joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b479
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor esi, esi
push 0x206
lea eax, [ebp - 0x62]
push esi
push eax
mov word [ebp - 0x64], si
call fcn.10085bc0
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
movzx eax, word [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push str._.4d_.2d_.2d
push eax
call fcn.10004df5
add esp, 0x20
call fcn.100052f9
mov ecx, eax
call fcn.10019985
push eax
push esi
mov ebx, str.CheckServiceFialNum
push ebx
mov esi, str.Setting
push esi
mov dword [ebp - 0x68], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [ebp - 0x68]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x64]
push eax
push str.RunServiceDate
push esi
call edi
cmp dword [ebp - 0x70], 0
je 0x1003b526
push dword [ebp - 0x68]
push 0x10186140
push ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x124f80
mov esi, 0x493e0
push esi
mov ebx, eax
call fcn.1001c3c2
mov edi, dword [ebp - 0x6c]
add eax, ebx
push 0xdbba0
push esi
mov dword [edi + 0x87c], eax
call fcn.1001c3c2
mov ecx, dword [ebp + 0x1a4]
add esp, 0x10
add eax, ebx
mov dword [edi + 0x880], eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x1a8
leave
ret
Function at 0x1003b8e0
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x884]
push edi
xor edi, edi
cmp dword [eax + 0x224], edi
je 0x1003ba64
cmp dword [ebx + 0x85c], edi
jne 0x1003ba64
push esi
call fcn.100052f9
mov ecx, eax
call fcn.10019985
mov dword [ebp - 0x80], eax
call fcn.1001d3b4
push dword [ebp - 0x80]
mov esi, str.Setting
push 0xffffffffffffffff
push str.ServiceUpOnlineData
push esi
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [ebp - 0x7c]
je 0x1003ba63
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebx + 0x87c]
jl 0x1003ba63
push dword [ebp - 0x7c]
mov word [ebp + 0x398], di
xor eax, eax
lea edi, [ebp + 0x39a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x398]
push 0x10186370
push eax
call fcn.10004df5
add esp, 0xc
push dword [ebp - 0x80]
lea eax, [ebp + 0x398]
push eax
push str.ServiceUpOnlineData
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and word [ebp + 0x190], 0
mov esi, 0x206
push esi
xor edi, edi
lea eax, [ebp + 0x192]
push edi
push eax
mov dword [ebx + 0x85c], 1
call fcn.10085bc0
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.10085bc0
add esp, 0x18
call fcn.100052f9
mov ecx, eax
call fcn.10019925
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.100860cd
lea eax, [ebp - 0x78]
push str.SCWBMutual.exe
push eax
call fcn.100860a3
lea eax, [ebp + 0x190]
push 0x10189190
push eax
call fcn.100860cd
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.100860a3
lea eax, [ebp + 0x190]
push str.__UpOnlineData_0
push eax
call fcn.100860a3
add esp, 0x28
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x78]
push eax
call fcn.1001ccc4
test eax, eax
pop ecx
je 0x1003ba63
lea eax, [ebp + 0x190]
push eax
mov ecx, ebx
call fcn.1003d563
pop esi
mov ecx, dword [ebp + 0x3ac]
pop edi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x3b0
leave
ret
Function at 0x1003ba7b
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ecx + 0x884]
push edi
xor edi, edi
cmp dword [eax + 0x224], edi
mov dword [ebp - 0x80], ecx
je 0x1003bc61
push ebx
push esi
mov esi, 0x206
push esi
lea eax, [ebp - 0x7a]
push edi
push eax
mov word [ebp - 0x7c], di
call fcn.10085bc0
add esp, 0xc
call fcn.1000ea44
mov edx, dword [eax]
push 0xbb
mov ecx, eax
call dword [edx]
push esi
mov ebx, eax
lea eax, [ebp + 0x59e]
push edi
push eax
mov word [ebp + 0x59c], di
call fcn.10085bc0
add esp, 0xc
call fcn.100052f9
mov ecx, eax
call fcn.10019999
push eax
lea eax, [ebp + 0x59c]
push eax
call fcn.100860cd
cmp ebx, edi
pop ecx
pop ecx
jne 0x1003bb25
lea eax, [ebp + 0x59c]
push str.UseData.ini
push eax
call fcn.100860a3
pop ecx
pop ecx
jmp 0x1003bb69
push ebx
lea eax, [ebp - 0x7c]
push 0x10186370
push eax
call fcn.10004df5
lea eax, [ebp + 0x59c]
push str.UseData
push eax
call fcn.100860a3
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x59c]
push eax
call fcn.100860a3
lea eax, [ebp + 0x59c]
push str..ini
push eax
call fcn.100860a3
add esp, 0x24
lea eax, [ebp + 0x59c]
push eax
push str.Run_Activity__s
call fcn.100293b4
pop ecx
pop ecx
lea eax, [ebp + 0x59c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003bc5f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp - 0x80]
cmp eax, dword [ebx + 0x87c]
jl 0x1003bc5f
push esi
lea eax, [ebp + 0x18e]
push edi
push eax
mov word [ebp + 0x18c], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x396]
push edi
push eax
mov word [ebp + 0x394], di
call fcn.10085bc0
add esp, 0x18
call fcn.100052f9
mov ecx, eax
call fcn.10019925
push eax
lea eax, [ebp + 0x394]
push eax
call fcn.100860cd
lea eax, [ebp + 0x394]
push str.SCWBMutual.exe
push eax
call fcn.100860a3
lea eax, [ebp + 0x18c]
push 0x10189190
push eax
call fcn.100860cd
lea eax, [ebp + 0x394]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.100860a3
lea eax, [ebp + 0x18c]
push str.__UpActivityData
push eax
call fcn.100860a3
add esp, 0x28
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x394]
push eax
call fcn.1001ccc4
test eax, eax
pop ecx
je 0x1003bc5f
lea eax, [ebp + 0x18c]
push eax
mov ecx, ebx
call fcn.1003d563
pop esi
pop ebx
mov ecx, dword [ebp + 0x7a4]
xor ecx, ebp
pop edi
call fcn.1008545e
add ebp, 0x7a8
leave
ret
Function at 0x1003bc77
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3b4]
sub esp, 0x434
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x3b0], eax
mov eax, ecx
mov dword [ebp - 0x78], eax
mov eax, dword [eax + 0x884]
cmp dword [eax + 0x224], 0
je 0x1003be0d
push ebx
push esi
call fcn.100052f9
mov ecx, eax
call fcn.10019985
mov dword [ebp - 0x80], eax
call fcn.1001d3b4
push dword [ebp - 0x80]
mov ebx, str.ServerSoftOpertorDate
push 0xffffffffffffffff
push ebx
mov esi, str.Setting
push esi
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [ebp - 0x7c]
jne 0x1003bcef
push str.Service_SoftOpertor_Already_
call fcn.100293b4
pop ecx
jmp 0x1003be0b
and word [ebp + 0x194], 0
push edi
mov edi, 0x206
push edi
lea eax, [ebp + 0x196]
push 0
push eax
call fcn.10085bc0
and word [ebp - 0x74], 0
push edi
lea eax, [ebp - 0x72]
push 0
push eax
call fcn.10085bc0
add esp, 0x18
call fcn.100052f9
mov ecx, eax
call fcn.10019925
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.100860cd
lea eax, [ebp - 0x74]
push str.SCWBMutual.exe
push eax
call fcn.100860a3
lea eax, [ebp + 0x194]
push 0x10189190
push eax
call fcn.100860cd
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.100860a3
lea eax, [ebp + 0x194]
push str.__SoftExtraOperate
push eax
call fcn.100860a3
add esp, 0x28
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x74]
push eax
call fcn.1001ccc4
test eax, eax
pop ecx
je 0x1003bdb4
lea eax, [ebp + 0x194]
push eax
push str.Run_SoftOpertor:__s
call fcn.100293b4
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
lea eax, [ebp + 0x194]
push eax
call fcn.1003d563
push str.Service_SoftOpertor_
call fcn.100293b4
and word [ebp + 0x39c], 0
push dword [ebp - 0x7c]
xor eax, eax
lea edi, [ebp + 0x39e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x39c]
push 0x10186370
push eax
call fcn.10004df5
add esp, 0x10
push dword [ebp - 0x80]
lea eax, [ebp + 0x39c]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x78]
mov dword [eax + 0x888], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3b0]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x3b4
leave
ret
Function at 0x1003c2a6
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x850]
push eax
xor eax, eax
push eax
push esi
push 0x1003c29c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x84c], eax
pop esi
ret

Function at 0x1003c45f
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x1c
push dword [ebp + 8]
call dword [eax]
test eax, eax
jne 0x1003c473
inc eax
jmp 0x1003c4d7
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1003c4d6
push esi
push 0x10020
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x1003c4aa
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1003c4d5
push ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
xor eax, eax
test ebx, ebx
setne al
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x1003c4db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003c550
push esi
lea eax, [ebp - 8]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloudWBInput
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003c550
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x104
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
je 0x1003c550
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 8

Function at 0x1003c556
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, 0xf003f
push esi
xor edi, edi
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003c5c2
push edi
lea eax, [ebp - 8]
push eax
push edi
push esi
push edi
push edi
push edi
push str.SmartCloudWBInput
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003c5c2
push 0x104
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], edi
je 0x1003c5c2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 8
Function at 0x1003c5c8
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x1017d046
call fcn.1008546d
lea ecx, [ebp - 0x40]
call fcn.1003cec0
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.1003ce97
test eax, eax
je 0x1003c661
lea eax, [ebp - 0x10]
push eax
mov edi, 0xf013f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1003c6c8
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push esi
push esi
push esi
push str.GsProtect
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x1003c63a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003c6c8
push 0x104
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
jmp 0x1003c6c6
lea eax, [ebp - 0x14]
push eax
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1003c6c8
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push esi
push esi
push esi
push str.GsProtect
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x1003c6a1
push dword [ebp - 0x14]
jmp 0x1003c62f
push 0x104
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1003cdba
call fcn.10085545
ret 8
Function at 0x1003c746
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1a4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1ac]
xor ebx, ebx
push 0x206
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6e]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x74], edi
mov word [ebp - 0x70], bx
call fcn.10085bc0
lea eax, [esi + 0x61c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.100860cd
lea eax, [ebp - 0x70]
push str._StartService
push eax
call fcn.100860a3
add esp, 0x1c
push edi
mov edi, str.ServiceName
push edi
mov ecx, esi
call fcn.1003c5c8
push dword [ebp - 0x78]
mov ecx, esi
push str.ServiceDescription
call fcn.1003c5c8
push dword [ebp - 0x7c]
mov ecx, esi
push str.ServiceDisplayName
call fcn.1003c5c8
lea eax, [ebp - 0x70]
push eax
push str.ServiceImagePath
mov ecx, esi
call fcn.1003c5c8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp - 0x74]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
push dword [ebp - 0x7c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
push dword [ebp - 0x78]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push dword [ebp - 0x74]
mov ecx, esi
push edi
call fcn.1003c556
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x74], eax
jne 0x1003c853
xor eax, eax
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x19c
leave
ret 0xc
push ebx
push ebx
push 0x101ebf0c
push ebx
push ebx
lea ecx, [ebp - 0x70]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
lea ecx, [esi + 0x20c]
push ecx
lea ecx, [esi + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x78], eax
jne 0x1003c896
push dword [ebp - 0x74]
call edi
mov eax, ebx
jmp 0x1003c839
lea ecx, [ebp - 0x80]
push ecx
xor ebx, ebx
inc ebx
push ebx
add esi, 0x414
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push dword [ebp - 0x78]
call edi
jmp 0x1003c88d
Function at 0x1003cdf7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x1018b558
mov esi, ecx
call ebp
test eax, eax
mov dword [esi], eax
je 0x1003ce75
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GetSystemWow64DirectoryW
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebp
test eax, eax
mov dword [esi + 4], eax
je 0x1003ce73
push ebx
push eax
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x1003cf8a
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3b4]
sub esp, 0x434
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x3b0], eax
mov eax, ecx
cmp dword [eax + 0xc], 0
mov dword [ebp - 0x70], eax
jne 0x1003d10b
push ebx
push esi
push edi
call fcn.100052f9
mov ecx, eax
call fcn.10019985
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 0xffffffffffffffff
push str.UpImeUtilHour
mov esi, str.Setting
push esi
mov dword [ebp - 0x68], eax
call edi
push dword [ebp - 0x68]
mov ebx, str.UpImeUtilMinute
push 0xffffffffffffffff
push ebx
push esi
mov dword [ebp - 0x6c], eax
call edi
push dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x70]
push 0x104
add eax, 0x18
push eax
push 0x101ebf0c
push str.ImeUtilTime
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [ebp - 0x6c], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
je 0x1003d030
cmp dword [ebp - 0x64], 0xffffffff
jne 0x1003d0cc
push 0xc
push 8
call fcn.1001c41d
and word [ebp - 0x60], 0
push 0x206
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x5e]
push 0
push eax
call fcn.10085bc0
push dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push 0x10186370
push eax
call fcn.10004df5
add esp, 0x20
push dword [ebp - 0x68]
lea eax, [ebp - 0x60]
push eax
push str.UpImeUtilHour
push esi
call edi
mov eax, dword [ebp - 0x64]
push 0x3c
push 0
mov dword [ebp - 0x6c], eax
call fcn.1001c41d
and word [ebp + 0x1a8], 0
push 0x206
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x1aa]
push 0
push eax
call fcn.10085bc0
push dword [ebp - 0x64]
lea eax, [ebp + 0x1a8]
push 0x10186370
push eax
call fcn.10004df5
add esp, 0x20
push dword [ebp - 0x68]
lea eax, [ebp + 0x1a8]
push eax
push ebx
push esi
call edi
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x64], eax
movzx eax, word [ebp - 0x78]
cmp eax, dword [ebp - 0x6c]
jne 0x1003d0e0
movzx eax, word [ebp - 0x76]
cmp eax, dword [ebp - 0x64]
jl 0x1003d0fe
jmp 0x1003d0e2
jle 0x1003d0fe
push dword [ebp - 0x68]
push 0x1018fe5c
push str.UpImeUtilHour
push esi
call edi
push dword [ebp - 0x68]
push 0x1018fe5c
push ebx
push esi
call edi
mov eax, dword [ebp - 0x70]
pop edi
pop esi
mov dword [eax + 0xc], 1
pop ebx
mov ecx, dword [ebp + 0x3b0]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x3b4
leave
ret
Function at 0x1003d3d6
Capabilities:
Enumerate processes

Disassembly:
push 0x27c
mov eax, 0x1017eb9a
call fcn.100854d6
mov dword [ebp - 0x280], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x27c], eax
jne 0x1003d404
xor eax, eax
jmp 0x1003d50f
push 0x228
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], ebx
call fcn.10085bc0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x278], eax
je 0x1003d3fd
lea ecx, [ebp - 0x274]
push ecx
push eax
mov dword [ebp - 0x274], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1003d501
push 7
pop esi
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], esi
call fcn.10001b40
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
call fcn.10001b40
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.10003610
push edi
lea ecx, [ebp - 0x2c]
call fcn.10003610
sub esp, 0x1c
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x284], esp
push eax
call fcn.100035e0
sub esp, 0x1c
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp - 0x288], esp
push eax
mov byte [ebp - 4], 2
call fcn.100035e0
mov ecx, dword [ebp - 0x280]
mov byte [ebp - 4], 1
call fcn.1003d120
cmp al, bl
jne 0x1003d517
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.100017c0
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.100017c0
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x278]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1003d454
xor ebx, ebx
inc ebx
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.10085559
ret 8
push dword [ebp - 0x26c]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp - 0x27c]
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x278]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.100017c0
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.100017c0
mov eax, esi
jmp 0x1003d50f

Function at 0x1003d563
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push str.EXPLORER.EXE
lea eax, [ebp - 8]
push eax
call fcn.1003d3d6
test eax, eax
je 0x1003d5ea
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10085bc0
add esp, 0xc
push 1
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], str.winsta0default
mov dword [ebp - 4], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x1003d5e6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push dword [ebp - 4]
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
cmp edi, esi
je 0x1003d5e6
push str.CreateProcessAsUser_ok__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
jmp 0x1003d5e8
xor eax, eax
pop edi
pop esi
leave
ret 4