joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035440
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e4]
sub esp, 0x6e4
push 0xffffffffffffffff
push 0x1006975d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp + 0x6e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x6ec]
push ebx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
jne 0x1003549e
mov esi, 0x643
jmp 0x10035636
push str.AI_SH_DIR
mov edx, str.ComboBox
mov ecx, ebx
call fcn.1002e5f0
add esp, 4
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x458]
push eax
push str.ProgramMenuFolder
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x10035634
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x40
push eax
lea eax, [ebp + 0x660]
push eax
push 0x100996cc
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x10035634
xor ecx, ecx
lea eax, [ebp + 0x458]
cmp word [ebp + 0x458], cx
je 0x1003551a
nop
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10035510
lea eax, [ebp + 0x458]
mov edx, 0x100962e4
lea eax, [eax + ecx*2]
mov ecx, 0x2a
sub edx, eax
nop
mov word [eax], cx
lea eax, [eax + 2]
movzx ecx, word [edx + eax]
test cx, cx
jne 0x10035530
xor ecx, ecx
push 0x250
mov word [eax], cx
lea eax, [ebp]
push ecx
push eax
call fcn.1004f160
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x10035634
lea eax, [ebp]
mov esi, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp], 0x10
je 0x10035619
mov cx, word [ebp + 0x2c]
cmp cx, 0x2e
jne 0x100355ae
mov ax, word [ebp + 0x2e]
test ax, ax
je 0x10035619
cmp ax, cx
jne 0x100355ae
cmp word [ebp + 0x30], 0
je 0x10035619
lea eax, [ebp + 0x250]
test cx, cx
je 0x100355d5
mov edi, eax
movzx ecx, cx
lea edx, [ebp + 0x2c]
sub edx, edi
mov edi, dword [ebp - 0x14]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx + eax]
test cx, cx
jne 0x100355c6
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x660]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10035619
push 0x10093cf4
lea eax, [ebp + 0x250]
mov edx, ebx
push eax
push eax
push esi
push str.AI_SH_DIR
mov ecx, str.ComboBox
call fcn.1002e0c0
add esp, 0x14
test eax, eax
je 0x10035619
inc esi
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x10035585
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1003564b
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6e0]
xor ecx, ebp
call fcn.1004d40a
lea esp, [ebp + 0x6e4]
pop ebp
ret 4
Function at 0x10037c50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov ebx, dword [ebp + 8]
xor edi, edi
push eax
push 0x10093cf4
mov dword [ebp - 0x28], edi
xor esi, esi
push 0x1009666c
mov dword [ebp - 0x2c], esi
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp eax, 0xea
jne 0x10037cf4
mov esi, dword [ebp - 0x10]
xor ecx, ecx
inc esi
mov edx, 2
mov eax, esi
mov dword [ebp - 0x10], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1009666c
mov dword [ebp - 0x28], edi
push ebx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test esi, esi
je 0x10037dbf
cmp esi, 2
jne 0x10037d0c
mov eax, 0x3a
mov word [edi + 2], ax
jmp 0x10037d11
cmp esi, 3
jne 0x10037d1a
mov eax, 0x5c
mov word [edi + 4], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x10037dbf
mov esi, dword [ebp - 0x18]
imul esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
shr esi, 0xa
imul esi, dword [ebp - 0x20]
shr esi, 0xa
mov byte [ebp - 4], 1
push 0x16
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x14], 0xb
mov edx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, esi
call fcn.100286f0
push ebx
push str.AI_FREE_DISK_SPACE
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x10037db1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10037dd1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100380b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069e34
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp + 8]
mov eax, edx
shr eax, 8
movzx esi, al
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], 0
imul eax, eax, 0x1000193
mov dword [ebp - 0x14], edx
xor esi, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, esi, 0x1000193
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1003a8f0
mov eax, dword [eax + 4]
test eax, eax
je 0x100381d2
cmp eax, dword [0x100aee24]
je 0x100381d2
push dword [eax + 0x10]
mov edx, edi
lea ecx, [ebp - 0x14]
push dword [eax + 0x14]
call fcn.10037e90
add esp, 8
mov dword [ebp - 4], 1
lea esi, [ebx + 4]
mov dword [ebp - 0x1c], esi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.10009d30
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1003821c
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 4]
mov dword [ebx], 0
mov dword [ebp - 0x1c], eax
call fcn.1000a220
mov edi, eax
test edi, edi
je 0x10038230
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebx + 4], eax
mov dword [ebp - 4], 6
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10005390
int3
Function at 0x1003a200
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a38d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x1c]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.1003a8f0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003a28c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x100aee28], 0xaaaaaaa
je 0x1003a3fa
mov dword [ebp - 0x14], 0x100aee24
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x18
push 0x40
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [edi]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 1
mov ecx, dword [0x100aee28]
mov edi, dword [0x100aee3c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1009d870]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x1009d870]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x100aee20]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1003a388
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.100106c0
call fcn.10060c80
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1003a36a
cmp edi, 0x200
jae 0x1003a368
shl edi, 3
cmp edi, ecx
jae 0x1003a36a
mov edi, ecx
push edi
call fcn.1003a490
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003a8f0
mov ecx, dword [0x100aee28]
mov edx, dword [eax]
jmp 0x1003a38b
mov edx, dword [ebp - 0x1c]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x100aee28], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x100aee38]
mov ecx, dword [0x100aee2c]
and eax, ebx
mov dword [ebp - 0x10], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x100aee24]
jne 0x1003a3c3
mov dword [ecx + eax*8], esi
jmp 0x1003a3d2
cmp ebx, edx
jne 0x1003a3cc
mov dword [ecx + eax*8], esi
jmp 0x1003a3d6
cmp dword [ecx + eax*8 + 4], edi
jne 0x1003a3d6
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1004cbfa
int3
Function at 0x1003a490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a3bd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1003a630
lea eax, [ecx - 1]
mov esi, dword [0x100aee24]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100aee2c
lea eax, [edi + edi]
push eax
call fcn.1000df70
lea eax, [edi - 1]
mov dword [0x100aee3c], edi
mov dword [0x100aee38], eax
mov dword [ebp - 0x18], 0x100aee20
mov dword [ebp - 4], 0
mov ecx, dword [0x100aee24]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1003a5ec
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x100aee2c]
imul edi, edi, 0x1000193
and edi, dword [0x100aee38]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 0x10], eax
cmp ebx, esi
jne 0x1003a578
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1003a5e2
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1003a5af
mov eax, dword [eax]
cmp eax, ecx
je 0x1003a5a7
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], ecx
jmp 0x1003a5e2
cmp ebx, eax
je 0x1003a5bf
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1003a60e
cmp ebx, eax
jne 0x1003a5b3
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
jne 0x1003a524
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x1003a5e2
push str.invalid_hash_bucket_count
call fcn.1004cbfa
int3
Function at 0x1003b710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa2c
mov eax, dword [0x100ad040]
xor eax, esp
mov dword [esp + 0xa28], eax
push ebx
mov ebx, dword [esp + 0xa34]
lea eax, [esp + 0xc]
push esi
push edi
push eax
lea eax, [esp + 0x238]
mov dword [esp + 0x18], 0x208
push eax
push str.AI_OFFICE_REG
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x104
push eax
push 0x20019
xor edi, edi
lea eax, [esp + 0x23c]
push edi
push eax
xor esi, esi
push SysReAllocString
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003b815
push eax
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push eax
push edi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1003b7e4
mov edx, str.OPEN
lea ecx, [esp + 0x2c]
call fcn.1002d1f0
push 0
push 0
push 0
test al, al
mov dword [esp + 0x1c], 0x104
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 1]
cmove ecx, esi
lea eax, [esp + 0x40]
push eax
inc edi
mov esi, ecx
push edi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1003b7a2
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1003b7f9
push 0x10093cf4
jmp 0x1003b809
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.100286f0
lea eax, [esp + 0x18]
push eax
push str.AI_ADDIN
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov ecx, dword [esp + 0xa34]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004d40a
add esp, 0xa2c
ret 4
Function at 0x100412c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xffffffffffffffff
push 0x1006b0ed
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp + 0x618], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x624]
mov edi, 0x100adba8
mov eax, dword [edi]
mov esi, dword [edi + 4]
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push 0x410
push eax
call fcn.1002d1b0
add esp, 0xc
lea edx, [ebp]
mov ecx, esi
call fcn.1002dd00
test al, al
je 0x10041344
cmp word [ebp], 0
je 0x1004139b
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
jmp 0x1004139b
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x18]
call fcn.1002df70
mov esi, dword [ebp - 0x14]
test al, al
je 0x1004137b
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1004138d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
add edi, 0xc
cmp edi, 0x100adbe4
jne 0x10041304
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInetStp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100414d1
push eax
lea eax, [ebp + 0x208]
push 0x208
push eax
call fcn.1002d1b0
add esp, 0xc
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 2
push eax
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.PathWWWRoot
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1004143e
push str._SystemDrive_inetpubwwwroot
lea eax, [ebp + 0x208]
push 0x104
push eax
call fcn.10053f50
add esp, 0xc
push 0
lea eax, [ebp + 0x410]
push 0x208
push eax
call fcn.1002d1b0
add esp, 0xc
lea eax, [ebp + 0x410]
push 0x104
push eax
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
lea eax, [ebp + 0x410]
cmp word [ebp + 0x410], cx
je 0x100414be
nop
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10041480
test ecx, ecx
je 0x100414be
cmp word [ebp + ecx*2 + 0x40e], 0x5c
je 0x100414be
mov eax, 0x5c
mov word [ebp + ecx*2 + 0x410], ax
lea eax, [ecx*2 + 2]
cmp eax, 0x208
jae 0x100414f8
xor ecx, ecx
mov word [ebp + eax + 0x410], cx
lea eax, [ebp + 0x410]
push eax
push str.IIsWWWRootFolder
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.1004d40a
lea esp, [ebp + 0x61c]
pop ebp
ret 4
call fcn.1004dc51
int3
Function at 0x10047190
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x438]
sub esp, 0x438
push 0xffffffffffffffff
push 0x1006c355
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp + 0x434], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push 0
lea eax, [ebp + 0x22c]
push 0x208
push eax
call fcn.1002d1b0
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x22c]
push eax
push 0x1009666c
push edi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp ebx, 1
jne 0x1004721a
push str.Stopped
push str.AI_PROCESS_STATE
push edi
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x2c], 0x100940f8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0
push 0x1009ce7c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0
push 2
mov ecx, esi
call dword [0x1006e578]
call esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x10094084
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
lea eax, [ebp]
push 0x22c
push 0
push eax
call fcn.1004f160
push 0
lea eax, [ebp]
push 0x22c
push eax
call fcn.1002d1b0
add esp, 0x18
mov dword [ebp], 0x22c
push 0x1009ce5c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1009ce6c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov ecx, esi
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [0x1006e578]
call esi
test eax, eax
je 0x10047324
mov esi, dword [ebp - 0x18]
lea eax, [ebp + 0x22c]
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1004730f
mov eax, esi
sub eax, 1
je 0x100472fe
sub eax, 1
jne 0x1004730f
push dword [ebp + 8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1004730f
push str.Running
push str.AI_PROCESS_STATE
push edi
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
lea eax, [ebp]
mov ecx, ebx
push eax
push dword [ebp - 0x10]
call dword [0x1006e578]
call ebx
test eax, eax
jne 0x100472c6
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 0x10094084
test eax, eax
je 0x10047344
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x100940f8
test eax, eax
je 0x10047367
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x28], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x434]
xor ecx, ebp
call fcn.1004d40a
lea esp, [ebp + 0x438]
pop ebp
ret
Function at 0x10047580
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c3e5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x10047710
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 1
push 0x30
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 1
push 0x30
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 1
xor ecx, ecx
imul esi, dword [ebp - 0x10], 0x101
mov edx, 2
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov edi, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x10], ebx
jbe 0x100476c1
mov esi, dword [ebp - 0x1c]
cmp word [edi], 0
mov ecx, edi
je 0x10047689
nop dword [eax]
add ecx, 2
cmp word [ecx], 0
jne 0x10047680
mov edx, dword [esi]
push 0xffffffffffffffff
call fcn.10013e00
add esp, 4
mov ecx, edi
cmp word [edi], 0
je 0x100476a9
nop dword [eax]
add ecx, 2
cmp word [ecx], 0
jne 0x100476a0
push 0xffffffffffffffff
mov edx, 0x100968fc
call fcn.10013e00
inc ebx
add esp, 4
add esi, 0x24
cmp ebx, dword [ebp - 0x10]
jb 0x10047671
push edi
push str.AI_SERVICES_LIST
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
test edi, edi
je 0x100476df
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10047702
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4