov ebx, dword [ebp - 0x10]
cmp dword [ebx - 8], esi
jge 0x10049e18
push 0x80070057
call fcn.10084b9b
mov dword [ebx - 0xc], esi
xor eax, eax
mov word [ebx + 0x400], ax
cmp dword [ebx - 4], 1
mov esi, dword [ebx - 8]
jle 0x10049e3c
push dword [ebx - 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.100849b7
mov ebx, dword [ebp - 0x10]
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.1008481d
push dword [edi + 0xc]
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push eax
call fcn.10049817
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
mov byte [ebp + 8], al
push dword [ebp + 8]
mov eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
call fcn.10049a3a
mov byte [ebp - 4], 2
mov eax, dword [edi + 4]
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp eax, ecx
jle 0x10049ec4
mov edx, dword [ebp - 0x2c]
cmp dword [ebp + 8], 0
jl 0x10049f33
cmp dword [ebp + 8], eax
jge 0x10049f33
mov esi, dword [edi]
cmp edx, dword [ecx + esi]
je 0x10049ef5
inc dword [ebp + 8]
add ecx, 0x14
cmp dword [ebp + 8], eax
jl 0x10049e9f
lea eax, [ebp - 0x2c]
push eax
mov esi, edi
call fcn.10062bd6
lea esi, [ebp - 0x2c]
call fcn.10049f48
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10084c29
lea eax, [ebx - 0x10]
call fcn.10084c29
xor eax, eax
inc eax
call fcn.10094ca6
ret 4
mov esi, dword [ebp + 8]
cmp esi, eax
jge 0x10049f33
imul esi, esi, 0x14
add esi, dword [edi]
mov eax, dword [esi]
sub eax, edx
jne 0x10049f25
cmp byte [esi + 0xc], al
setne al
xor ecx, ecx
cmp byte [ebp - 0x20], cl
setne cl
sub eax, ecx
jne 0x10049f25
push dword [ebp - 0x24]
add esi, 8
push esi
call fcn.1005f70a
test eax, eax
jns 0x10049ecf
push dword [ebp + 8]
call fcn.10062c67
jmp 0x10049ec4
call fcn.10083339
int3
Function at 0x1004b5be
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x100a1c0b
call fcn.10094bba
mov edi, dword [ebp + 8]
mov dword [edi], 0x1001bd7c
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ebx, [edi + 4]
push ebx
call fcn.10049260
lea eax, [esi - 0x10]
call fcn.10084c29
and dword [edi + 0x10], 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10026b8b
push 0
push 0x10003658
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.1002672c
test al, al
je 0x1004b675
cmp byte [ebp + 0x10], 0
jne 0x1004b675
push dword [ebp + 0xc]
mov esi, ebx
call fcn.1004931b
push 0xc
call fcn.10088115
mov esi, eax
pop ecx
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x1004b6a5
mov dword [esi], 0x1001bce8
and dword [esi + 4], 0
mov byte [ebp - 4], 7
call fcn.10026562
mov ecx, ebx
mov dword [esi + 8], eax
call fcn.1007490c
call eax
jmp 0x1004b6a0
lea eax, [ebp - 0x28]
call fcn.10026f11
test al, al
je 0x1004b6ac
cmp byte [ebp + 0x10], 0
jne 0x1004b6ac
push 8
call fcn.10088115
mov esi, eax
pop ecx
test esi, esi
je 0x1004b6a5
mov dword [esi], 0x1001bc1c
call fcn.10026562
mov dword [esi + 4], eax
jmp 0x1004b6a7
xor esi, esi
mov dword [edi + 0x10], esi
jmp 0x1004b6c2
push dword [ebp + 0xc]
mov esi, ebx
call fcn.1004931b
mov ecx, ebx
call fcn.1007490c
call eax
mov dword [edi + 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.10026ee6
mov eax, edi
call fcn.10094ca6
ret 0xc

Function at 0x1004ba60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 8], eax
xor eax, eax
push eax
push eax
push esi
push 0x1004ba2d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x1004cbcb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebx]
push 0x20
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x80091007
call dword [eax]
test al, al
je 0x1004ccdb
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test al, al
je 0x1004ccdb
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1004ccd3
push esi
mov esi, 0x100000
push esi
call fcn.100878f8
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1004ccc9
push edi
lea ecx, [ebp + 8]
push ecx
push esi
mov dword [ebp + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
jmp 0x1004cc78
cmp dword [ebp + 8], esi
ja 0x1004ccc0
push dword [ebp + 8]
mov eax, dword [ebx]
push dword [ebp - 8]
mov ecx, ebx
call dword [eax + 8]
test al, al
je 0x1004ccc0
cmp dword [ebp + 8], esi
jne 0x1004cc83
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x1004cc4f
jmp 0x1004ccc0
mov eax, dword [ebx]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, ebx
call dword [eax + 0xc]
test al, al
je 0x1004ccc0
cmp dword [ebp - 0x10], 0x20
jne 0x1004ccb6
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push 8
pop ecx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1004ccb6
and dword [ebp - 0x14], eax
push dword [ebp - 4]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x10]
push dword [ebp - 8]
call fcn.10087908
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x1004e355
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x100a1b07
call fcn.10094bba
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp byte [ebp + 0xc], bl
jne 0x1004e37f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
call fcn.10084bc8
add eax, 0x10
mov dword [esi], eax
jmp 0x1004e3ed
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], ebx
push eax
mov eax, dword [ebp + 0x10]
call fcn.1003ab8e
mov byte [ebp - 4], 1
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp + 0xc]
call fcn.1005ffe7
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.10084c29
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004e3d3
mov eax, dword [edi]
jmp 0x1004e3d8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
call fcn.10084bc8
add eax, 0x10
mov dword [esi], eax
lea eax, [ebx - 0x10]
call fcn.10084c29
mov eax, esi
call fcn.10094ca6
ret 0xc

Function at 0x1004e451
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x100a1ad7
call fcn.10094bba
mov esi, ecx
and dword [ebp - 4], 0
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.1005f448
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1004e4ae
lea eax, [ebp - 0x14]
push eax
call fcn.10028bbf
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1005f5c3
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10084c29
push dword [ebp + 8]
mov eax, edi
call fcn.1005ffa8
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004e4d1
push dword [ebp + 8]
mov esi, dword [esi + 4]
push 0x1000d990
push eax
call fcn.100266c3
add esp, 0xc
jmp 0x1004e527
mov ebx, dword [ebp - 0x10]
mov ecx, esi
call fcn.1004e54a
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
xor ebx, ebx
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
rep stosd dword es:[edi], eax
jmp 0x1004e51a
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
jne 0x1004e506
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084c29
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10084c29
call fcn.10094ca6
ret 4
Function at 0x100514bd
Capabilities:
Accept command line arguments

Disassembly:
push 0x24
mov eax, 0x100a3b2a
call fcn.10094bba
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [esi + 0x1c], eax
mov edi, 0x1001d3e4
push edi
lea eax, [esi + 0x28]
push eax
mov dword [esi], 0x1001c21c
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x14], bl
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
call fcn.1005f448
push edi
lea eax, [esi + 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.1005f448
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.10051464
mov ecx, dword [ebp + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 2
call fcn.1004ebc9
cmp dword [ebp - 0x18], ebx
je 0x10051540
push dword [ebp - 0x18]
call fcn.10087e79
pop ecx
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], 0xa
or dword [esi + 0x84], 0xffffffff
mov byte [esi + 0x70], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x88], ebx
mov byte [ebp - 4], 6
cmp byte [0x100c4402], 1
mov edi, dword [sym.imp.msi.dll_MsiSetPropertyW]
jne 0x10051599
push ebx
push 3
call edi
mov byte [0x100c4402], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10026b8b
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 7
mov dword [ebp + 0xc], 0x102
call fcn.10026f45
test al, al
jne 0x100515c7
mov dword [ebp + 0xc], 2
push ebx
push dword [ebp + 0xc]
call edi
push ebx
push esi
push 0x932
push 0x100516f0
call dword [sym.imp.msi.dll_MsiBeginTransactionW]
push esi
push 0x7fdf
push 0x100516d4
call dword [sym.imp.msi.dll_MsiSetInternalUI]
lea ecx, [ebp - 0x30]
mov dword [esi + 0x88], eax
call fcn.10026ee6
mov eax, esi
call fcn.10094ca6
ret 0x18
Function at 0x10052d6c
Capabilities:
Acquire debug privileges

Disassembly:
push 0x14
mov eax, 0x1009f677
call fcn.10094bba
mov ebx, ecx
call fcn.10052780
push ecx
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [ebp - 0x18], esp
push 0x1000f6a8
push eax
call fcn.1005f448
mov cl, 1
mov edx, ebx
call fcn.10053348
mov ecx, dword [ebx + 0x2c]
mov esi, eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x20]
xor edi, edi
cmp eax, edi
jne 0x10052de0
push 0x1000f60c
lea eax, [ebp - 0x10]
push eax
call fcn.1005f448
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], edi
call fcn.1002b2d5
push 0x100aaea0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x1001b00c
call fcn.1008e427
push edi
push edi
push ecx
call eax
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, edi
je 0x10052dfd
mov edi, dword [ebx + 0x34]
push 0x1000f6cc
push 1
call fcn.1002a44e
mov byte [ebx + 0x38], 1
test esi, esi
je 0x10052e14
push esi
xor eax, eax
call fcn.100533c4
push esi
call fcn.10086e21
pop ecx
call fcn.10052760
mov eax, dword [eax + 4]
test eax, eax
je 0x10052e25
push dword [ebp - 0x14]
call eax
mov eax, dword [ebp - 0x10]
call fcn.10094ca6
ret

Function at 0x10052eaa
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov ebx, eax
mov esi, ecx
call fcn.100756e8
call fcn.10052b66
test eax, eax
jne 0x10052f4e
call fcn.10052780
push ecx
mov dword [ebp - 8], eax
mov eax, esp
mov dword [ebp - 4], esp
push 0x1000f6a8
push eax
call fcn.1005f448
mov cl, 1
mov edx, esi
call fcn.10053348
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.100532af
mov dword [ebp + 8], eax
test eax, eax
jne 0x10052f1f
cmp dword [ebp + 0xc], eax
je 0x10052f1f
test byte [edi], 2
je 0x10052f1f
push ebx
mov ecx, esi
call fcn.10052f5a
test al, al
je 0x10052f1f
push edi
call fcn.100532af
mov dword [ebp + 8], eax
cmp dword [ebp - 4], 0
je 0x10052f3a
push dword [ebp - 4]
xor eax, eax
mov ebx, esi
call fcn.100533c4
push dword [ebp - 4]
call fcn.10086e21
pop ecx
call fcn.10052760
mov eax, dword [eax + 4]
test eax, eax
je 0x10052f4b
push dword [ebp - 8]
call eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100537ce
Capabilities:
Query service status

Disassembly:
push 0x34
mov eax, 0x1009c3d9
call fcn.10094c2d
mov eax, dword [0x100bcf90]
xor ebx, ebx
mov ecx, 0x100bcf90
mov byte [ebp - 0x35], bl
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3c], eax
push 5
push 0x10007434
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
je 0x10053871
push 4
push 0x1000fd40
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edx, eax
cmp edx, ebx
je 0x10053863
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push ebx
push edx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10053855
cmp dword [ebp - 0x30], 1
je 0x10053850
test byte [ebp - 0x2c], 1
jne 0x10053850
mov byte [ebp - 0x35], 1
jmp 0x10053895
mov byte [ebp - 0x35], bl
jmp 0x10053895
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000fd58
jmp 0x1005387d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000fda0
jmp 0x1005387d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000fdd8
lea eax, [ebp - 0x3c]
push eax
call fcn.10084899
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 0x3c]
mov ecx, esi
push 5
call dword [eax + 4]
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
call fcn.10084c29
mov al, byte [ebp - 0x35]
call fcn.10094cbf
ret
Function at 0x100538ae
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x100a3a51
call fcn.10094bba
mov ebx, ecx
cmp byte [0x100c68dc], 0
jne 0x10053a21
mov esi, edi
call fcn.100537ce
test al, al
je 0x10053a21
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push 0x1001d3e4
push eax
call fcn.1005f448
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push 0xd
call dword [eax + 8]
mov dword [ebp - 0x10], 0x3c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10026b8b
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
call fcn.10026f45
test al, al
jne 0x10053921
mov dword [ebp - 0x10], 0x258
push dword [ebp - 0x10]
mov esi, edi
push 0x1000fe18
push 2
call fcn.100266c3
and dword [ebp - 0x14], 0
add esp, 0xc
cmp dword [ebp - 0x10], 0
jle 0x1005396f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push 0
call dword [eax]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebx + 4], 0
jne 0x1005399c
mov esi, edi
call fcn.100537ce
test al, al
je 0x100539b8
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x1005393f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
cmp eax, 2
je 0x100539ca
cmp eax, 5
mov eax, dword [edi]
mov ecx, edi
je 0x10053a0e
push 0x100100f8
push 2
call dword [eax + 4]
mov dword [ebp - 0x10], 1
jmp 0x10053921
mov eax, dword [edi]
push 0x1000fec0
push 2
mov ecx, edi
call dword [eax + 4]
xor bl, bl
lea ecx, [ebp - 0x2c]
call fcn.10026ee6
mov al, bl
jmp 0x10053a23
mov eax, dword [edi]
push 0x1000ff24
push 2
mov ecx, edi
call dword [eax + 4]
mov bl, 1
jmp 0x100539ac
push 0x1000ff54
lea eax, [ebp + 0xc]
push eax
call fcn.1005f448
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.10062198
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10084c29
mov eax, dword [edi]
push 0x1000ff68
push 2
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x100539aa
push 0x10010020
push 2
call dword [eax + 4]
mov byte [0x100c68dc], 1
jmp 0x100539c6
mov al, 1
call fcn.10094ca6
ret 0xc
Function at 0x10053ccd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [esi + 4], bl
je 0x10053d72
cmp dword [esi + 0x18], ebx
jne 0x10053d72
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x18], eax
cmp eax, ebx
jne 0x10053d06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10053d6d
push edi
push 0x10
call fcn.100878f8
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x10053d1e
mov dword [ebp - 4], 0xe
jmp 0x10053d6c
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi], esi
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x10053d40
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push edi
push 0x10053d81
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x10053d6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x18]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], ebx
pop edi
mov eax, dword [ebp - 4]
jmp 0x10053d77
mov eax, 0x10dd
pop ebx
leave
ret 0xc

Function at 0x10053fea
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [esi + 0x2c]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ebx, [esi + 0x1c]
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10054089
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
jne 0x1005406f
mov eax, dword [esi + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
test edi, edi
jne 0x1005405b
push eax
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10054089
jmp 0x10054060
cmp edi, 0xffffffff
jne 0x1005406a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1005406f
mov edi, 0x3e3
test edi, edi
je 0x10054089
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov byte [esi + 0x39], 0
mov eax, edi
pop edi
pop ebx
leave
ret 8