joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012740
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069cbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100128cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100128c0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x681e
mov dword [ebp - 0x3c], 0x10007b2c
cmp dword [ebp - 0x24], 0x6a72
jle 0x10012861
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
and dword [ebp - 0x14], 0
jmp 0x100127c2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3143
jge 0x10012861
and dword [ebp - 0x18], 0
jmp 0x100127dc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5f4
jge 0x1001285c
and dword [ebp - 0x1c], 0
jmp 0x100127f2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xd66
jge 0x10012857
and dword [ebp - 0x20], 0
jmp 0x10012808
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x73f3
jge 0x10012855
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar edx, cl
xor eax, edx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.1000a5da
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000c002
push eax
call fcn.10050f66
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1000bff8
jmp 0x10012801
jmp 0x100127eb
jmp 0x100127d5
jmp 0x100127bb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10012882
push 0
push 1
push 0x9ef
call fcn.100129e7
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x665d
jge 0x10012898
push dword [ebp - 0x3c]
call fcn.10050f66
pop ecx
jmp 0x100128b4
or dword [ebp - 4], 0xffffffff
jmp 0x100128be
jmp 0x100128cd
push 0
push 0x10dd
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x100128f0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x5442
push 1
push dword [ebp - 0x44]
call fcn.1000f9ec
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015c72
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069d96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10015e9d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10015e0a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1061736c]
and eax, 1
jne 0x10015cf9
mov eax, dword [0x1061736c]
or eax, 1
mov dword [0x1061736c], eax
and dword [ebp - 4], 0
mov ecx, 0x10617300
call fcn.1002470b
push 0x1006ad1d
call fcn.10050f3c
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10617291]
test eax, eax
je 0x10015d59
mov ecx, 0x10617300
call fcn.100247d0
movzx eax, al
test eax, eax
jne 0x10015d59
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10617300
call fcn.100247d9
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x10617300
call fcn.100247c2
push eax
lea ecx, [ebp - 0x18]
call fcn.10024692
movzx eax, al
test eax, eax
je 0x10015d59
lea ecx, [ebp - 0x18]
call fcn.100247ee
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x10015ebf
mov eax, dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x70]
push eax
call fcn.10049b82
pop ecx
pop ecx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x70]
push eax
call fcn.1001308c
pop ecx
mov dword [ebp - 0x20], eax
movzx eax, byte [0x10617291]
test eax, eax
je 0x10015d99
mov ecx, 0x10617300
call fcn.100247d0
movzx eax, al
test eax, eax
jne 0x10015de0
push 0x7ac5
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push 0x92a
push 1
push 0x10617300
call fcn.10015af7
add esp, 0x1c
push 0x6d95
push 1
push 0x6ac0
push 0x2c71
push 0x4b19
push 1
push 0x10617291
call fcn.1001591d
add esp, 0x1c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.100245bf
jmp 0x10015ebf
mov dword [ebp - 0x38], 0xb2c2
mov dword [ebp - 0x3c], 4
push 3
lea ecx, [ebp - 0x48]
call fcn.1000c137
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
jmp 0x10015e39
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10015e4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x58], 0xa2768935
jmp 0x10015e32
lea eax, [ebp - 0x48]
push eax
push 0x3eeb
push 0x1e6b
lea eax, [ebp - 0x10]
push eax
push 0x6b77
push 0
push 0x6544
call fcn.10023d14
add esp, 0x1c
push 0x2b3e
lea eax, [ebp - 0x48]
push eax
push 0x5613
push 0x28f5
push 0
call fcn.10023481
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1000c1b9
jmp 0x10015ebf
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10015eb9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10015ebf
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10028e9b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10028f3d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10028f19
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10028efd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10028f17
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000c1d5
or dword [eax], 0xffffffff
jmp 0x10028ef2
jmp 0x10028f3b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10028f3b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10028f51
push 0x77a8
push 1
push 0x470f
call fcn.10027a0a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002cbed
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1002cc80
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002cc33
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002cc31
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002cc7e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002cc61
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1002cc7e
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1000c1d5
mov dword [eax], 0xfdbd
jmp 0x1002cc56
jmp 0x1002ccf6
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002cce9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1002ccca
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jge 0x1002cce7
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1000c1d5
mov dword [eax], 8
jmp 0x1002ccbf
jmp 0x1002ccf6
push 0
push 0x10dd
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov esp, ebp
pop ebp
ret

Function at 0x1002cf87
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002cfd8
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002cfb8
push 0xa3d
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x1002cfd6
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002cfd6
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1002cff4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.1002b9db
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10030847
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10030903
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100308c6
mov dword [ebp - 0x4c], 0xfffc
mov byte [ebp - 1], 0
push 0
push 1
push 0x1d2c
lea eax, [ebp - 1]
push eax
push 0
push 0x1311
call fcn.1003c560
add esp, 0x18
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x100308c4
push 0x6bbd
push 1
push 1
push 0x6477
push 0xa99
call fcn.1002cf87
add esp, 0x14
jmp 0x100308fe
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1000c1d5
mov esi, eax
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1000c1d5
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10030992
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10030947
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10030945
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10030992
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10030975
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10030992
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.1000c1d5
mov dword [eax], 2
jmp 0x1003096a
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100309af
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a441
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030b61
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10030b53
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10030a2b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xfffffffb
jge 0x10030b51
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0xfffffffc
push dword [ebp - 0x40]
push dword [ebp - 0x14]
lea eax, [ebp - 0x44]
push eax
push 0
push 0x7225
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10034b48
add esp, 0x1c
mov dword [ebp - 0x28], 0x6fa2
mov dword [ebp - 0x50], 0x10008320
cmp dword [ebp - 0x28], 0x7108
jle 0x10030b0c
and dword [ebp - 0x24], 0
jmp 0x10030a95
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3504
jge 0x10030b0c
and dword [ebp - 0x18], 0
jmp 0x10030aab
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6c2b
jge 0x10030b0a
and dword [ebp - 0x1c], 0
jmp 0x10030ac1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x27b6
jge 0x10030b08
and dword [ebp - 0x20], 0
jmp 0x10030ad7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5a02
jge 0x10030b06
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x10612038
call fcn.1000c022
jmp 0x10030ad0
jmp 0x10030aba
jmp 0x10030aa4
jmp 0x10030a8e
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x6bbf
jge 0x10030b26
mov edx, dword [ebp - 0x50]
mov ecx, 0x10612038
call fcn.1000e0f4
jmp 0x10030b42
or dword [ebp - 4], 0xffffffff
jmp 0x10030b4c
jmp 0x10030a20
jmp 0x10030b5f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10030b6f
push 0x1a79
push 0
call fcn.10039b98
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031152
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100311d1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100311af
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100311ad
push 0x4343
push 1
push 0
push 0xd73
push 0x1534
call fcn.1002e637
add esp, 0x14
jmp 0x100311cf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100311cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x100311df
push 0
push 0x68d6
call fcn.1002b560
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003146a
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a47d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003158f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100314ce
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0x4115
push 1
call fcn.10027b87
add esp, 0x10
jmp 0x1003158d
push 4
lea ecx, [ebp - 0x54]
call fcn.1000c137
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xfffffffc
push 0x3147
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0x7efe
push 1
push 0x71cc
call fcn.1002b902
add esp, 0x1c
mov dword [ebp - 0x10], 3
jmp 0x10031516
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10031581
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0x3a3e
push 1
push 0x543d
push 0x408e
push 0x481
push 1
call fcn.1002b9fd
add esp, 0x18
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1eb5
push 0
push 0x2628
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x34b2
push 0x4830
push 0x7f58
call fcn.1002f771
add esp, 0x2c
jmp 0x1003150f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.1000c1b9
jmp 0x100315ec
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100315ce
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100315cc
push 0x2218
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x100315ec
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x100315ec
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003c33b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003c362
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x44a9
push dword [ebp - 4]
push 1
call fcn.1003c391
add esp, 0xc
jmp 0x1003c38d
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003c381
push 0
push 0x1c2f
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1003c38d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esp, ebp
pop ebp
ret
Function at 0x10041b59
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10041b9c
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10041b8e
push 0x694
push 0x1402
push 0
push 0x2062
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x10041b9a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10041bb0
push 0x6285
push 1
push 0x7a93
call fcn.1004047f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10045f78
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10045fd0
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10045fb8
mov byte [ebp - 1], 0
push 1
push 0x24bc
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0x62aa
call fcn.10044544
add esp, 0x18
jmp 0x10045fce
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10045fce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10045ff6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x8e1
push 0
push 0x6eb4
push dword [ebp - 0x10]
call fcn.10049e75
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100467f3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aa0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10046995
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10046987
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10046985
mov dword [ebp - 0x28], 0x1dc3
mov dword [ebp - 0x34], 0x10008db0
cmp dword [ebp - 0x28], 0x2138
jle 0x10046918
push 0x22ce
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and dword [ebp - 0x18], 0
jmp 0x1004687a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x67ac
jge 0x10046918
and dword [ebp - 0x1c], 0
jmp 0x10046894
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x48a
jge 0x10046913
and dword [ebp - 0x20], 0
jmp 0x100468aa
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x47a2
jge 0x1004690e
and dword [ebp - 0x24], 0
jmp 0x100468c0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x10ed
jge 0x1004690c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
shl eax, cl
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.1000a5da
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000c002
push eax
call fcn.10050f66
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.1000bff8
jmp 0x100468b9
jmp 0x100468a3
jmp 0x1004688d
jmp 0x10046873
push 0
push 0x260
push 0xb2f
push 0x42fb
push 1
push 0x465b
push 0x2f06
push 0x70fc
push 1
push 0x6689
call fcn.10046e3a
add esp, 0x28
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x1d99
jge 0x1004695f
push dword [ebp - 0x34]
call fcn.10050f66
pop ecx
jmp 0x1004697b
or dword [ebp - 4], 0xffffffff
jmp 0x10046985
jmp 0x10046993
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x100469bb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push 1
push 0x260b
push 0x3920
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.10045ffa
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret