joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002077
Capabilities:
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.10003454
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x1000209f
mov dword [esi + 4], 0x1b6b
jmp 0x10002154
push ebx
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x353]
mov byte [ebp - 0x354], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x354]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], eax
jbe 0x10002146
lea esi, [ebp + eax - 0x354]
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
mov al, byte [esi]
cmp al, 0x41
je 0x10002135
cmp al, 0x42
je 0x10002135
push 0x4e
xor eax, eax
pop ecx
lea edi, [ebp - 0x14c]
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x154]
push eax
push esi
call fcn.10001f6a
pop ecx
lea eax, [ebp - 0x10]
pop ecx
mov dword [ebp - 0x10], ebx
push ebx
push eax
lea eax, [ebp - 0x154]
push 0x140
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
add eax, 4
cmp eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jb 0x100020d8
mov esi, dword [ebp - 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100021bf
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
and byte [ebp - 0x54c], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x54b]
and byte [ebp - 0x34c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x34b]
rep stosd dword es:[edi], eax
push dword [ebx + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x34c]
push eax
call esi
mov byte [ebp + eax - 0x34d], 0x5c
lea eax, [ebp - 0x34c]
push eax
call esi
and byte [ebp + eax - 0x34d], 0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x54c]
push str._s.
push eax
call esi
and dword [ebp - 0x14c], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x148]
push 0x4f
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1000228d
mov dword [ebx + 4], 0x1b58
jmp 0x10002368
mov ecx, ebx
call fcn.10003454
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x100022b1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 4], 0x1b6b
jmp 0x10002368
and dword [ebp - 8], 0
and byte [ebp - 0x74c], 0
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x74b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x120]
push 0x10009048
push eax
call edi
test eax, eax
je 0x10002326
lea eax, [ebp - 0x120]
push 0x10009044
push eax
call edi
test eax, eax
je 0x10002326
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x74c]
push str._s_s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x74c]
mov ecx, ebx
push eax
push dword [ebp - 0xc]
call fcn.10002157
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000234c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10002352
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x100022d2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx + 4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002481
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
and byte [ebp - 0x548], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x547]
and byte [ebp - 0x348], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x347]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x548]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
and dword [ebp - 0x148], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x144]
push 0x4f
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1000260c
and dword [ebp + 8], 0
and byte [ebp - 0x748], 0
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x747]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push 0x10009048
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100025c7
lea eax, [ebp - 0x11c]
push 0x10009044
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100025c7
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x748]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
test byte [ebp - 0x148], 0x10
je 0x100025b4
mov ecx, dword [ebp - 8]
inc dword [ebx]
push esi
push edi
lea eax, [ebp - 0x748]
push ebx
push eax
call fcn.10002481
test eax, eax
je 0x1000260c
jmp 0x100025c7
mov eax, dword [ebp - 0x128]
inc dword [edi]
add dword [esi], eax
mov ecx, dword [ebp - 0x12c]
adc dword [esi + 4], ecx
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100025ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10002610
mov dword [ebp + 8], 1
cmp dword [ebp + 8], 0
je 0x10002542
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x10002605
xor esi, esi
jmp 0x100025fa
Function at 0x10002614
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
and byte [ebp - 0x400], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x3ff]
and byte [ebp - 0x200], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x1ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x200
push esi
push dword [ebx + 0xc]
stosb byte es:[edi], al
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebx + 0xc]
push esi
add eax, esi
push eax
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x18
call fcn.10004bf5
xor esi, esi
push 5
lea eax, [ebp - 0x200]
push esi
push eax
lea eax, [ebp - 0x400]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x100026a8
mov dword [ebx + 4], 0x1b5d
jmp 0x100026ab
mov dword [ebx + 4], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002a63
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x747]
mov byte [ebp - 0x748], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x547]
mov byte [ebp - 0x548], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x748]
push str._s.
push eax
call esi
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x144]
mov dword [ebp - 0x148], ebx
push 0x4f
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x748]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x10002bda
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x347]
mov byte [ebp - 0x348], bl
mov dword [ebp + 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x11c]
push 0x10009048
push eax
call edi
test eax, eax
je 0x10002b96
lea eax, [ebp - 0x11c]
push 0x10009044
push eax
call edi
test eax, eax
je 0x10002b96
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x348]
push str._s_s
push eax
call esi
add esp, 0x10
test byte [ebp - 0x148], 0x10
je 0x10002b84
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x348]
push eax
call fcn.10002a63
test eax, eax
je 0x10002bda
jmp 0x10002b96
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x348]
push eax
push dword [ebp + 0xc]
call fcn.1000295b
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10002bbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10002bde
mov dword [ebp + 8], 1
cmp dword [ebp + 8], ebx
je 0x10002b20
push 1
pop esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x10002bd3
xor esi, esi
jmp 0x10002bc8
Function at 0x10002e8b
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10002ead
mov dword [esi + 4], 0x1b5f
jmp 0x10002ed5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x10002eca
push edi
mov dword [esi + 4], 0x1b5f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002ed5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
pop edi
pop esi
ret

Function at 0x10002ed8
Capabilities:
Modify service

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xe00f003f
push 0
mov esi, ecx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x10002efc
mov dword [esi + 4], 0x1b66
jmp 0x10002f5d
mov edi, dword [esi + 0xc]
push 0xf01ff
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x10002f1d
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10002f4b
lea ecx, [edi + 0x104]
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [edi + 0x220]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
test eax, eax
jne 0x10002f54
call edi
push ebp
call edi
mov dword [esi + 4], 0x1b65
jmp 0x10002f5d
call edi
push ebp
call edi
and dword [esi + 4], 0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10002f62
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 0xe00f003f
push ebx
mov esi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 8], edi
je 0x10002fa6
mov eax, dword [esi + 0xc]
push 0xf01ff
inc eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edx, eax
cmp edx, ebx
mov dword [ebp - 4], edx
jne 0x10002faf
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esi + 4], 0x1b65
jmp 0x10003001
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xc]
movsx eax, byte [eax]
sub eax, ebx
je 0x10002fd8
dec eax
jne 0x10002fea
lea eax, [ebp - 0x24]
push eax
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x10002fe1
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
cmp eax, ebx
je 0x10002fea
mov dword [esi + 4], ebx
jmp 0x10002ff1
mov dword [esi + 4], 0x1b65
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003006
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push edi
push 0xe00f003f
push 0
mov esi, ecx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x1000303c
push 0xf01ff
push dword [esi + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10003047
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esi + 4], 0x1b6c
pop edi
pop esi
pop ebx
ret
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call edi
push ebx
call edi
test ebp, ebp
pop ebp
je 0x1000303c
and dword [esi + 4], 0
jmp 0x10003043
Function at 0x10003068
Capabilities:
Acquire debug privileges
Enumerate services
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
push ebx
push esi
lea eax, [ebp - 0x24]
push edi
mov esi, ecx
push eax
push 0x28
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x34]
xor ebx, ebx
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
push ebx
push dword [ebp - 0x24]
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0xe00f003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x1000311b
push 0xffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xfffe
push eax
push 3
push 0x30
push edi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x10003127
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esi + 4], 0x1b64
jmp 0x10003211
mov ecx, esi
call fcn.10003454
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x1000314b
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [esi + 4], 0x1b6b
jmp 0x10003211
and byte [ebp - 0xa64], 0
mov ecx, 0x28a
xor eax, eax
lea edi, [ebp - 0xa63]
rep stosd dword es:[edi], eax
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
jbe 0x100031f3
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0xa2c
lea esi, [eax + 0xc]
push ebx
lea eax, [ebp - 0xa64]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa64]
push dword [esi - 0xc]
push eax
call edi
push dword [esi - 8]
lea eax, [ebp - 0x960]
push eax
call edi
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0xa64]
push eax
push dword [ebp - 0x10]
call fcn.10003216
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
push 0
push eax
lea eax, [ebp - 0xa64]
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc dword [ebp - 8]
add esi, 0x24
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x10003181
mov esi, dword [ebp - 0x18]
xor ebx, ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esi + 4], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003216
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
push 0xf01ff
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x100032fd
and dword [ebp + 8], 0
push ebx
mov ebx, 0x2000
push esi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
push ebx
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp + 8]
push eax
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x100032eb
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [edi + 0x224], eax
mov eax, dword [esi]
mov dword [edi + 0x21c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x220], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x428], eax
push dword [esi + 0xc]
lea eax, [edi + 0x228]
push eax
call ebx
push dword [esi + 0x18]
lea eax, [edi + 0x42c]
push eax
call ebx
push dword [esi + 0x10]
lea eax, [edi + 0x328]
push eax
call ebx
push dword [esi + 0x1c]
lea eax, [edi + 0x62c]
push eax
call ebx
push edi
push str.SYSTEMControlSet001Services_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
add esp, 0xc
add edi, 0x82c
push edi
push str.Description
push esi
call fcn.10003302
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x10003302
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.10006a40
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push dword [ebp + 8]
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10003334
xor eax, eax
jmp 0x100033a2
push 0x2000
lea eax, [ebp - 0x2008]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x1fff
mov dword [ebp - 8], 1
push eax
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10003384
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10003330
lea eax, [ebp - 0x2008]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
leave
ret 0xc

Function at 0x100033a6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.10003454
mov edi, eax
cmp edi, 0xffffffff
je 0x100033dc
lea eax, [ebp - 4]
push 0
push eax
and dword [ebp - 4], 0
push dword [esi + 8]
push dword [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
jne 0x100033e5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0x1b6b
jmp 0x100033ef
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
pop edi
pop esi
leave
ret
Function at 0x100033f3
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
push 4
lea eax, [esi + 4]
push eax
push dword [esi + 0x10]
call fcn.10005c1b
add esp, 0xc
test eax, eax
je 0x10003421
lea edi, [esi + 8]
push 4
push edi
push dword [esi + 0x10]
call fcn.10005c1b
add esp, 0xc
test eax, eax
jne 0x10003425
xor eax, eax
jmp 0x10003451
mov eax, dword [edi]
test eax, eax
jne 0x10003430
push 1
pop eax
jmp 0x10003451
mov ecx, dword [esi + 0xc]
and byte [ecx + eax], 0
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
push dword [esi + 0xc]
push dword [esi + 0x10]
call fcn.10005c1b
add esp, 0xc
pop edi
pop esi
ret

Function at 0x10003470
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 4
lea eax, [edi + 4]
push eax
push dword [edi + 0x10]
call fcn.10005bfc
add esp, 0xc
test eax, eax
je 0x1000355c
xor ecx, ecx
lea esi, [edi + 8]
push ecx
push 0x80
push 3
push ecx
lea eax, [edi + 0x14]
push 1
push connect
push eax
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100034db
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esi], eax
jne 0x100034eb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 4
push esi
push dword [edi + 0x10]
call fcn.10005bfc
add esp, 0xc
jmp 0x1000355c
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 0
push ecx
mov dword [ebp - 8], eax
push dword [esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi]
cmp eax, dword [ebp - 4]
je 0x10003513
and dword [esi], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 4
push esi
push dword [edi + 0x10]
call fcn.10005bfc
add esp, 0xc
test eax, eax
je 0x1000354f
push dword [esi]
push dword [ebp - 8]
push dword [edi + 0x10]
call fcn.10005bfc
add esp, 0xc
test eax, eax
je 0x1000354f
push 1
pop esi
jmp 0x10003551
xor esi, esi
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100040d6
Capabilities:
Create thread
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x2c], eax
call fcn.100042af
test eax, eax
je 0x1000418b
push ebx
push ebp
push edi
xor edi, edi
push edi
push edi
push esi
push 0x1000420f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, 0x100000
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ecx
push edi
mov dword [esp + 0x14], eax
push dword [esi + 4]
call ebp
cmp eax, 0x102
jne 0x10004161
lea eax, [esp + 0x18]
push edi
push eax
push ebx
push dword [esp + 0x1c]
mov dword [esp + 0x28], edi
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004161
cmp dword [esp + 0x18], edi
je 0x10004161
push dword [esp + 0x18]
mov ecx, esi
push dword [esp + 0x14]
call fcn.10004268
test eax, eax
je 0x10004161
push edi
push dword [esi + 4]
jmp 0x1000411d
push dword [esp + 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [esi + 8]
call edi
push dword [esi + 0x18]
call edi
push dword [esi + 0x10]
call edi
push dword [esi + 0x1c]
call edi
push 1
pop eax
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4