joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45df50
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x45df84
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0045de60
test eax, eax
jne 0x45df9d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0045ded0
cmp eax, 1
je 0x45e12a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x45dfd6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x45e052
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45e0d2
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.0045dd90
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x45e0e9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x45dff2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x45e0a0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.0045da40
test eax, eax
je 0x45e0d2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x45e06e
cmp dword [esp + 0x18], 1
jb 0x45e0d2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push getpeername
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.0045d920
cmp eax, 1
je 0x45e11b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x45e0f9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x45e0d2
push ebp
mov ecx, ebx
call fcn.0045e140
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45e12a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x45e140
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x45e172
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.0045ded0
test eax, eax
jne 0x45e18f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x45e1b6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x45e204
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.0045dbe0
test eax, eax
jne 0x45e1ed
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x45e1d3
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push getpeername
mov ecx, edi
call fcn.0045d9b0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x45e227
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x463100
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4631a3
test eax, eax
jbe 0x4631a3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4631a3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46314e
xor esi, esi
jmp 0x463154
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46317f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0041a410
add esi, eax
push esi
mov ebx, esi
call fcn.0041a410
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x463160
pop ebp
test edi, edi
pop edi
jne 0x4631a3
test ebx, ebx
je 0x4631a3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046a700
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4632e5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4633fd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4633fd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047c5f6
mov esi, eax
test esi, esi
je 0x4633fd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4633fd
mov ecx, esi
call fcn.00463250
cmp edi, eax
jge 0x4633fd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x463383
mov dword [esp + 0x34], 1
jmp 0x4633de
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4633fd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00462810
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x465c30
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x465c79
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4660f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00465ca0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00465d20
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00465d20
lea ecx, [esi + 0xc]
call fcn.0047ab80
lea ecx, [esi + 0x10]
call fcn.0047ab80
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004672b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004672b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004672b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0047abf5
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0047abf5
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4674a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x467506
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x467506
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4674e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x47cf99
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47cfd1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047b050
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047b028
jmp 0x47cfdd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47e687
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47e6c9
call fcn.004841fe
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47e6c9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47e6c0
xor eax, eax
jmp 0x47e6d1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047e6d7
pop edi
pop esi
pop ebx
ret 4

Function at 0x48472e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48475c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48477a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00484694
jmp 0x48477a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48477a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00484694
test edi, edi
mov eax, edi
jne 0x484764
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1002b55
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0x100124c
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0xc
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x1002da1
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [0x101ce40]
mov eax, dword [0x101ce38]
mov edx, dword [0x10226c8]
push esi
mov esi, dword [ecx + 4]
push edi
lea edi, [esi + eax + 1]
mov eax, dword [0x101ce44]
cmp eax, edi
jbe 0x1002dce
push 0x1001360
jmp 0x1002ebb
sub eax, edx
cmp dword [ecx + 0x20], 0
jne 0x1002de6
xor ecx, ecx
cmp eax, 1
setne cl
inc ecx
mov eax, ecx
jmp 0x1002f17
dec eax
push ebx
mov ebx, eax
test ebx, ebx
jle 0x1002df9
mov edi, ebx
mov al, byte [edx]
mov byte [esi], al
inc esi
inc edx
dec edi
jne 0x1002df0
cmp dword [ecx + 0x24], 2
jne 0x1002e0e
xor eax, eax
and dword [ecx + 0x10], eax
mov dword [0x101ce38], eax
jmp 0x1002ecd
mov esi, dword [ecx + 0xc]
sub esi, ebx
dec esi
xor edi, edi
cmp esi, edi
jg 0x1002e24
push 0x1001318
jmp 0x1002ebb
mov eax, 0x2000
cmp esi, eax
jle 0x1002e2f
mov esi, eax
cmp dword [ecx + 0x18], edi
je 0x1002e89
test esi, esi
jle 0x1002e80
push dword [0x101ce4c]
call dword [sym.imp.msvcrt.dll_getc]
cmp eax, 0xffffffff
pop ecx
mov ecx, dword [0x101ce40]
je 0x1002e62
cmp eax, 0xa
je 0x1002e67
mov edx, dword [ecx + 4]
add edx, edi
inc edi
cmp edi, esi
mov byte [edx + ebx], al
jl 0x1002e38
cmp eax, 0xa
jne 0x1002e70
mov edx, dword [ecx + 4]
add edx, edi
mov byte [edx + ebx], al
inc edi
cmp eax, 0xffffffff
jne 0x1002e80
mov eax, dword [0x101ce4c]
test byte [eax + 0xc], 0x20
jne 0x1002eb6
mov eax, edi
mov dword [0x101ce38], eax
jmp 0x1002ec6
push dword [0x101ce4c]
mov eax, dword [ecx + 4]
push esi
add eax, ebx
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, edi
mov dword [0x101ce38], eax
jne 0x1002ec0
mov ecx, dword [0x101ce4c]
test byte [ecx + 0xc], 0x20
je 0x1002ec0
push 0x10012f4
call fcn.01002b55
mov ecx, dword [0x101ce40]
test eax, eax
mov dword [ecx + 0x10], eax
jne 0x1002ef4
test ebx, ebx
jne 0x1002eec
push dword [0x101ce4c]
xor esi, esi
inc esi
call fcn.01002d67
mov ecx, dword [0x101ce40]
mov eax, dword [0x101ce38]
jmp 0x1002ef6
push 2
pop esi
mov dword [ecx + 0x24], esi
jmp 0x1002ef6
xor esi, esi
mov edx, dword [ecx + 4]
add eax, ebx
mov byte [eax + edx], 0
mov edx, dword [ecx + 4]
mov byte [eax + edx + 1], 0
mov dword [0x101ce38], eax
mov eax, dword [ecx + 4]
mov dword [0x10226c8], eax
mov eax, esi
pop ebx
pop edi
pop esi
ret
Function at 0x10047cd
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.010047aa
test eax, eax
je 0x10047f5
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1004843
mov eax, dword [ebp + 0x10]
push esi
push edi
add eax, eax
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x1004841
mov eax, dword [ebp + 0x10]
push esi
push esi
lea ecx, [eax + eax]
push ecx
push edi
push eax
push dword [ebp + 0xc]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, esi
mov dword [ebp + 0x10], eax
je 0x100483a
push esi
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1004955
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
lea esi, [ecx + eax*2]
add esi, eax
xor ebx, ebx
push edi
shl esi, 5
xor edi, edi
cmp dword [esi + 0x1020f98], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x1004b51
movzx eax, word [esi + 0x1020f88]
cmp eax, 3
je 0x1004ac7
cmp eax, 8
je 0x1004a9d
cmp eax, 0x2000
je 0x10049f4
push 0x1000
mov esi, 0x101ef50
push esi
push 0x4ea
push dword [0x101ef44]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x10049d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004b54
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push dword [0x101eee4]
call fcn.010047cd
mov dword [ebp - 0xc], 0x80004005
jmp 0x1004b51
mov ebx, dword [0x101eecc]
mov dword [ebp + 0x10], 7
jmp 0x1004a19
push dword [ebx]
call dword [sym.imp.msvcrt.dll_wcslen]
mov ebx, dword [ebx + 4]
pop ecx
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x1004a03
add dword [ebp - 4], 2
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jne 0x1004a86
mov dword [ebp - 0xc], 0x8007000e
jmp 0x1004b42
push dword [eax]
mov eax, dword [ebp - 8]
lea eax, [eax + edi*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [0x101eecc]
push dword [eax]
call dword [sym.imp.msvcrt.dll_wcslen]
lea edi, [edi + eax + 1]
mov eax, dword [0x101eecc]
mov ebx, eax
mov eax, dword [eax + 4]
mov dword [0x101eecc], eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x1004a7e
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [0x101eecc]
test eax, eax
jne 0x1004a3e
mov eax, dword [ebp - 8]
and word [eax + edi*2], 0
mov edi, eax
xor ebx, ebx
jmp 0x1004ad6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 8], ebx
je 0x1004ab9
mov edi, dword [eax + 8]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp - 4], eax
jmp 0x1004abe
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], 1
jmp 0x1004ad6
mov edi, dword [ebp + 0x10]
push 4
pop eax
add edi, 8
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], eax
cmp edi, ebx
je 0x1004b42
push dword [ebp - 4]
mov eax, dword [esi + 0x1020f80]
push edi
push dword [ebp + 0x10]
push ebx
push dword [esi + 0x1020f84]
push dword [eax*4 + 0x101eed8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jge 0x1004b42
push ebx
push ebx
lea eax, [ebp + 0x10]
push eax
push 0x400
push dword [ebp - 0xc]
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1004b42
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push dword [ebp + 0x10]
push dword [0x101eee4]
call fcn.010047cd
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
je 0x1004b51
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004cbc
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x100cdf4]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1004cf1
xor eax, eax
jmp 0x1004d40
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
lea edi, [ebx + 4]
mov dword [edi], eax
je 0x1004d0f
test eax, eax
jne 0x1004d31
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1004d3f
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [ebx], 2
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01009832
leave
ret 8

Function at 0x1004e31
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x100cdf4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x101
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1004e6c
mov eax, 0x80004005
jmp 0x1004eb7
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0x198], eax
je 0x1004e9e
push 2
push 4
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
jne 0x1004e9a
mov ebx, 0x80004005
jmp 0x1004eaf
push dword [eax]
jmp 0x1004e9f
push edi
call fcn.01004b60
test eax, eax
mov dword [esi], eax
jne 0x1004eaf
mov ebx, 0x8007000e
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009832
leave
ret 8
Function at 0x1006a0d
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
push esi
push 0xf01ff
push 0xf003f
push dword [ebp + 8]
call fcn.0100569b
cmp eax, esi
mov dword [ebp + 8], eax
jl 0x1006b8e
cmp eax, 5
je 0x1006b8e
push edi
push esi
push esi
push dword [0x101eec4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1006afa
lea eax, [ebp - 0x20]
push eax
push dword [0x101eec4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1006a75
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006b42
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1006ac0
mov eax, dword [ebp - 8]
push 0xa
xor edx, edx
pop ecx
div ecx
cmp eax, 0x3e8
jae 0x1006a95
mov eax, 0x3e8
jmp 0x1006aa0
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1006aa0
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push dword [0x101eec4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1006ada
cmp dword [ebp - 0xc], edi
jbe 0x1006aca
call esi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x1006ad4
call esi
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
ja 0x1006ada
cmp dword [ebp - 0x1c], 2
je 0x1006a7d
cmp dword [ebp - 0x1c], 4
jne 0x1006afa
push 0x10020a0
push 0x4e30
push dword [0x101eee4]
call fcn.0100591e
jmp 0x1006b8d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
cmp edi, 0x420
mov dword [ebp + 8], edi
jne 0x1006b5d
lea eax, [ebp - 0x20]
push eax
push 4
push dword [0x101eec4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1006b40
push 0x1002058
push 0x4e2f
push dword [0x101eee4]
call fcn.0100591e
and dword [ebp + 8], 0
jmp 0x1006b8d
call esi
push 0x1002000
push 0x4e31
mov dword [ebp + 8], eax
call fcn.01005965
cmp dword [ebp + 8], 0x3e5
jmp 0x1006b83
cmp edi, 5
jne 0x1006b6e
push 0xd6
call fcn.0100484c
jmp 0x1006b8d
push 0x1002000
push 0x4e31
call fcn.01005965
cmp edi, 0x3e5
je 0x1006b8d
push dword [ebp + 8]
call fcn.01004de1
pop edi
call fcn.01004721
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
Function at 0x1006ba0
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x1c
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 8], edi
jne 0x1006bc4
mov eax, 0x8007000e
jmp 0x1006d2a
and dword [ebp - 4], 0
push ebx
push esi
push 0
push 0xf01ff
push 0xf003f
push dword [ebp + 8]
xor ebx, ebx
inc ebx
call fcn.0100569b
mov esi, eax
test esi, esi
jl 0x1006bee
cmp esi, 5
jne 0x1006bfd
push eax
pop esi
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
jmp 0x1006d28
push edi
push dword [ebp + 0xc]
push dword [0x101eec4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1006d03
mov eax, dword [ebp + 0xc]
dec eax
je 0x1006c2a
dec eax
je 0x1006c26
dec eax
jne 0x1006c2c
push 4
pop esi
jmp 0x1006c2c
push 7
jmp 0x1006c23
mov esi, ebx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 8]
push dword [0x101eec4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1006cac
mov eax, dword [ebp - 8]
cmp dword [eax + 4], esi
je 0x1006c69
mov eax, dword [eax + 0x18]
test eax, eax
je 0x1006c57
push eax
jmp 0x1006c5c
push 0x1f4
call edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jle 0x1006c32
jmp 0x1006cba
mov eax, dword [ebp + 0xc]
dec eax
je 0x1006c98
dec eax
je 0x1006c8c
dec eax
jne 0x1006ca8
push 0x10021c0
push 0x4e33
push dword [0x101eee4]
call fcn.0100591e
jmp 0x1006ca8
push 0x1002180
push 0x4e32
jmp 0x1006c7f
push 0x106
push dword [0x101eee4]
call fcn.010058c7
xor ebx, ebx
jmp 0x1006cba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call fcn.01004de1
cmp dword [ebp - 4], 0xa
jle 0x1006d11
mov eax, dword [ebp + 0xc]
dec eax
je 0x1006cef
dec eax
je 0x1006ce3
dec eax
jne 0x1006cff
push 0x1002138
push 0x4e35
push dword [0x101eee4]
call fcn.0100591e
jmp 0x1006cff
push 0x10020f0
push 0x4e34
jmp 0x1006cd6
push 0x18d
push dword [0x101eee4]
call fcn.010058c7
xor ebx, ebx
jmp 0x1006d11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call fcn.01004de1
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
test ebx, ebx
pop ecx
jge 0x1006d23
mov eax, ebx
jmp 0x1006d28
call fcn.01004721
pop esi
pop ebx
pop edi
leave
ret 8