joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c327
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x1001c3fe
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
lea eax, [ebp - 0x18]
pop edi
mov dword [ebp - 0x18], ebx
push edi
push 0xc
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], 8
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x1001c407
cmp dword [ebp - 0x18], ebx
jbe 0x1001c40a
cmp dword [ebp - 0x18], ebx
jbe 0x1001c40a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1001c3bb
mov eax, dword [ebp - 0xc]
test byte [eax + 1], 0x10
jne 0x1001c3c4
add eax, 8
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1001c3cd
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x1001c384
jmp 0x1001c40a
mov dword [ebp - 4], 3
jmp 0x1001c40a
mov dword [ebp - 4], 4
jmp 0x1001c40a
cmp dword [ebp + 0x10], 0x10000000
mov dword [ebp - 8], 1
jne 0x1001c40a
mov eax, dword [ebp - 0xc]
cmp byte [eax], bl
jne 0x1001c3f2
mov ecx, dword [eax + 4]
mov eax, 0x1f0000
and ecx, eax
cmp ecx, eax
je 0x1001c40a
mov dword [ebp - 4], 5
mov dword [ebp - 8], ebx
jmp 0x1001c40a
mov dword [ebp - 4], 1
jmp 0x1001c40a
mov dword [ebp - 4], edi
cmp dword [0x1027ecb0], ebx
je 0x1001c43b
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push str.CKSecurity::IsInAcl_____Inner___ret:__d___myerror:__d___Acl:__08x___Sid:__08x___Mask:__08x___Index:__d_
push str.Security
push 0xffffffffffffffff
push 0x1027e41c
call fcn.100859a0
add esp, 0x28
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d876
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 4], edi
jle 0x1001d898
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1001d89f
inc edi
cmp edi, dword [esi + 4]
jl 0x1001d883
xor eax, eax
pop edi
pop esi
ret 4
push 1
pop eax
jmp 0x1001d89a

Function at 0x1001fa3d
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x1001fa85
mov eax, dword [esi + 8]
cmp dword [eax - 8], edi
je 0x1001fa85
call fcn.100ea4d0
push dword [esi + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x1001fa85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001fa79
push 1
pop edi
jmp 0x1001fa85
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x100205ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
push edi
push esi
call fcn.100205b2
pop ecx
push 2
push esi
push 0xffffffffffffffe0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], esi
push esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x24]
push 0x20
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002063b
push 0xe3
jmp 0x10020646
cmp dword [ebp - 4], 0x20
jae 0x1002064a
push 0xe8
push 7
jmp 0x10020687
cmp dword [ebp - 0x24], 0x4f504554
jne 0x1002068e
lea eax, [ebp - 0x1c]
push 0x18
push eax
call fcn.10020694
cmp dword [ebp - 0x20], eax
pop ecx
pop ecx
jne 0x10020680
cmp dword [ebp + 0xc], esi
je 0x1002067b
lea eax, [ebp - 0x24]
push 0x20
push eax
push dword [ebp + 0xc]
call fcn.10043350
add esp, 0xc
push 1
pop eax
jmp 0x10020690
push 0xf7
push 0xc
call fcn.10020594
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100214dd
Capabilities:
Create directory
Get file attributes

Disassembly:
mov eax, 0x101e56d4
call fcn.100431e8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x100215ab
push edi
call fcn.10042d96
test eax, eax
pop ecx
je 0x100215ab
push edi
lea ecx, [ebp + 8]
call fcn.1005bc60
push 3
push 0x5c
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.1005d670
push 2
push 0x10242c48
push edi
mov esi, eax
call fcn.10043cfb
add esp, 0xc
test eax, eax
jne 0x10021543
inc esi
lea ecx, [ebp + 8]
push esi
push 0x5c
call fcn.1005d670
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x100215bc
lea eax, [ebp - 0x10]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.1005eca0
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
jne 0x10021576
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x10021578
test al, 0x10
je 0x10021595
inc esi
lea ecx, [ebp + 8]
push esi
push 0x5c
call fcn.1005d670
lea ecx, [ebp - 0x10]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.1005c4d0
jmp 0x10021546
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.1005c4d0
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.1005c4d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [ebp + 8]
call fcn.100ea460
push eax
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.1005c4d0
push 1
pop eax
jmp 0x100215ad

Function at 0x1002577a
Capabilities:
Set registry value

Disassembly:
mov eax, 0x101e5cf0
call fcn.100431e8
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
test eax, 0x80000000
jne 0x10025807
mov dword [ebp - 0x10], edi
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.10025fb7
cmp eax, edi
jne 0x100257dc
push esi
mov esi, str.OCULAR_SafeDoc_extension
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push edi
push str.A8A5D364_5D3F_4DF0_9B4E_CD8DD8B09E09
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
pop esi
je 0x100257f5
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x100257ee
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x10025813
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x10025807
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push 0x1027a810
call fcn.10027484
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x10025820
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x101e5d04
call fcn.100431e8
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor esi, esi
test eax, 0x80000000
jne 0x10025879
mov dword [ebp - 0x10], esi
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.10025fb7
cmp eax, esi
jne 0x10025867
push str.A8A5D364_5D3F_4DF0_9B4E_CD8DD8B09E09
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x10025879
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push 0x1027a810
call fcn.1002760f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1002630d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
and dword [ebp - 8], 0
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x1002635a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x10026353
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1002641f
xor esi, esi
jmp 0x1002641f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10026380
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x10026390
xor esi, esi
jmp 0x10026416
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x100263a2
jmp 0x1002636d
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10026416
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x100263d5
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.10043800
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.10043350
add esp, 0xc
and byte [edi + esi], 0
test edi, edi
jne 0x100263dd
xor ebx, ebx
jmp 0x10026408
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10043800
mov ebx, esp
push esi
push ebx
xor eax, eax
push 0xffffffffffffffff
push edi
push eax
push eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ebx
call fcn.1002642b
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10026d75
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x101e5f68
call fcn.100431e8
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.10025fb7
mov edi, eax
cmp edi, esi
je 0x10026dc3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x10026dbc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10026e68
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x10026e38
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.10026d75
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x10026e21
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x10026de6
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x10026e33
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x10026e68
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10026e4b
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x10026e66
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10026e79
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.10043800
push ebx
push esi
push edi
lea eax, [ebp - 0x4018]
mov edi, ecx
push eax
mov dword [ebp - 0x18], edi
call fcn.10026587
xor esi, esi
cmp eax, esi
jl 0x10026ffc
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x4018]
push eax
call fcn.10027009
pop ecx
test eax, eax
pop ecx
jne 0x10026ec4
mov eax, 0x80020009
jmp 0x10026ffc
mov ecx, edi
call fcn.1002655e
lea eax, [ebp - 0x2018]
mov ecx, edi
push eax
call fcn.10026587
cmp eax, esi
jl 0x10026ffc
movzx eax, word [ebp - 0xe]
sub eax, 8
je 0x10026fc1
sub eax, 9
je 0x10026f21
dec eax
dec eax
jne 0x10026feb
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x2018]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x10026fdc
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
jne 0x10026f59
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10043800
mov edi, esp
push ebx
push esi
push edi
call fcn.100432f0
add esp, 0xc
cmp edi, esi
jne 0x10026f63
mov eax, 0x80004005
jmp 0x10026ffc
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jle 0x10026fb1
lea eax, [ebp - 0x2018]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + edi]
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
call fcn.10027090
pop ecx
add dword [ebp - 0xc], 2
mov ecx, dword [ebp - 4]
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x10026f74
xor esi, esi
mov eax, dword [ebp + 8]
push ebx
push edi
push 3
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
jmp 0x10026fe5
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2018]
push eax
push 1
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.10026587
cmp eax, esi
jl 0x10026ffc
xor eax, eax
lea esp, [ebp - 0x4024]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100358a2
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x101e7008
call fcn.100431e8
sub esp, 0xe18
xor edx, edx
push ebx
cmp dword [0x1027ab04], edx
push esi
push edi
jne 0x10035aa9
and byte [ebp - 0x41c], dl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xe22]
mov word [ebp - 0xe24], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], dx
rep stosd dword es:[edi], eax
push str.OAgent.ini
mov dword [0x1027ab04], 1
mov dword [ebp - 0x10], edx
stosw word es:[edi], ax
call fcn.100019f9
push eax
lea eax, [ebp - 0x624]
push 0x1023b350
push eax
call fcn.10043207
add esp, 0x10
lea eax, [ebp - 0x624]
mov esi, 0x400
mov ebx, 0x10279924
push eax
lea eax, [ebp - 0xe24]
push esi
push eax
push ebx
push 0x101fc7d8
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edi, edi
cmp eax, edi
jbe 0x1003598a
cmp word [ebp - 0x626], di
jne 0x1003598a
lea eax, [ebp - 0x41c]
push esi
push eax
lea eax, [ebp - 0xe24]
push eax
call fcn.100a7ef0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jne 0x10035a6c
lea ecx, [ebp - 0x18]
call fcn.10072290
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.10072400
test eax, eax
mov edi, 0x101fc7e0
je 0x100359f9
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push edi
call fcn.10072820
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x100359f9
cmp dword [ebp - 0x10], esi
jae 0x100359ec
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10043350
add esp, 0xc
jmp 0x100359f0
and dword [ebp - 0x10], 0
push dword [ebp - 0x1c]
call fcn.101d505d
pop ecx
lea ecx, [ebp - 0x18]
call fcn.10072450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10072380
cmp dword [ebp - 0x10], 0
jne 0x10035a6c
push 0x800
lea eax, [ebp - 0xe24]
push 0
push eax
call fcn.100432f0
add esp, 0xc
lea eax, [ebp - 0xe24]
push esi
push eax
push ebx
push edi
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x10035a66
cmp word [ebp - 0x626], 0
jne 0x10035a66
lea eax, [ebp - 0x41c]
push esi
push eax
lea eax, [ebp - 0xe24]
push eax
call fcn.100a7ef0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10035aa9
cmp dword [ebp - 0x10], 4
jbe 0x10035aa9
lea eax, [ebp - 0x41c]
test eax, eax
je 0x10035aa9
cmp dword [ebp - 0x41c], 1
je 0x10035aa9
movzx eax, word [ebp - 0x400]
lea eax, [eax + eax + 0x22]
test eax, eax
je 0x10035aa9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffffc
cmp eax, ecx
ja 0x10035aa9
mov eax, dword [ebp - 0x414]
mov dword [0x1027ab00], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10037ef4
Capabilities:
Start service

Disassembly:
push ecx
push esi
call fcn.10070f00
test eax, eax
je 0x10037f11
xor esi, esi
cmp dword [esp + 0xc], esi
jne 0x10037f18
mov dword [0x1027ab40], 0x57
xor eax, eax
jmp 0x10037fde
push ebx
push ebp
push edi
push 0xf003f
push esi
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
mov ebx, str.TSDEncryptDrv
test ebp, ebp
mov edi, 0x1027e41c
je 0x10037f64
push 0x10
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10037f74
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [esp + 0x10], eax
jmp 0x10037f8e
cmp dword [0x1027ecb0], 0
je 0x10037f8e
push str.CTSDEncryptDrv:_StartService_fail_to_OpenSCManager
jmp 0x10037f82
cmp dword [0x1027ecb0], 0
je 0x10037f8e
push str.CTSDEncryptDrv:_StartService_fail_to_OpenService
push ebx
push 4
push edi
call fcn.100859a0
add esp, 0x10
and dword [0x1027ab40], 0
cmp dword [esp + 0x10], 0
jne 0x10037fc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1027ecb0], 0
mov dword [0x1027ab40], eax
je 0x10037fc3
push eax
push eax
push str.CTSDEncryptDrv:_StartService_failed__error_ld_0x_08x__n
push ebx
push 4
push edi
call fcn.100859a0
add esp, 0x18
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10037fd0
push esi
call edi
test ebp, ebp
je 0x10037fd7
push ebp
call edi
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x1005a9c0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1005aa19
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1005aa19
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x1005aa20
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x1005a9fd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1005aa1b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x100604f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10060540
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10060540
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x10060545
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1006052b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x10060552
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x1006b120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x1006b161
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1006b163
mov esi, edi
test esi, esi
je 0x1006b1d8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006b1cd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1006b1cd
cmp dword [esp + 0x1c], eax
jbe 0x1006b19e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006b1cd
cmp esi, edi
je 0x1006b1bf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x1006b1d8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x1006b1f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x1006b255
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1006b255
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x1006b255
cmp dword [esp + 0x18], eax
jbe 0x1006b23b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x1006b259
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x1006b470
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x1006b4e4
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006b4e4
cmp dword [esp + 0x10], 3
jne 0x1006b4e4
mov edx, dword [esp + 0x18]
push edx
call fcn.101d5034
mov edi, eax
add esp, 4
test edi, edi
je 0x1006b4e4
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1006b4db
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.101d505d
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8