joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10076750
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101291d8
push 0x10063b64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x10171dbc]
xor ebx, ebx
cmp eax, ebx
jne 0x100768b0
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100768ab
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x10140804
lea edx, [ebp - 0x42c]
push edx
call fcn.10062d6e
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.100629b7
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x100768ab
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100768a2
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x101507f0
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100768a2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x10171dbc], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x100768a2
push esi
call fcn.10062976
add esp, 4
mov eax, dword [0x10171dbc]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007a880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10123580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call fcn.1003ae10
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call fcn.10033340
mov esi, dword [esp + 0x44]
mov byte [esp + 0x38], 1
cmp esi, 0xffffffff
jne 0x1007a8d0
mov esi, 0xfffffffe
mov edi, dword [esp + 0x40]
push 0x5c
push edi
call fcn.10063640
mov ebp, eax
lea eax, [esp + 0x18]
push esi
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.1007f470
mov eax, dword [esp + 0x28]
add esp, 0x14
xor esi, esi
test eax, eax
jle 0x1007a95d
test ebp, ebp
je 0x1007a916
mov edx, dword [esp + 0x10]
push edi
mov eax, dword [edx + esi*4]
push eax
call fcn.10062ddd
add esp, 8
test eax, eax
je 0x1007a93c
jmp 0x1007a931
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + esi*4]
push eax
call fcn.1004fba0
push eax
push edi
call fcn.10062ddd
add esp, 0xc
test eax, eax
je 0x1007a945
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jl 0x1007a8fb
jmp 0x1007a95d
mov edx, dword [esp + 0x20]
mov esi, dword [edx + esi*4]
jmp 0x1007a94c
mov eax, dword [esp + 0x20]
mov esi, dword [eax + esi*4]
test esi, esi
je 0x1007a95d
push esi
call fcn.1007a780
add esp, 4
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.10033350
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.1003ae20
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x1007d0b0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1007d0fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1007d0fb
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.100629b7
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.100629b7
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x1007d140
test esi, esi
je 0x1007d151
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x1007d14d
push esi
call fcn.10062976
add esp, 4
test ebx, ebx
jne 0x1007d160
mov edi, dword [edi]
test edi, edi
je 0x1007d160
push edi
call fcn.10062976
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100872e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.10063a20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x1008730b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x1008731d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x10087489
push esi
call fcn.100886e0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x10087353
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.10088310
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x10087392
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.10087820
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.10087990
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.10087a90
add esp, 0x24
jmp 0x100873d1
test ebp, ebp
jl 0x1008739e
cmp ebp, 0x80
jle 0x100873b2
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.10088310
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x100873f6
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x100873ff
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.10087820
push esi
call fcn.100886e0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.10087990
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x1008743b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.10087820
push esi
call fcn.100886e0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.10087990
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.10087b40
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x1008746e
jmp 0x100873fd
Function at 0x10088190
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.10063a20
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x100881d9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100881d9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x1014c300
call fcn.101161c4
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.10116174
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100882eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x100882eb
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x100882eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100882eb
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x100882eb
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.10063a20
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x100882eb
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.10062b07
add esp, 8
test eax, eax
je 0x100882eb
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10088e40
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x10093cc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x10093d21
mov al, byte [edi]
test al, al
je 0x10093d21
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x10093cd9
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100a7580
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x100a8e90
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x100a8ef0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x100aa630
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x100aa6d0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x100b17f0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x101247a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1012fcf4
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x100b1831
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.10033350
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.10033350
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.1002da20
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.1002da20
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.1002da20
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.1002da20
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.1002da20
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.1002da20
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.1002da20
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100b3d00
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x101248fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa20
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor esi, esi
call fcn.10033340
mov eax, dword [esp + 0xa5c]
mov dword [esp + 0xa34], ebp
cmp eax, ebp
je 0x100b3d47
push eax
lea ecx, [esp + 0x18]
call fcn.10033590
mov eax, dword [esp + 0xa60]
cmp eax, ebp
je 0x100b3d5c
push eax
lea ecx, [esp + 0x18]
call fcn.10033590
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0x400
cmp eax, ebp
jle 0x100b3dc7
lea eax, [esp + 0xc]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.1003a1c0
add esp, 0x10
test eax, eax
jne 0x100b3dc0
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], 0xffffffff
call fcn.10033350
xor eax, eax
jmp 0x100b3e95
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0xa4c]
mov ecx, dword [esp + 0xa68]
mov edx, dword [esp + 0xa64]
push ebx
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
mov edx, dword [esp + 0xa58]
push esi
mov esi, dword [esp + 0xa50]
push ebp
push eax
mov eax, dword [esp + 0xa60]
push ecx
mov ecx, dword [esp + 0xa60]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, ebp
je 0x100b3e7e
mov ebp, dword [esp + 0xa54]
test ebp, ebp
je 0x100b3e7e
test esi, esi
je 0x100b3e7e
call fcn.10079210
mov eax, dword [0x10172040]
test eax, eax
je 0x100b3e7e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push ebp
stosw word es:[edi], ax
call fcn.10037800
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x28]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x10172040]
lea ecx, [esp + 0x18]
mov dword [esp + 0xa38], 0xffffffff
call fcn.10033350
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0xa2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa2c
ret
Function at 0x100b46d0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x100b46ed
cmp edi, 4
jbe 0x100b46ed
mov dword [0x10172a84], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x100b470c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.1003d2b0
cmp edi, 0xffffffff
je 0x100b4720
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.1003d2b0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x100b4738
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.1003d2b0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100b474e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.1003d460
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100b4765
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.1003d460
mov edi, dword [esp + 0x28]
test edi, edi
je 0x100b478d
push edi
call fcn.10062cc2
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [str.ImagePath]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100b47a4
mov ecx, dword [str.Group]
push eax
push ecx
mov ecx, esi
call fcn.1003d460
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100b47bb
mov edx, dword [str.DependOnGroup]
push eax
push edx
mov ecx, esi
call fcn.1003d8c0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100b47d1
push eax
mov eax, dword [str.DependOnService]
push eax
mov ecx, esi
call fcn.1003d8c0
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x100b5770
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10124b40
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x100b57a3
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp word [esi], 0
jne 0x100b57bb
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.1003c020
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.1003c190
test eax, eax
je 0x100b5867
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.1003e660
test eax, eax
jne 0x100b581c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1003c110
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x100b584f
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.1003c7c0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.1002dbb0
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.1002da20
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x100b592e
mov dword [eax], 0x10
jmp 0x100b592e
mov edx, dword [0x10127994]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x10140804
push ecx
mov byte [esp + 0x24], 2
call fcn.100309a0
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.WS2_32.dll_bind
call fcn.1003c190
test eax, eax
jne 0x100b58db
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.1002da20
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1003c110
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x100b5912
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.1003c7c0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.1002dbb0
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.1002da20
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100b5920
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.1002da20
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1003c110
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100b5960
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10124b68
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x100b5a71
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x100b5a71
cmp word [edi], bx
je 0x100b5a71
cmp word [esi], bx
je 0x100b5a71
lea ecx, [esp + 0xc]
call fcn.1003c020
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x100b5a0f
cmp eax, 1
je 0x100b5a0f
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x18]
call fcn.1003c190
test eax, eax
jne 0x100b59fd
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x18]
call fcn.1003c200
test eax, eax
je 0x100b5a60
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.1003d460
mov esi, eax
jmp 0x100b5af6
mov edx, dword [0x10127994]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x10140804
push ecx
mov byte [esp + 0x2c], 1
call fcn.100309a0
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.WS2_32.dll_bind
call fcn.1003c190
test eax, eax
jne 0x100b5a85
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.1002da20
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.1003c110
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x10127994]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.10062cdf
add esp, 8
cmp eax, ebx
je 0x100b5aaf
add eax, 2
lea ecx, [esp + 0x2c]
push eax
call fcn.1002dca0
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x100b5ac8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.1002da20
jmp 0x100b5a53
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.1003d460
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.1002da20
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.1002da20
lea ecx, [esp + 0xc]
call fcn.1003c1e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.1003c110
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret