joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d4bb
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
jmp 0x1000d4d5
dec dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 3
cmp eax, dword [ebp + 8]
jbe 0x1000d4fc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov byte [ecx + edx], al
jmp 0x1000d4d2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], 0x52
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx + 1], 0x45
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx + 2], 0x4d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx + 3], 0x20
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 8], eax
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d680c
push 0x101434e0
call fcn.1001bc40
add esp, 8
push str.config.nt
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
call fcn.10005ffa
add esp, 4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1000d5b2
push 0x40003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000d628
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000d5f8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000d628
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000d621
push 0x40005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000d628
xor eax, eax
jmp 0x1000d628
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000dac6
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.1000da42
cmp eax, 0xffffffff
jne 0x1000dae7
mov eax, 0xffffffff
jmp 0x1000dd50
mov eax, dword [0x101436e8]
push eax
call fcn.100053ef
add esp, 4
cmp eax, 0xffffffff
jne 0x1000db14
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x1000dd50
push 0x100d695c
push 0x10143080
call fcn.1001bc30
add esp, 8
push 4
push 0x100d696c
push 1
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000db72
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000dd50
mov dword [ebp - 0x10], 0xffff
push 0x100d6970
push 0x10143080
call fcn.1001bc30
add esp, 8
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dbd6
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000dd50
mov dword [ebp - 0xc], 3
push 0x100d697c
push 0x10143080
call fcn.1001bc30
add esp, 8
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dc3a
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000dd50
mov dword [ebp - 4], 1
push 0x100d6990
push 0x10143080
call fcn.1001bc30
add esp, 8
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dc9e
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000dd50
mov eax, dword [0x101436e8]
push eax
call fcn.10004e8b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000dccf
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x1000dd50
cmp dword [0x10034ed8], 0
je 0x1000dcff
push 0xd
push 0x100d69a8
push 1
push 0x100d69b8
push 0x100d69c4
call fcn.10005808
add esp, 0x14
mov dword [ebp - 8], eax
jmp 0x1000dd1d
push 9
push 0x100d69f8
push 1
push 0x100d6a04
push 0x100d6a10
call fcn.10005808
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000dd3d
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x1000dd50
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000dd50
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000dd55
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x101436e8
push 0x101430d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000dd97
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000de20
push 0x100d6a44
push 0x10143080
call fcn.1001bc30
add esp, 8
push 0xd
push str.Devicehasp
push 1
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000dde9
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000de20
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000de19
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000de20
xor eax, eax
jmp 0x1000de20
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000df02
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
push 0x101430d0
call fcn.1001bc30
add esp, 8
push str.Parallel_arbitrator
push 0x10142710
call fcn.1001bc30
add esp, 8
push 0x101436e8
push 0x101430d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000df68
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e00f
push str.HASP
push 0x10143080
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0x101432d0
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000dfd8
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dfd8
push 0x10004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e00f
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e008
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e00f
xor eax, eax
jmp 0x1000e00f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e014
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov esi, str._SystemRoot_System32Drivers_
lea edi, [ebp - 0x208]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1e9]
xor eax, eax
mov ecx, 0x78
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x100d6b38
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d6b40
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x1000e0c6
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d6b48
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d6b4c
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d6b54
lea eax, [ebp - 0x208]
push eax
call fcn.1001bc40
add esp, 8
push str.SYSTEMCurrentControlSetServicesEventLogSystem_
push 0x101436f0
call fcn.1001bc30
add esp, 8
push 0x100d6b90
push 0x101436f0
call fcn.1001bc40
add esp, 8
push 0x101436e8
push 0x101436f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e123
push 0x10007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e209
push str.EventMessageFile
push 0x10143080
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.1001bd20
add esp, 4
inc eax
push eax
lea eax, [ebp - 0x208]
push eax
push 2
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e192
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e209
push str.TypesSupported
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [ebp - 4], 7
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e1f6
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e209
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000e209
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e20e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push eax
push 0x10008
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x1000e300
mov dword [ebp - 0x208], 0
cmp dword [ebp - 0x20c], 0
jne 0x1000e2fb
mov dword [ebp - 0x204], 0x100
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x200]
push eax
mov eax, dword [ebp - 0x208]
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x103
jne 0x1000e2cf
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000e2fb
cmp dword [ebp - 0x20c], 0
jne 0x1000e2f6
inc dword [ebp - 0x208]
lea eax, [ebp - 0x200]
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000e253
jmp 0x1000e32b
cmp dword [ebp - 0x20c], 2
jne 0x1000e314
xor eax, eax
jmp 0x1000e332
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e332
xor eax, eax
jmp 0x1000e332
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000e337
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e3e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x431
jne 0x1000e3a9
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000e454
cmp dword [ebp - 0xc], 0x430
je 0x1000e3d2
push 0x20003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e454
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
jmp 0x1000e3ec
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0x430
jne 0x1000e403
cmp dword [ebp - 8], 0xa
jl 0x1000e347
cmp dword [ebp - 8], 0xa
jne 0x1000e424
push 0x20003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e454
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1000e44d
push 0x20004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e454
xor eax, eax
jmp 0x1000e454
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e459
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1000e499
push 0x20005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e5bd
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1000e58d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x420
jne 0x1000e56c
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1000e508
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e5bd
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x3c], 1
jne 0x1000e508
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1000e567
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e5bd
jmp 0x1000e58d
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e5bd
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1000e5b6
push 0x20004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e5bd
xor eax, eax
jmp 0x1000e5bd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e5c2
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1000e61a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x1000e603
xor eax, eax
jmp 0x1000e6ce
push 0x20005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e6ce
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1000e67b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x41c
je 0x1000e67b
cmp dword [ebp - 0x24], 0x426
je 0x1000e67b
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e6ce
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x3c], 1
jne 0x1000e67b
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1000e6c7
push 0x20004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e6ce
xor eax, eax
jmp 0x1000e6ce
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000e6d3
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e72b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x1000e714
xor eax, eax
jmp 0x1000e78e
push 0x20005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e78e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1000e75e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20008
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e78e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1000e787
push 0x20002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000e78e
xor eax, eax
jmp 0x1000e78e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e8a9
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
push ebx
push esi
push edi
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x454], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x10143070], eax
cmp dword [0x10143070], 0
jne 0x1000e90e
push 0x20001
call fcn.100042e2
add esp, 4
push 0x2008001
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x1000eae8
cmp dword [ebp + 0xc], 0
je 0x1000e940
mov eax, dword [ebp + 0xc]
push eax
push 0x101434e0
call fcn.1001bc30
add esp, 8
push 0x100d6bbc
push 0x101434e0
call fcn.1001bc40
add esp, 8
jmp 0x1000e962
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6bc0
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x101434e0
lea eax, [ebp - 0x400]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d6bcc
lea eax, [ebp - 0x400]
push eax
call fcn.1001bc40
add esp, 8
push 0x101434e0
lea eax, [ebp - 0x654]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d6bdc
lea eax, [ebp - 0x654]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d6be4
lea eax, [ebp - 0x654]
push eax
call fcn.1001bc40
add esp, 8
test byte [ebp + 8], 2
je 0x1000e9f0
lea eax, [ebp - 0x654]
push eax
push 0x100d6bec
mov eax, dword [0x10143070]
push eax
call fcn.1000e337
add esp, 0xc
mov dword [ebp - 0x450], eax
test byte [ebp + 8], 1
je 0x1000ea27
cmp dword [ebp - 0x450], 0
jne 0x1000ea27
lea eax, [ebp - 0x400]
push eax
push 0x100d6bf4
mov eax, dword [0x10143070]
push eax
call fcn.1000e337
add esp, 0xc
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x450], 0xffffffff
je 0x1000ea41
cmp dword [ebp - 0x454], 0xffffffff
jne 0x1000ea64
mov eax, dword [0x10143070]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2008006
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x1000eae8
mov eax, dword [0x10143070]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x1000eaa7
push 0x20002
call fcn.100042e2
add esp, 4
push 0x2008001
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x1000eae8
push 0x100d6c00
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d6c2c
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
jmp 0x1000eae8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ecdb
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
lea eax, [ebp - 0x204]
push eax
push 0x100d6c5c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1000ed6d
cmp dword [ebp - 0x20c], 5
jne 0x1000ed44
push 0x2010000
call fcn.1000427e
add esp, 4
push 0
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000ee5e
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000ee5e
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesHaspCheck
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x200
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Aladdin_TestX.ttt
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffff
jne 0x1000ee3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 5
jne 0x1000ee17
push 0x2010000
call fcn.1000427e
add esp, 4
push 0
call fcn.100042e2
add esp, 4
jmp 0x1000ee31
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000ee5e
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x200]
push eax
call fcn.10005ffa
add esp, 4
xor eax, eax
jmp 0x1000ee5e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000f3fd
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x100d6d58
push 0x101436f0
call fcn.1001bc30
add esp, 8
push str.PcmciaDataBaseAladdin_Knowledge_Systems_Ltd.PC_CardHASP_V1.1
push 0x101436f0
call fcn.1001bc40
add esp, 8
push 0x101436e8
push 0x101436f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000f453
xor eax, eax
jmp 0x1000f4c4
push 0x100d6dbc
push 0x10143080
call fcn.1001bc30
add esp, 8
push 7
push 0x100d6dc4
push 1
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000f4b1
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000f4c4
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000f4c4
pop edi
pop esi
pop ebx
leave
ret