joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449fe0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x449ff7
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418ee4
mov eax, dword [0x44df2c]
cmp word [eax + 2], 0
jne 0x44a01f
mov eax, dword [0x44df2c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b638
mov eax, dword [0x44dfd8]
cmp word [eax + 2], 0
jne 0x44a039
mov eax, dword [0x44dfd8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b830
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4111dc]
call fcn.004030a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4111dc]
call fcn.004030a8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b0b8]
call fcn.00420d00
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44a1c0
mov eax, dword [0x44de54]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004210d0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44bdd0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44de54]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bdc4
test eax, eax
je 0x44a12e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040817c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bdec
test eax, eax
je 0x44a142
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, dword [0x44dd58]
cmp byte [eax], 0
jne 0x44a176
mov eax, ebx
call fcn.0044a2e8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044bfac
mov eax, ebx
call fcn.0044c970
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44a1b6
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a568
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44fbb0]
cmp dword [eax + 0x30], 0
je 0x44a612
cmp dword [ebx + 0x94], 0
jne 0x44a60c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44a4f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44a60c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44a5d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44a60c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413544
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44a5e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44b174
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44b1a9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f00
jmp 0x44b1b6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e64
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44c188
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44c1c9
mov eax, esi
call fcn.00432bd4
test al, al
je 0x44c1c9
mov eax, dword [ebx + 0x84]
call fcn.00432974
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c1c9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00432974
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4eba92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x4ebb67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x4ebb31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x4ebb5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ebb71
test eax, eax
je 0x4ebb67
add ebx, 0x14
jmp 0x4ebb3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x4ebb71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x4ebddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x4ebddd
mov eax, 1
test eax, eax
je 0x4ebddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x4ebddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x4ebdd3
mov ebx, eax
and eax, 0x80000000
jne 0x4ebd4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x4ebddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x4ebddd
mov eax, 1
test eax, eax
je 0x4ebddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x4ebddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x4ebca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x4ebddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x4ebb67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x4ebddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x4ebca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x4ebe9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x4ebfee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x4ebfee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.004ebff8
test eax, eax
je 0x4ebfee
add ebx, 0x28
dec ecx
jne 0x4ebfc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x4ec09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x4ec0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x4ec12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x4ec0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x4ec12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x4ec105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x4ec12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x4ec123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x4ec12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x4ec16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x4ec172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4ec1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4ec1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x4ecdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.004ecf04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.004ecf20
push edx
push dword [ebp + 0x10]
push eax
call fcn.004eceec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004ecf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004ececb
push ecx
push dword [ebp + 8]
call fcn.004ecf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004ecf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004ececb
push ecx
push dword [ebp + 8]
call fcn.004ecf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004ecf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004ececb
push ecx
push dword [ebp + 8]
call fcn.004ecf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004ecf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004ececb
cmp ecx, 0x2b
jne 0x4ece0f
leave
ret 0xc

Function at 0x4ee4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x4ee544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x74650
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4ee5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x74650
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x74650
call fcn.004ee3fa
push 0x74650
push dword [ebp + 0xc]
call fcn.004ec1a8
test eax, eax
jne 0x4ee5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x74650
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004ee5dd
test eax, eax
je 0x4ee5d6
jmp 0x4ee574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4ee5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x4ee60b
Capabilities:
Terminate process

Disassembly:
call fcn.004ee618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x10003698
Capabilities:
Encode data using xor

Disassembly:
cld
sbb edx, esp
dec ecx
insd dword es:[edi], dx
in eax, dx
xchg esi, eax
cmp edi, dword [edi + 0x3f9f3b32]
mov edi, 0x3f9f3b32
xor dword [esi + ebp*2], esp
xor esp, dword [ecx + 0x46]
push cs
in al, dx
loopne 0x100036a1
invalid
Function at 0x100013e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
xor ecx, ecx
test eax, eax
setne cl
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, ecx
test esi, esi
jne 0x10001426
push 0x5d
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
push edi
push esi
push str.pExeFile_NULL
jmp 0x10001461
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001430
sub eax, edx
sar eax, 1
xor ecx, ecx
mov edi, eax
cmp ecx, edi
sbb esi, esi
neg esi
jne 0x1000147a
push 0x5f
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
push edi
push 0
push str.szlExe_0
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
mov ebx, dword [esp + 0x24]
add esp, 0x18
jmp 0x1000152e
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor ecx, ecx
mov ebx, eax
cmp ebx, 0xffffffff
setne cl
mov esi, ecx
test esi, esi
jne 0x100014ba
push 0x62
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push esi
push str.hProcessSnap_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x18
jmp 0x1000152e
lea ecx, [esp + 0x10]
push ecx
push ebx
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov esi, eax
test esi, esi
jne 0x100014fa
push 0x66
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push esi
push str.Process32First__hProcessSnap__pe32_
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x18
jmp 0x1000152e
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll__wcsnicmp]
xor esi, esi
mov ecx, dword [esp + 0x10]
push edi
push ecx
lea edx, [esp + 0x40]
push edx
call ebp
add esp, 0xc
test eax, eax
je 0x10001528
lea eax, [esp + 0x14]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10001503
jmp 0x1000152d
mov esi, 1
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.10045f6c
add esp, 0x234
ret
Function at 0x10001550
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
push ebp
xor eax, eax
push esi
push edi
push str.ABCore.exe
mov edi, 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
xor esi, esi
call fcn.100013e0
add esp, 4
neg eax
sbb eax, eax
inc eax
jne 0x100015c5
push 0x85
call fcn.100010d0
mov esi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push 0
push str._ProcessExist_APP_BACKUPCORE_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0xc], ebp
jne 0x10001622
call fcn.10001750
mov edi, eax
test edi, edi
jne 0x10001616
push 0x8c
call fcn.100010d0
mov esi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push edi
push str.StartBackupCoreByServiceTCP__
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x18
jmp 0x10001724
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x20
ret
push ebx
push 0xf01ff
push str.Backupper_Service
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov edi, eax
test edi, edi
jne 0x10001670
push 0x91
call fcn.100010d0
mov esi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push edi
push str.hService_NULL
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x18
jmp 0x10001718
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10001692
cmp dword [esp + 0x18], 1
jne 0x10001692
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push 0xca
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call ebp
mov edi, eax
test edi, edi
je 0x10001738
push str.ABCore.exe
call fcn.100013e0
add esp, 4
test eax, eax
jne 0x100016ec
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, esi
add esi, 1
cmp edx, 0x64
jl 0x10001698
xor eax, eax
cmp esi, 0x64
setl al
mov edi, eax
test edi, edi
jne 0x10001714
push 0xa3
call fcn.100010d0
push eax
push str.Retry_100
xor esi, esi
call fcn.10001230
add esp, 0xc
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x10001723
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
test ebp, ebp
je 0x1000172f
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20
ret
push 0x9d
call fcn.100010d0
push eax
push str.ControlService_hService__SERVICE_RUN_BACKUPCORE__ServiceStatus_
jmp 0x1000170a
Function at 0x10001f40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov edi, ecx
mov word [esp + 0x14], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call sub.Comn.dll_GetObjectSys
xor ecx, ecx
test edi, edi
setne cl
mov esi, ecx
test esi, esi
jne 0x10001fb2
push 0x1b5
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push esi
push str.pDir_NULL
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x18
jmp 0x100020f2
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
jne 0x10001fec
push 0x1b6
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push esi
push str.pSys_NULL
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x18
jmp 0x100020f2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10002070
xor eax, eax
jmp 0x10002000
movzx ecx, word [eax + str.C:ProgramData]
mov word [esp + eax + 8], cx
add eax, 2
test cx, cx
jne 0x10002000
lea eax, [esp + 8]
lea edx, [eax + 2]
jmp 0x10002020
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002020
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov esi, ecx
test esi, esi
jne 0x100020d9
push 0x1bc
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push edi
push esi
push str.l_Length
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x18
jmp 0x100020f2
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002090
sub eax, edx
xor edx, edx
sar eax, 1
cmp eax, 0x104
setl dl
mov esi, edx
test esi, esi
jne 0x100020d9
push 0x1c2
call fcn.100010d0
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edi
push esi
push str.l_Length
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x18
jmp 0x100020f2
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100020e3
mov ecx, dword [esp + 0x210]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.10045f6c
add esp, 0x20c
ret