joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014f2b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10014f69
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014f67
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10014f7f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov esp, ebp
pop ebp
ret

Function at 0x100163cf
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100163e7
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10016432
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10016415
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10016432
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017168
mov dword [eax], 0xfffffffd
jmp 0x1001640a
mov esp, ebp
pop ebp
ret

Function at 0x10016436
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100164a5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x3c]
push eax
call fcn.100155af
add esp, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.10016edf
lea ecx, [ebp - 0x3c]
call fcn.10016f04
jmp 0x100164b4
push 0
push 0x209d
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esp, ebp
pop ebp
ret
Function at 0x1001a733
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
test cl, cl
je 0x1001a758
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1001a775
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1001a770
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfe7d8a87
inc dword [edx]
cmp dword [edx], 2
jl 0x1001a763
pop esi
pop ebp
ret
Function at 0x1001c45f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001c4ba
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001c49b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1001c4b8
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10017168
mov dword [eax], 0x260039c1
jmp 0x1001c490
jmp 0x1001c4cc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001c4cc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret

Function at 0x1001c551
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078cb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c665
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x1001c5b3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0xffffffe6
je 0x1001c663
mov dword [ebp - 0x2c], 0xb40194dd
push 3
lea ecx, [ebp - 0x40]
call fcn.100170ca
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
jmp 0x1001c5e4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1001c5fd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
call fcn.10017168
mov dword [eax], 0x4990
jmp 0x1001c5dd
push 1
lea ecx, [ebp - 0x40]
call fcn.10017168
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx]
jle 0x1001c61b
mov dword [ebp - 0x18], 1
jmp 0x1001c61f
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push 1
lea ecx, [ebp - 0x40]
call fcn.10017168
sub esi, dword [eax]
cmp dword [ebp - 0x18], esi
jle 0x1001c63e
mov dword [ebp - 0x1c], 1
jmp 0x1001c642
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1001714c
jmp 0x1001c5a8
jmp 0x1001c67f
push 0x199a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001cc27
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001cc66
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001cc64
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1001ccb1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001cc94
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001ccb1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10017168
mov dword [eax], 1
jmp 0x1001cc89
mov esp, ebp
pop ebp
ret

Function at 0x1001d55b
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001d588
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d586
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001d59e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esp, ebp
pop ebp
ret

Function at 0x1001d7b1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001d7e3
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d7e1
push 0x14cc
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001d7ef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov esp, ebp
pop ebp
ret
Function at 0x100257da
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100257fa
push 0x1ae2
push 0x1a9c
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x1002581f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002581f
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x10025885
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100258b7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100258d1
push 0x199a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x10025dac
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10025dc2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x10025e0d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10025df0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10025e0d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017168
mov dword [eax], 0xac64a684
jmp 0x10025de5
mov esp, ebp
pop ebp
ret
Function at 0x10027bab
Capabilities:
Get file system object information
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10027bd1
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10027bd7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
pop ebp
ret

Function at 0x1002961f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10029652
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10029650
push 0x14cc
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x100296cc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100296b1
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffff
jne 0x10029692
mov dword [ebp - 8], 1
jmp 0x10029696
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jle 0x100296b1
mov dword [ebp - 0xc], 1
jmp 0x100296b5
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add eax, 0x37a9a971
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002dd22
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002dd46
xor eax, eax
jmp 0x1002de7b
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
call fcn.1002da46
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002dd6e
xor eax, eax
jmp 0x1002de7b
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002da98
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002dd8d
xor eax, eax
jmp 0x1002de7b
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1002db27
add esp, 0x18
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x4cc1
lea eax, [ebp - 8]
push eax
push 0x322d
call fcn.1002dbbf
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002ddf0
push 1
push 0x2118
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1002dc58
add esp, 0x10
push dword [ebp - 4]
call fcn.1002ccce
pop ecx
test eax, eax
jne 0x1002de01
xor eax, eax
jmp 0x1002de7b
push 0x2620
push dword [ebp - 4]
push 0
push 0x7710
call fcn.1002aa46
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002de63
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002de37
xor eax, eax
jmp 0x1002de7b
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002de50
xor eax, eax
jmp 0x1002de7b
push 0x3d66
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002dccc
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002de74
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002de78
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004128e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100412c2
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 2
mov ecx, dword [ebp - 0xc]
call fcn.10017168
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x100412db
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10044d82
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10044da8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10044dc2
push 0x199a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x1004534c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10045375
push 0x1731
push 0x2126
push 0
push 0x1d3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x100453c0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100453a3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x100453c0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017168
mov dword [eax], 0xf57a7c2
jmp 0x10045398
mov esp, ebp
pop ebp
ret

Function at 0x10045d4d
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10045d74
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10045d72
push 0x14cc
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10045d86
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10045d86
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x10046254
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x100462c2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + eax]
mov dword [edx], eax
jmp 0x100462e0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100462e0
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x10046539
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10046584
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
shl eax, 2
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax + 0x20], ecx
jmp 0x100465a9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100465a9
push 0
push 0x209d
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esp, ebp
pop ebp
ret
Function at 0x10074915
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007e330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10065724
mov dword [ebp - 0x14], eax
cmp dword [0x1066b21c], esi
jne 0x10074a08
push 0x800
push esi
push 0x10007abc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10074995
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10074ae8
push esi
push esi
push 0x10007abc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10074ae8
push 0x10007ad4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10074ae8
push eax
call ebx
push 0x10007ae0
push edi
mov dword [0x1066b21c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007af0
push edi
mov dword [0x1066b220], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b04
push edi
mov dword [0x1066b224], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066b22c], eax
test eax, eax
je 0x10074a05
push 0x10007b20
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066b228], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10074a2d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10074a20
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10074a42
push 4
pop eax
jmp 0x10074aea
cmp dword [ebp - 0x14], esi
je 0x10074a42
push dword [0x1066b21c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10074a27
mov eax, dword [0x1066b228]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10074aa0
cmp dword [0x1066b22c], edi
je 0x10074aa0
push eax
call ebx
push dword [0x1066b22c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10074aa0
test eax, eax
je 0x10074aa0
call ecx
test eax, eax
je 0x10074a95
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10074a95
test byte [ebp - 8], 1
jne 0x10074aa0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10074ad0
mov eax, dword [0x1066b220]
cmp eax, edi
je 0x10074acd
push eax
call ebx
test eax, eax
je 0x10074acd
call eax
mov esi, eax
test esi, esi
je 0x10074acd
mov eax, dword [0x1066b224]
cmp eax, edi
je 0x10074acd
push eax
call ebx
test eax, eax
je 0x10074acd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066b21c]
call ebx
test eax, eax
je 0x10074ae8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10074aea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret