joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d90a
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push edi
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
call esi
cmp eax, 1
je 0x100d959
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
je 0x100d959
call edi
mov dword [ebp - 4], eax
jmp 0x100d9bc
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call edi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x100d980
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 2]
push eax
push 0x40
call edi
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x100d988
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100d954
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
push ebx
call esi
test eax, eax
je 0x100d9b5
cmp dword [ebp - 0x18], 1
jne 0x100d9b5
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x100d9c3
mov dword [ebp - 4], 0x8000ffff
mov esi, dword [ebp - 4]
cmp esi, ebx
jne 0x100d9d8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x100d9e6
cmp dword [ebp - 8], ebx
je 0x100d9e6
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], ebx
je 0x100d9f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
jle 0x100da04
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100da12
Capabilities:
Manipulate user privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0xf0fff
push ebx
mov dword [ebp - 4], ebx
call fcn.01017057
mov esi, eax
cmp esi, ebx
jne 0x100da96
push edi
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x100da8d
cmp esi, ebx
jne 0x100da8d
mov eax, dword [ebp + 0x10]
push dword [eax + edi*4]
lea eax, [ebp - 0xc]
push eax
call fcn.0101b1c8
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0xc]
push 1
push eax
je 0x100da6c
push dword [0x101f2c8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaAddAccountRights
jmp 0x100da7b
push ebx
push dword [0x101f2c8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaRemoveAccountRights
mov esi, eax
cmp esi, 0xc0000060
jne 0x100da87
xor esi, esi
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x100da3e
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaClose
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100e5c1
Capabilities:
Delete user account

Disassembly:
mov eax, 0x101c5fb
call fcn.01017df8
push ecx
push ecx
push esi
push edi
mov esi, ecx
push 0x101f2d0
lea ecx, [ebp - 0x10]
call fcn.01007f02
lea eax, [ebp - 0x14]
push eax
push dword [0x101f2f0]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0101684b
test eax, eax
jne 0x100e616
push 0xf03bf
push edi
push edi
push 1
mov ecx, esi
call fcn.0100de60
push edi
mov ecx, esi
call fcn.0100e39d
push edi
mov ecx, esi
call fcn.0100daa3
push dword [0x101f2f0]
push edi
call sub.NETAPI32.dll_NetUserDel
mov esi, eax
cmp esi, 5
je 0x100e64f
push edi
push edi
push 0x1001858
xor esi, esi
call fcn.0101b209
push edi
push edi
push 0x1001780
call fcn.0101b209
push edi
push edi
push 0x1001938
call fcn.0101b209
cmp esi, edi
jle 0x100e65f
and esi, 0xffff
or esi, 0x80070000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100eee8
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x101c687
call fcn.01017df8
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jne 0x100ef14
mov eax, dword [esi + 0x1c]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x100efed
push edi
push dword [esi + 0x20]
lea ecx, [ebp - 0x1c]
call fcn.01007f02
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x100efb9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
cmp dword [ebp - 0x18], eax
jne 0x100efaa
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x100efa0
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0x10]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x100efb9
cmp dword [esi + 0x28], eax
je 0x100ef8b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call fcn.0101b941
mov ebx, eax
test ebx, ebx
jne 0x100efb9
push dword [ebp - 0x10]
mov eax, dword [esi]
push dword [ebp - 0x14]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
jne 0x100efd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100efb9
push dword [esi + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 2
pop ebx
cmp ebx, 2
jne 0x100efcc
mov eax, dword [esi + 0x14]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 8], eax
xor ebx, ebx
test ebx, ebx
jne 0x100efd4
and dword [esi + 0xc], 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x14], 0
pop edi
je 0x100efed
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100f004
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x101c687
call fcn.01017df8
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jne 0x100f030
mov eax, dword [esi + 0x14]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x100f103
push edi
push dword [esi + 0x18]
lea ecx, [ebp - 0x1c]
call fcn.01007f02
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x100f0d5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
cmp dword [ebp - 0x18], eax
jne 0x100f0c6
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x100f0bc
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x100f0d5
cmp dword [esi + 0x20], eax
je 0x100f0a7
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call fcn.0101b941
mov ebx, eax
test ebx, ebx
jne 0x100f0d5
push dword [ebp - 0x10]
mov eax, dword [esi]
push dword [ebp - 0x14]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
jne 0x100f0e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100f0d5
push dword [esi + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 2
pop ebx
cmp ebx, 2
jne 0x100f0e2
mov eax, dword [esi + 0x10]
mov dword [esi + 4], eax
xor ebx, ebx
test ebx, ebx
jne 0x100f0ea
and dword [esi + 8], 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x14], 0
pop edi
je 0x100f103
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100f56b
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x101c687
call fcn.01017df8
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jne 0x100f597
mov eax, dword [esi + 0x14]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x100f670
push edi
push dword [esi + 0x18]
lea ecx, [ebp - 0x1c]
call fcn.01007f02
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x100f63c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
cmp dword [ebp - 0x18], eax
jne 0x100f62d
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x100f623
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x100f63c
cmp dword [esi + 0x20], eax
je 0x100f60e
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call fcn.0101b941
mov ebx, eax
test ebx, ebx
jne 0x100f63c
push dword [ebp - 0x10]
mov eax, dword [esi]
push dword [ebp - 0x14]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
jne 0x100f653
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100f63c
push dword [esi + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 2
pop ebx
cmp ebx, 2
jne 0x100f64f
lea eax, [esi + 0x10]
push eax
lea ecx, [esi + 4]
call fcn.0100876d
xor ebx, ebx
test ebx, ebx
jne 0x100f657
and dword [esi + 8], 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x14], 0
pop edi
je 0x100f670
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100fd07
Capabilities:
Set registry value

Disassembly:
mov eax, 0x101c760
call fcn.01017df8
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x38]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.01007f02
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x100fe01
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x100fdec
cmp dword [ebp - 0x1c], 2
jne 0x100fd6e
mov dword [ebp - 0x10], 0x80070050
jmp 0x100fddf
push 4
pop eax
push eax
lea ecx, [ebp - 0x20]
push ecx
push eax
push ebx
push 0x1001bfc
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x100fddc
push 0x254
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x100fdb7
push ebx
push dword [esi + 0x54]
push ebx
push esi
call fcn.0100f72d
mov edi, eax
jmp 0x100fdb9
xor edi, edi
cmp edi, ebx
mov byte [ebp - 4], bl
je 0x100fdd5
push dword [ebp + 8]
lea ecx, [edi + 0x78]
call fcn.01008bbb
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
inc dword [esi + 0x30]
jmp 0x100fddc
mov dword [ebp - 0x10], 0x8007000e
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x100fe08
jg 0x100fdf3
mov dword [ebp - 0x10], edi
jmp 0x100fe08
and edi, 0xffff
or edi, 0x80070000
jmp 0x100fdee
mov dword [ebp - 0x10], 0x8000ffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x1010d1f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 1]
push eax
mov esi, ecx
lea eax, [ebp - 1]
xor edi, edi
push eax
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.01010ac2
mov dword [esi + 0x30], edi
push 0xfa0
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], edi
call fcn.01007ea6
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push 0x1001c30
push 0x80000002
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1010db3
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x54]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1001c18
push dword [ebp - 8]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], 4
mov dword [ebp - 0xc], eax
je 0x1010da5
mov dword [ebp - 0xc], 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
je 0x1010dba
mov dword [esi + 0x54], 0x1e
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x101116e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x3f44
call fcn.01017ee0
mov eax, dword [0x101f128]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x3f44]
push 0x1f9f
push eax
call dword [sym.imp.msvcrt.dll__vsnwprintf]
add esp, 0x10
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x3f44]
jne 0x10111b6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10111cc
push dword [ebp + 8]
push eax
call dword [sym.imp.msvcrt.dll_fputws]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0xc
mov ecx, dword [ebp - 4]
call fcn.0101793c
leave
ret

Function at 0x10111db
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001cf0
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1011222
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], esi
pop esi
je 0x1011231
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x1011325
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101f128]
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
add eax, 0x488
push eax
push 0x1001e20
lea eax, [ebp - 0x210]
push 0x1001e14
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
push esi
push 0x1001da0
push edi
call fcn.0101116e
add esp, 0xc
test esi, esi
jle 0x1011392
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.0101793c
leave
ret 4
Function at 0x101149f
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x10020d0
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.0101116e
pop ecx
pop ecx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x10114f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1001ec0
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
jmp 0x10115aa
push 2
lea ecx, [esi + 0x286]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x1011524
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f00
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0101116e
add esp, 0xc
jmp 0x1011592
lea ecx, [esi + 0x84]
push edi
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x101155b
call edi
push eax
push 0x1002080
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0101116e
add esp, 0xc
add esi, 0x488
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1011591
call edi
push eax
push 0x1002030
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0101116e
add esp, 0xc
pop edi
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x10115a2
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call esi
mov esi, dword [ebp - 4]
push esi
push 0x1001fc8
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
xor eax, eax
cmp esi, ebx
pop esi
sete al
pop ebx
leave
ret 4
Function at 0x10115cd
Capabilities:
Create service
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101f128]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1002220
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [ebp - 0x210], ebx
call fcn.0101116e
pop ecx
pop ecx
push edi
mov ecx, esi
call fcn.010113e1
test eax, eax
je 0x1011621
push 0x10021e8
push edi
call fcn.0101116e
pop ecx
pop ecx
mov dword [ebp - 0x210], ebx
jmp 0x1011724
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x214], eax
jne 0x1011658
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001ec0
push edi
mov dword [ebp - 0x210], eax
call fcn.0101116e
add esp, 0xc
jmp 0x1011724
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push 0x10021d8
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 1
push 3
push 0x10
push 0xf01ff
lea eax, [esi + 0x488]
push eax
lea eax, [esi + 0x286]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
mov dword [ebp - 0x21c], eax
jne 0x10116d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002198
push edi
mov dword [ebp - 0x210], eax
call fcn.0101116e
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1011724
lea ecx, [ebp - 0x218]
push ecx
push 1
add esi, 0x84
push eax
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x101170e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002080
push edi
mov dword [ebp - 0x210], eax
call fcn.0101116e
add esp, 0xc
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x210]
push 0x1002148
push edi
call fcn.0101116e
mov ecx, dword [ebp - 4]
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0x210], ebx
pop edi
pop esi
sete al
pop ebx
call fcn.0101793c
leave
ret 4
Function at 0x1011757
Capabilities:
Delete service
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x1002340
push dword [ebp + 8]
xor edi, edi
mov esi, ecx
inc edi
call fcn.0101116e
pop ecx
pop ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.010113e1
test eax, eax
jne 0x1011797
push 0x1002300
push dword [ebp + 8]
call fcn.0101116e
pop ecx
pop ecx
jmp 0x1011832
push ebx
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
jne 0x10117c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001ec0
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
jmp 0x1011831
push 0x10020
add esi, 0x286
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, edi
jne 0x10117f4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f00
jmp 0x10117b9
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
test edi, edi
jne 0x1011825
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10022c0
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop ebx
push 0x1002270
push dword [ebp + 8]
call fcn.0101116e
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1011bda
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0x1002a60
push dword [ebp + 8]
call fcn.0101116e
and dword [ebp - 0x10], 0
push 0x1002a24
push dword [ebp + 8]
call fcn.0101116e
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov esi, 0x1001c30
push esi
mov edi, 0x80000002
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1011d07
push ebx
lea eax, [ebp - 4]
push eax
mov esi, 0x1002a08
push esi
mov ebx, 0x10029b0
push ebx
push edi
call fcn.010172c3
test eax, eax
jne 0x1011c7d
push dword [ebp - 4]
push 0x1002988
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
push ebx
push edi
call fcn.01016d71
push 4
pop ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x10], 1
jmp 0x1011ce5
push 0x100294c
push dword [ebp + 8]
call fcn.0101116e
pop ecx
pop ecx
push 4
pop ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
mov dword [ebp - 0xc], eax
je 0x1011ccc
cmp dword [ebp - 0x18], ebx
jne 0x1011ccc
push dword [ebp - 4]
push 0x10028f8
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
jmp 0x1011ce8
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x1002898
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
jmp 0x1011d19
push eax
push esi
push 0x1002840
push dword [ebp + 8]
call fcn.0101116e
add esp, 0x10
cmp dword [ebp - 0x10], 1
jne 0x1011d45
push 0x10027b0
push dword [ebp + 8]
call fcn.0101116e
pop ecx
pop ecx
push 0x1001a30
push edi
call fcn.01016d71
push 0
mov ecx, 0x101f2fc
call fcn.0100e0a3
push 0x100277c
push dword [ebp + 8]
call fcn.0101116e
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x1011faa
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101f128]
push esi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10014f4
lea eax, [ebp - 0x210]
push eax
call esi
push 0x1002b84
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push 0x1002b7c
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
mov esi, eax
push 0x1002b38
push esi
call fcn.0101116e
add esp, 0x10
push 0
push 0x10019d4
call fcn.010168a2
test eax, eax
je 0x1012033
push eax
push 0x1002ad0
push esi
call fcn.0101116e
add esp, 0xc
push esi
call fcn.01011bda
push 0x1002a94
push esi
call fcn.0101116e
test esi, esi
pop ecx
pop ecx
je 0x101205a
push esi
call dword [sym.imp.msvcrt.dll_fflush]
push esi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101793c
leave
ret