joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803c040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10018
call fcn.1814ba20
mov eax, dword [0x1819f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
mov dword [ebp - 0x10014], eax
mov esi, dword [eax + 0x28]
test esi, esi
je 0x1803c179
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
push ecx
mov dword [eax + 0x28], ecx
lea eax, [ebp - 0x1000c]
push eax
push 0x10000
lea eax, [ebp - 0x10008]
mov dword [ebp - 0x1000c], ecx
push eax
push esi
call edi
mov ecx, dword [ebp - 0x1000c]
mov ebx, ecx
jmp 0x1803c0d3
test ecx, ecx
je 0x1803c0d7
mov ecx, 0x10000
cmp ebx, ecx
je 0x1803c0d7
and dword [ebp - 0x1000c], 0
lea eax, [ebp - 0x1000c]
push 0
push eax
sub ecx, ebx
lea eax, [ebp - 0x10008]
push ecx
add eax, ebx
push eax
push esi
call edi
mov ecx, dword [ebp - 0x1000c]
add ebx, ecx
test eax, eax
jne 0x1803c09f
lea eax, [ebp - 0x10018]
mov dword [ebp - 0x10018], 0xf
push eax
push ebx
lea eax, [ebp - 0x10008]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov ecx, dword [ebp - 0x10014]
mov edi, eax
add ecx, 0x38
push ecx
lea ecx, [ebp - 0x10010]
call fcn.1800d539
test edi, edi
je 0x1803c140
mov edi, dword [ebp - 0x10014]
xor eax, eax
mov word [ebp + ebx - 0x10008], ax
lea eax, [ebp - 0x10008]
push eax
call fcn.1813397d
pop ecx
push eax
lea eax, [ebp - 0x10008]
push eax
lea ecx, [edi + 0x54]
call fcn.18005b56
jmp 0x1803c165
cmp ebx, 0x10002
jae 0x1803c186
mov ecx, dword [ebp - 0x10014]
lea eax, [ebp - 0x10008]
push eax
mov byte [ebp + ebx - 0x10008], 0
lea ecx, [ecx + 0x54]
call fcn.1800ae48
mov ecx, dword [ebp - 0x10010]
mov eax, dword [ecx]
call dword [eax + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.18128eaf
leave
ret
call fcn.18129723
int3
Function at 0x180420b9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
xor edx, edx
push edi
xor edi, edi
push edi
mov eax, dword [ebx + 0x88]
push 0x80
cmp dword [eax + 0x30], edi
setne dl
lea edx, [edx*2 + 2]
push edx
push edi
push edi
push 0x40000000
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x18042171
mov eax, dword [ebx + 0x88]
cmp dword [eax + 0x30], edi
je 0x18042181
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x1804217a
cmp eax, 0x7fffffff
ja 0x1804217a
mov edx, dword [ebx + 0x88]
push edi
cmp eax, dword [edx + 0x30]
mov ecx, dword [edx + 0x34]
mov dword [ebp - 4], ecx
setg cl
cmp eax, dword [edx + 0x34]
setne al
or cl, al
je 0x18042161
push 0x80
push 2
push edi
push edi
push 0x40000000
mov dword [edx + 0x34], edi
push dword [ebx + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp esi, ebx
je 0x1804215c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
cmp esi, 0xffffffff
jmp 0x1804216f
push edi
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18042184
call fcn.18011478
mov edi, eax
jmp 0x1804218e
mov edi, 0x80004005
jmp 0x1804218e
mov dword [eax + 0x34], edi
mov eax, dword [ebp + 8]
mov ecx, esi
or esi, 0xffffffff
mov dword [eax], ecx
cmp esi, 0xffffffff
je 0x1804219a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x180447f8
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov edi, ecx
mov edx, dword [eax]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov eax, dword [edx - 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], edx
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push 1
push esi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], esi
push eax
push str.gupdate
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x18044854
call fcn.18011478
jmp 0x18044878
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, ecx
push eax
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.18042cbd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov esi, dword [ebp - 0x24]
test eax, eax
js 0x18044919
push ebx
push edi
lea ecx, [ebp - 0x18]
call fcn.1800d539
push dword [ebp + 8]
lea ecx, [edi + 0x1c]
call fcn.18044da2
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x180448d3
push dword [ebp + 8]
lea ecx, [edi + 0x1c]
call fcn.18044dd8
push dword [ebp + 0xc]
lea ecx, [edi + 0x28]
call fcn.18044dd8
lea eax, [ebp - 0x24]
push eax
lea ecx, [edi + 0x34]
call fcn.18044d20
lea eax, [ebp + 8]
mov dword [ebp + 8], 0xffff
push eax
lea ecx, [edi + 0x40]
call fcn.18044c79
jmp 0x18044910
push dword [ebp + 0xc]
lea ecx, [edi + 0x28]
push ebx
call fcn.18044c54
mov ecx, eax
call fcn.18005843
push ebx
lea ecx, [edi + 0x34]
call fcn.18044cfb
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x18044901
push dword [ebp - 0x20]
mov ecx, eax
push esi
call fcn.18044e65
push ebx
lea ecx, [edi + 0x40]
call fcn.18044c54
mov dword [eax], 0xffff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
call dword [eax + 8]
pop ebx
lea ecx, [ebp - 0x24]
call fcn.18009ef9
pop edi
pop esi
leave
ret 0xc
Function at 0x18074b0b
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x18074b80
test bl, 1
je 0x18074b26
mov ecx, dword [esi + 0x14]
call fcn.18050db2
test bl, 2
je 0x18074b33
mov ecx, dword [esi + 0x18]
call fcn.18051ebd
test bl, 4
je 0x18074b40
mov ecx, dword [esi + 0x1c]
call fcn.1805679e
test bl, 8
je 0x18074b4d
mov ecx, dword [esi + 0x20]
call fcn.1805dc81
test bl, 0x10
je 0x18074b5a
mov ecx, dword [esi + 0x24]
call fcn.180684f0
test bl, 0x20
je 0x18074b67
mov ecx, dword [esi + 0x28]
call fcn.180691c3
test bl, 0x40
je 0x18074b74
mov ecx, dword [esi + 0x2c]
call fcn.180508fc
test bl, bl
jns 0x18074b80
mov ecx, dword [esi + 0x30]
call fcn.18052608
test ebx, 0xff00
je 0x18074c0c
test ebx, 0x100
je 0x18074b9c
mov ecx, dword [esi + 0x34]
call fcn.18052a95
test ebx, 0x200
je 0x18074bac
mov ecx, dword [esi + 0x38]
call fcn.18069a9e
test ebx, 0x400
je 0x18074bbc
mov ecx, dword [esi + 0x3c]
call fcn.180562f0
test ebx, 0x800
je 0x18074bcc
mov ecx, dword [esi + 0x40]
call fcn.180562f0
test ebx, 0x1000
je 0x18074bdc
mov ecx, dword [esi + 0x44]
call fcn.1806b6e6
test ebx, 0x2000
je 0x18074bec
mov ecx, dword [esi + 0x48]
call fcn.18051ebd
test ebx, 0x4000
je 0x18074bfc
mov ecx, dword [esi + 0x4c]
call fcn.180562f0
test ebx, 0x8000
je 0x18074c0c
mov ecx, dword [esi + 0x50]
call fcn.18052a95
test ebx, 0xff0000
je 0x18074c98
test ebx, 0x10000
je 0x18074c28
mov ecx, dword [esi + 0x54]
call fcn.18051ebd
test ebx, 0x20000
je 0x18074c38
mov ecx, dword [esi + 0x58]
call fcn.1806cb46
test ebx, 0x40000
je 0x18074c48
mov ecx, dword [esi + 0x5c]
call fcn.18052a95
test ebx, 0x80000
je 0x18074c58
mov ecx, dword [esi + 0x60]
call fcn.18052a95
test ebx, 0x100000
je 0x18074c68
mov ecx, dword [esi + 0x64]
call fcn.18051ebd
test ebx, 0x200000
je 0x18074c78
mov ecx, dword [esi + 0x68]
call fcn.18051ebd
test ebx, 0x400000
je 0x18074c88
mov ecx, dword [esi + 0x6c]
call fcn.18065ced
test ebx, 0x800000
je 0x18074c98
mov ecx, dword [esi + 0x70]
call fcn.18070c24
test ebx, 0xff000000
je 0x18074d2f
test ebx, 0x1000000
je 0x18074cb4
mov ecx, dword [esi + 0x74]
call fcn.1806617c
test ebx, 0x2000000
je 0x18074cc4
mov ecx, dword [esi + 0x78]
call fcn.18066f6f
test ebx, 0x4000000
je 0x18074cd4
mov ecx, dword [esi + 0x7c]
call fcn.180562f0
test ebx, 0x8000000
je 0x18074ce7
mov ecx, dword [esi + 0x80]
call fcn.180505dd
test ebx, 0x10000000
je 0x18074cfa
mov ecx, dword [esi + 0x84]
call fcn.1807239e
test ebx, 0x20000000
je 0x18074d0d
mov ecx, dword [esi + 0x88]
call fcn.180562f0
test ebx, 0x40000000
je 0x18074d20
mov ecx, dword [esi + 0x8c]
call fcn.18052a95
test ebx, ebx
jns 0x18074d2f
mov ecx, dword [esi + 0x90]
call fcn.18066901
test byte [esi + 0xc], 1
je 0x18074d40
mov ecx, dword [esi + 0x94]
call fcn.180737cf
push 8
push 0
push edi
call fcn.1812b9b0
add esp, 0xc
test byte [esi + 4], 1
pop edi
je 0x18074d64
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
pop esi
add ecx, 4
pop ebx
jmp fcn.1804c5f9
pop esi
pop ebx
ret
Function at 0x18074b0c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x18074b80
test bl, 1
je 0x18074b26
mov ecx, dword [esi + 0x14]
call fcn.18050db2
test bl, 2
je 0x18074b33
mov ecx, dword [esi + 0x18]
call fcn.18051ebd
test bl, 4
je 0x18074b40
mov ecx, dword [esi + 0x1c]
call fcn.1805679e
test bl, 8
je 0x18074b4d
mov ecx, dword [esi + 0x20]
call fcn.1805dc81
test bl, 0x10
je 0x18074b5a
mov ecx, dword [esi + 0x24]
call fcn.180684f0
test bl, 0x20
je 0x18074b67
mov ecx, dword [esi + 0x28]
call fcn.180691c3
test bl, 0x40
je 0x18074b74
mov ecx, dword [esi + 0x2c]
call fcn.180508fc
test bl, bl
jns 0x18074b80
mov ecx, dword [esi + 0x30]
call fcn.18052608
test ebx, 0xff00
je 0x18074c0c
test ebx, 0x100
je 0x18074b9c
mov ecx, dword [esi + 0x34]
call fcn.18052a95
test ebx, 0x200
je 0x18074bac
mov ecx, dword [esi + 0x38]
call fcn.18069a9e
test ebx, 0x400
je 0x18074bbc
mov ecx, dword [esi + 0x3c]
call fcn.180562f0
test ebx, 0x800
je 0x18074bcc
mov ecx, dword [esi + 0x40]
call fcn.180562f0
test ebx, 0x1000
je 0x18074bdc
mov ecx, dword [esi + 0x44]
call fcn.1806b6e6
test ebx, 0x2000
je 0x18074bec
mov ecx, dword [esi + 0x48]
call fcn.18051ebd
test ebx, 0x4000
je 0x18074bfc
mov ecx, dword [esi + 0x4c]
call fcn.180562f0
test ebx, 0x8000
je 0x18074c0c
mov ecx, dword [esi + 0x50]
call fcn.18052a95
test ebx, 0xff0000
je 0x18074c98
test ebx, 0x10000
je 0x18074c28
mov ecx, dword [esi + 0x54]
call fcn.18051ebd
test ebx, 0x20000
je 0x18074c38
mov ecx, dword [esi + 0x58]
call fcn.1806cb46
test ebx, 0x40000
je 0x18074c48
mov ecx, dword [esi + 0x5c]
call fcn.18052a95
test ebx, 0x80000
je 0x18074c58
mov ecx, dword [esi + 0x60]
call fcn.18052a95
test ebx, 0x100000
je 0x18074c68
mov ecx, dword [esi + 0x64]
call fcn.18051ebd
test ebx, 0x200000
je 0x18074c78
mov ecx, dword [esi + 0x68]
call fcn.18051ebd
test ebx, 0x400000
je 0x18074c88
mov ecx, dword [esi + 0x6c]
call fcn.18065ced
test ebx, 0x800000
je 0x18074c98
mov ecx, dword [esi + 0x70]
call fcn.18070c24
test ebx, 0xff000000
je 0x18074d2f
test ebx, 0x1000000
je 0x18074cb4
mov ecx, dword [esi + 0x74]
call fcn.1806617c
test ebx, 0x2000000
je 0x18074cc4
mov ecx, dword [esi + 0x78]
call fcn.18066f6f
test ebx, 0x4000000
je 0x18074cd4
mov ecx, dword [esi + 0x7c]
call fcn.180562f0
test ebx, 0x8000000
je 0x18074ce7
mov ecx, dword [esi + 0x80]
call fcn.180505dd
test ebx, 0x10000000
je 0x18074cfa
mov ecx, dword [esi + 0x84]
call fcn.1807239e
test ebx, 0x20000000
je 0x18074d0d
mov ecx, dword [esi + 0x88]
call fcn.180562f0
test ebx, 0x40000000
je 0x18074d20
mov ecx, dword [esi + 0x8c]
call fcn.18052a95
test ebx, ebx
jns 0x18074d2f
mov ecx, dword [esi + 0x90]
call fcn.18066901
test byte [esi + 0xc], 1
je 0x18074d40
mov ecx, dword [esi + 0x94]
call fcn.180737cf
push 8
push 0
push edi
call fcn.1812b9b0
add esp, 0xc
test byte [esi + 4], 1
pop edi
je 0x18074d64
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
pop esi
add ecx, 4
pop ebx
jmp fcn.1804c5f9
pop esi
pop ebx
ret
Function at 0x1807767b
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x180776f0
test bl, 1
je 0x18077696
lea ecx, [esi + 0x10]
call fcn.1804c2b8
test bl, 2
je 0x180776a3
mov ecx, dword [esi + 0x14]
call fcn.1805190d
test bl, 4
je 0x180776b0
mov ecx, dword [esi + 0x18]
call fcn.18051ebd
test bl, 8
je 0x180776bd
mov ecx, dword [esi + 0x1c]
call fcn.18056b68
test bl, 0x10
je 0x180776ca
mov ecx, dword [esi + 0x20]
call fcn.18058201
test bl, 0x20
je 0x180776d7
mov ecx, dword [esi + 0x24]
call fcn.18058201
test bl, 0x40
je 0x180776e4
mov ecx, dword [esi + 0x28]
call fcn.180695df
test bl, bl
jns 0x180776f0
mov ecx, dword [esi + 0x2c]
call fcn.18051ebd
test ebx, 0xff00
je 0x1807777c
test ebx, 0x100
je 0x1807770c
mov ecx, dword [esi + 0x30]
call fcn.18052a95
test ebx, 0x200
je 0x1807771c
mov ecx, dword [esi + 0x34]
call fcn.18069dd1
test ebx, 0x400
je 0x1807772c
mov ecx, dword [esi + 0x38]
call fcn.1806a85f
test ebx, 0x800
je 0x1807773c
mov ecx, dword [esi + 0x3c]
call fcn.1806a85f
test ebx, 0x1000
je 0x1807774c
mov ecx, dword [esi + 0x40]
call fcn.1806bd34
test ebx, 0x2000
je 0x1807775c
mov ecx, dword [esi + 0x44]
call fcn.180505dd
test ebx, 0x4000
je 0x1807776c
mov ecx, dword [esi + 0x48]
call fcn.180505dd
test ebx, 0x8000
je 0x1807777c
mov ecx, dword [esi + 0x4c]
call fcn.18051ebd
test ebx, 0xff0000
je 0x18077808
test ebx, 0x10000
je 0x18077798
mov ecx, dword [esi + 0x50]
call fcn.18051ebd
test ebx, 0x20000
je 0x180777a8
mov ecx, dword [esi + 0x54]
call fcn.1806d7bd
test ebx, 0x40000
je 0x180777b8
mov ecx, dword [esi + 0x58]
call fcn.18051ebd
test ebx, 0x80000
je 0x180777c8
mov ecx, dword [esi + 0x5c]
call fcn.1806e7b4
test ebx, 0x100000
je 0x180777d8
mov ecx, dword [esi + 0x60]
call fcn.18052a95
test ebx, 0x200000
je 0x180777e8
mov ecx, dword [esi + 0x64]
call fcn.18051ebd
test ebx, 0x400000
je 0x180777f8
mov ecx, dword [esi + 0x68]
call fcn.18051ebd
test ebx, 0x800000
je 0x18077808
mov ecx, dword [esi + 0x6c]
call fcn.18051ebd
test ebx, 0x7f000000
je 0x18077889
test ebx, 0x1000000
je 0x18077820
mov ecx, dword [esi + 0x70]
call fcn.1806a359
test ebx, 0x2000000
je 0x18077830
mov ecx, dword [esi + 0x74]
call fcn.18051ebd
test ebx, 0x4000000
je 0x18077840
mov ecx, dword [esi + 0x78]
call fcn.18058201
test ebx, 0x8000000
je 0x18077850
mov ecx, dword [esi + 0x7c]
call fcn.18055714
test ebx, 0x10000000
je 0x18077863
mov ecx, dword [esi + 0x80]
call fcn.1806de25
test ebx, 0x20000000
je 0x18077876
mov ecx, dword [esi + 0x84]
call fcn.18051ebd
test ebx, 0x40000000
je 0x18077889
mov ecx, dword [esi + 0x88]
call fcn.18073fb0
push 4
push 0
push edi
call fcn.1812b9b0
add esp, 0xc
test byte [esi + 4], 1
pop edi
je 0x180778ad
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
pop esi
add ecx, 4
pop ebx
jmp fcn.1804c5f9
pop esi
pop ebx
ret
Function at 0x1807767c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x180776f0
test bl, 1
je 0x18077696
lea ecx, [esi + 0x10]
call fcn.1804c2b8
test bl, 2
je 0x180776a3
mov ecx, dword [esi + 0x14]
call fcn.1805190d
test bl, 4
je 0x180776b0
mov ecx, dword [esi + 0x18]
call fcn.18051ebd
test bl, 8
je 0x180776bd
mov ecx, dword [esi + 0x1c]
call fcn.18056b68
test bl, 0x10
je 0x180776ca
mov ecx, dword [esi + 0x20]
call fcn.18058201
test bl, 0x20
je 0x180776d7
mov ecx, dword [esi + 0x24]
call fcn.18058201
test bl, 0x40
je 0x180776e4
mov ecx, dword [esi + 0x28]
call fcn.180695df
test bl, bl
jns 0x180776f0
mov ecx, dword [esi + 0x2c]
call fcn.18051ebd
test ebx, 0xff00
je 0x1807777c
test ebx, 0x100
je 0x1807770c
mov ecx, dword [esi + 0x30]
call fcn.18052a95
test ebx, 0x200
je 0x1807771c
mov ecx, dword [esi + 0x34]
call fcn.18069dd1
test ebx, 0x400
je 0x1807772c
mov ecx, dword [esi + 0x38]
call fcn.1806a85f
test ebx, 0x800
je 0x1807773c
mov ecx, dword [esi + 0x3c]
call fcn.1806a85f
test ebx, 0x1000
je 0x1807774c
mov ecx, dword [esi + 0x40]
call fcn.1806bd34
test ebx, 0x2000
je 0x1807775c
mov ecx, dword [esi + 0x44]
call fcn.180505dd
test ebx, 0x4000
je 0x1807776c
mov ecx, dword [esi + 0x48]
call fcn.180505dd
test ebx, 0x8000
je 0x1807777c
mov ecx, dword [esi + 0x4c]
call fcn.18051ebd
test ebx, 0xff0000
je 0x18077808
test ebx, 0x10000
je 0x18077798
mov ecx, dword [esi + 0x50]
call fcn.18051ebd
test ebx, 0x20000
je 0x180777a8
mov ecx, dword [esi + 0x54]
call fcn.1806d7bd
test ebx, 0x40000
je 0x180777b8
mov ecx, dword [esi + 0x58]
call fcn.18051ebd
test ebx, 0x80000
je 0x180777c8
mov ecx, dword [esi + 0x5c]
call fcn.1806e7b4
test ebx, 0x100000
je 0x180777d8
mov ecx, dword [esi + 0x60]
call fcn.18052a95
test ebx, 0x200000
je 0x180777e8
mov ecx, dword [esi + 0x64]
call fcn.18051ebd
test ebx, 0x400000
je 0x180777f8
mov ecx, dword [esi + 0x68]
call fcn.18051ebd
test ebx, 0x800000
je 0x18077808
mov ecx, dword [esi + 0x6c]
call fcn.18051ebd
test ebx, 0x7f000000
je 0x18077889
test ebx, 0x1000000
je 0x18077820
mov ecx, dword [esi + 0x70]
call fcn.1806a359
test ebx, 0x2000000
je 0x18077830
mov ecx, dword [esi + 0x74]
call fcn.18051ebd
test ebx, 0x4000000
je 0x18077840
mov ecx, dword [esi + 0x78]
call fcn.18058201
test ebx, 0x8000000
je 0x18077850
mov ecx, dword [esi + 0x7c]
call fcn.18055714
test ebx, 0x10000000
je 0x18077863
mov ecx, dword [esi + 0x80]
call fcn.1806de25
test ebx, 0x20000000
je 0x18077876
mov ecx, dword [esi + 0x84]
call fcn.18051ebd
test ebx, 0x40000000
je 0x18077889
mov ecx, dword [esi + 0x88]
call fcn.18073fb0
push 4
push 0
push edi
call fcn.1812b9b0
add esp, 0xc
test byte [esi + 4], 1
pop edi
je 0x180778ad
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
pop esi
add ecx, 4
pop ebx
jmp fcn.1804c5f9
pop esi
pop ebx
ret
Function at 0x180922fc
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1819f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x18092333
call fcn.18011478
mov ebx, eax
jmp 0x1809240b
push 0x24
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x180923f2
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x18092392
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x180923f9
cmp eax, 3
je 0x18092395
push 0x1c
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.1812b9b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180923f2
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x180923f9
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [ebp - 0x1c], 1
mov dword [ebp - 0x24], eax
je 0x180923f9
call edi
sub eax, dword [ebp - 0x24]
cmp eax, 0x1f40
jae 0x180923e3
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1c
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.1812b9b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x1c]
cmp eax, 1
jne 0x180923ab
jmp 0x180923e6
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x180923f9
mov ebx, 0x800705b4
jmp 0x180923f9
call fcn.18011478
mov ebx, eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x18092406
push esi
call edi
push dword [ebp - 0x28]
call edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18128eaf
leave
ret

Function at 0x18092467
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1819f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x180924dc
push esi
push edi
push 4
push str.Schedule
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x180924ca
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180924c8
cmp dword [ebp - 0x1c], 4
je 0x180924c6
cmp dword [ebp - 0x1c], 2
jne 0x180924c8
mov bl, 1
test esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x180924d5
push esi
call edi
push dword [ebp - 0x24]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.18128eaf
leave
ret
Function at 0x180928bd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0x18092848
mov eax, dword [esi + 0x20]
mov dword [esi + 0x24], eax
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x18092958
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
cmp ecx, eax
je 0x18092958
sub eax, ecx
mov byte [ebp - 1], 0
push ebx
push edi
sar eax, 2
xor edi, edi
test eax, eax
je 0x18092950
xor ebx, ebx
inc ebx
push 0
push 0xf060
push 0x112
push dword [ecx + edi*4]
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x1809292b
cmp byte [esi + 0x30], 0
je 0x18092924
mov eax, dword [esi + 0x20]
push ebx
push dword [eax + edi*4]
call dword [sym.imp.USER32.dll_FlashWindow]
mov dl, bl
mov byte [ebp - 1], dl
jmp 0x1809292e
mov dl, byte [ebp - 1]
mov eax, dword [esi + 0x24]
inc edi
mov ecx, dword [esi + 0x20]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x180928f8
test dl, dl
je 0x18092950
push dword [ebp + 8]
mov ecx, esi
call fcn.180925bc
test al, al
jne 0x18092952
xor bl, bl
pop edi
mov al, bl
pop ebx
jmp 0x1809295a
xor al, al
pop esi
leave
ret 4

Function at 0x180929f7
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1819f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 4
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
cmp ebx, 0xffffffff
jne 0x18092a2a
xor al, al
jmp 0x18092aa3
xor eax, eax
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x18092a97
mov eax, dword [ebp - 0x24]
mov esi, dword [esi + 0x10]
cmp esi, dword [eax + 0x14]
je 0x18092a82
mov ebx, eax
mov eax, dword [esi]
cmp eax, dword [ebp - 0x14]
jne 0x18092a77
mov eax, dword [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.1800ee3c
add esi, 4
cmp esi, dword [ebx + 0x14]
jne 0x18092a5f
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov esi, dword [ebp - 0x24]
test eax, eax
jne 0x18092a52
mov eax, dword [edi]
cmp eax, dword [edi + 4]
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18128eaf
leave
ret 4
Function at 0x18092ab4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov byte [ebp - 1], bl
mov edi, ebx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x18092b0b
push ebx
push dword [ecx + edi*4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x18092ae8
mov dl, 1
mov byte [ebp - 1], dl
jmp 0x18092aeb
mov dl, byte [ebp - 1]
mov eax, dword [esi + 8]
inc edi
mov ecx, dword [esi + 4]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x18092ad3
test dl, dl
je 0x18092b0b
push dword [ebp + 8]
mov ecx, esi
call fcn.180925bc
mov bl, al
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4

Function at 0x18092c23
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push dword [edi + 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [edi + 8]
cmp eax, esi
je 0x18092c4e
test eax, eax
je 0x18092c49
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], esi
mov eax, esi
test eax, eax
je 0x18092c60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne bl
pop edi
pop esi
mov al, bl
pop ebx
ret