joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f34
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415009
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x415024
push ebx
push 0x415034
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405370
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403270
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f58
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x414fb4
mov al, 0x69
call fcn.00414bac
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00414f08
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x414fbd
call fcn.00414f08
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415010
lea eax, [ebp - 4]
call fcn.00404ebc
ret

Function at 0x415124
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
jmp 0x4151e3
cmp dword [esi + 0x10], 0x1000
jne 0x4151cf
test byte [esi + 0x15], 1
jne 0x4151cf
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x415180
cmp ebp, 2
je 0x415180
cmp ebp, 0x10
je 0x415180
cmp ebp, 0x20
jne 0x41519c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41519c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4151ad
mov eax, dword [esi]
add eax, ebx
call fcn.0041511c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4151a0
cmp byte [esp + 4], 0
je 0x4151cf
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x415155
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x492c53
Capabilities:
Encode data using xor

Disassembly:
jno 0x492c7c
rcr byte [edx], cl
call 0x5a2bad4a
pop ecx
cmp dword [ebx], edi
xor dword [eax - 0x4d4c7b78], 0x59
mov dl, 0x59
les esp, [edx - 0x57bdd057]
fcmovnb st(0), st(5)
add al, 0x6c
mov byte [ecx - 0x43], bl
Function at 0x788980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2b5000]
push edi
jmp 0x78899a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7889a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x788990
mov eax, 1
add ebx, ebx
jne 0x7889b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7889c4
jne 0x7889e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7889e3
dec eax
add ebx, ebx
jne 0x7889d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7889a8
add ebx, ebx
jne 0x7889df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x788a35
xor ecx, ecx
sub eax, 3
jb 0x7889fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x788a6a
sar eax, 1
mov ebp, eax
jmp 0x788a06
add ebx, ebx
jne 0x788a06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7889d4
inc ecx
add ebx, ebx
jne 0x788a14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7889d4
add ebx, ebx
jne 0x788a21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x788a16
jne 0x788a32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x788a16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x788a54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x788a46
jmp 0x788996
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x788a54
add edi, ecx
jmp 0x788996
pop esi
mov edi, esi
mov ecx, 0x17721
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x788a72
cmp byte [edi], 0xa7
jne 0x788a72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x788a77
lea edi, [esi + 0x385000]
mov eax, dword [edi]
or eax, eax
je 0x788aef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x38ec3c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x38ed80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x788aa4
mov ecx, edi
jns 0x788ad3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x38ed88]
or eax, eax
je 0x788ae9
mov dword [ebx], eax
add ebx, 4
jmp 0x788ac1
call dword [esi + 0x38ed84]
mov ebp, dword [esi + 0x38ed8c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x788b23
sub esp, 0xffffff80
jmp 0x5a4334
Function at 0x100065de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000d5a8]
jne 0x100065e8
repz ret
jmp fcn.10008b6b

Function at 0x100085c1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000d5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10004702
and dword [ebp - 0x14], 0
cmp dword [0x1000e888], 0
mov dword [ebp - 0x18], eax
jne 0x10008674
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000871c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000871c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000e888], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000e88c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000e890], eax
call edi
push eax
call esi
mov dword [0x1000e898], eax
test eax, eax
je 0x10008674
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000e894], eax
mov eax, dword [0x1000e894]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100086cd
cmp dword [0x1000e898], ecx
je 0x100086cd
push eax
call esi
push dword [0x1000e898]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100086cd
test ebx, ebx
je 0x100086cd
call edi
test eax, eax
je 0x100086c4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100086c4
test byte [ebp - 8], 1
jne 0x100086cd
or dword [ebp + 0x10], 0x200000
jmp 0x10008700
mov eax, dword [0x1000e88c]
cmp eax, dword [ebp - 0x18]
je 0x10008700
push eax
call esi
test eax, eax
je 0x10008700
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10008700
mov eax, dword [0x1000e890]
cmp eax, dword [ebp - 0x18]
je 0x10008700
push eax
call esi
test eax, eax
je 0x10008700
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000e888]
call esi
test eax, eax
je 0x1000871c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000871e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100065de
leave
ret
Function at 0x604760
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x60479f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x60479f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x60479f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x60479f
cmp dword [ecx + 0x74], 0xe
jbe 0x60479f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x60a2f3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x60a390
push ebx
push esi
call fcn.0060a2bc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0060a250
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x60a33d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x60a38f
push edi
push eax
call fcn.0060af10
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x60a35d
call fcn.00608db1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x60a38e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0060a250
add esp, 0x20
test eax, eax
jne 0x60a37c
push edi
call fcn.00608db1
jmp 0x60a384
push ebx
call fcn.00608db1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x60b68d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x613030
push 0x613028
push str.FlsAlloc
push 0x1f
call fcn.0060b54c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x60b6c1
push dword [ebp + 8]
mov ecx, esi
call dword [0x61112c]
call esi
jmp 0x60b6c7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x60b70b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x613040
push 0x613038
push str.FlsGetValue
push 0x21
call fcn.0060b54c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x60b742
push dword [ebp + 8]
mov ecx, esi
call dword [0x61112c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x60b74a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x613048
push 0x613040
push str.FlsSetValue
push 0x22
call fcn.0060b54c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x60b784
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x61112c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x610be0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x610c0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x610c0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000d067
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov dword [ebp - 0x1c], 0x2628
cmp dword [ebp - 0x1c], 0x597
jge 0x1000d155
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x100089f8
call fcn.10050e4b
add esp, 0xc
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
jmp 0x1000d0bb
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jg 0x1000d13f
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1000d040
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.1000d040
pop ecx
pop ecx
cmp esi, eax
jge 0x1000d0ea
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x1000d13a
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1000d040
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.1000d040
pop ecx
pop ecx
cmp esi, eax
jne 0x1000d113
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x1000d13a
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1000d040
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.1000d040
pop ecx
pop ecx
cmp esi, eax
jle 0x1000d13a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x1000d0b4
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x10008a00
call fcn.10051040
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8b8
push 0x228b
push 0x25fc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011752
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov dword [esp + 4], 0x1702
cmp dword [esp + 4], 0x1a9f
push esi
push edi
jle 0x100117cf
push 0x1f77
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
or eax, esi
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.10010185
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100117a0
mov eax, dword [eax]
push eax
call fcn.10051040
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000e3c8
inc ebx
cmp ebx, 0x12b9
jl 0x10011785
inc edi
cmp edi, 0x1516
jl 0x10011783
inc esi
cmp esi, 0x6b7c
jl 0x10011781
cmp dword [esp + 0xc], 0x1481
jge 0x100117e4
push 0x10008c98
call fcn.10051040
pop ecx
fldz
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100117ed
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006afd1
call fcn.1006a778
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x18], 0x5d88
cmp dword [ebp - 0x18], 0x5f1a
push edi
mov dword [ebp - 0x10], esp
jle 0x10011857
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, ebx
mov ecx, 0x1065dcf8
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10011a4e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x61b
jl 0x1001181b
inc ebx
cmp ebx, 0x5ae5
jl 0x10011816
inc edi
cmp edi, 0x74ae
jl 0x10011814
inc esi
cmp esi, 0x1770
jl 0x10011812
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5a03
jge 0x10011873
mov edx, 0x10008cd4
mov ecx, 0x1065dcf8
call fcn.10013070
fldz
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014fc6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10015075
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10015066
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
push 0x7c83
push 0
push 0x10ed
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1001c953
add esp, 0x14
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10015064
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
and eax, 0x40
je 0x1001504a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
jmp 0x10015064
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
and eax, 0x80
je 0x10015064
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [ecx], eax
jmp 0x10015073
push 0x37c
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10015083
push 0x388
push 1
call fcn.10013d8d
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10015087
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100150f9
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100150d2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8b8
push 0x228b
push 0x25fc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x100150f7
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100150f7
push 0
push 0xa69
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1001512d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 1
push 0x3ba1
push dword [ebp - 0x14]
push 0x7e09
push 0x3ab0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.10013d31
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1001c060
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001c085
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x14]
call fcn.1001c11d
pop ecx
pop ecx
jmp 0x1001c119
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001c0a1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1001c119
mov dword [ebp - 0x1c], 0x1f58
cmp dword [ebp - 0x1c], 0x59b
jge 0x1001c103
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10008a14
call fcn.10050e4b
add esp, 0xc
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
inc ecx
imul eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jl 0x1001c0f4
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x100089dc
call fcn.10051040
pop ecx
pop ecx
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001c119
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esp, ebp
pop ebp
ret
Function at 0x100243be
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10024409
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100243fb
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0x10], 0
jmp 0x10024407
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10024434
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x3cd2
push dword [ebp - 0x14]
push 0x5ea4
push dword [ebp - 0x18]
push 0
push 0x6be0
call fcn.1002d0dc
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x100248ee
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10024941
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002492a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10024928
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002493f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 6
jmp 0x1002499a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10024981
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002497f
push 0x236d
push 0
push 0x1f85
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x1002499a
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1002499a
push 0
push 0x3c1
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov esp, ebp
pop ebp
ret
Function at 0x10024a4a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10024a9f
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10024a7c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10024a9d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10024a9d
push 0x1517
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x10024af8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x4f85
push 0x732a
push dword [ebp - 0x1c]
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0xdc8
push dword [ebp - 0x28]
push 0x5f95
push 0x51de
call fcn.1001f889
add esp, 0x30
mov esp, ebp
pop ebp
ret

Function at 0x10025545
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10025595
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.100255c0
add esp, 0x1c
jmp 0x100255bc
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100255b1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x100255bc
push 0xafb
call dword [sym.imp.USER32.dll_GetDC]
mov esp, ebp
pop ebp
ret
Function at 0x10026e6c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10026ef4
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10026ee3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10026ec4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10026ee1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000e00f
mov dword [eax], 1
jmp 0x10026eb9
jmp 0x10026ef2
push 0
push 0xa69
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x10026f08
push 0x16a1
push 0x1ef3
push 0
call fcn.10026e54
add esp, 0xc
mov esp, ebp
pop ebp
ret