joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102da97
Capabilities:
Get domain controller name
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10723e4]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebx], edi
mov dword [ebp - 0x214], eax
mov dword [ecx], edi
mov eax, dword [eax + 8]
push edi
add eax, 0x28
push eax
mov dword [ebp - 0x21c], ecx
call fcn.01026af5
mov esi, eax
cmp esi, edi
jne 0x102dae6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x102dc07
push 2
call fcn.0102d975
cmp eax, edi
mov dword [ebp - 0x210], eax
jne 0x102db0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.01026bd2
jmp 0x102dc05
push esi
call fcn.01026bd2
mov esi, dword [ebp - 0x210]
mov eax, esi
cmp word [eax], di
je 0x102db2a
cmp word [esi], 0x5c
je 0x102db38
inc esi
inc esi
cmp word [esi], di
jne 0x102db1d
cmp word [esi], 0x5c
je 0x102db38
push 0xd
pop edi
jmp 0x102dbf9
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
mov word [esi], di
push eax
mov dword [ebp - 0x220], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x102db6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x102dbf9
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x102dba5
lea eax, [ebp - 0x218]
push eax
push edi
add esi, 2
push esi
push edi
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x102dba5
push dword [ebp - 0x218]
mov dword [ebx], 1
jmp 0x102dbed
push dword [ebp - 0x214]
call fcn.0102da42
test eax, eax
je 0x102dbf9
lea eax, [ebp - 0x214]
push eax
push 0x20
push edi
push edi
push dword [ebp - 0x210]
push edi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x102dbf4
mov eax, dword [ebp - 0x214]
cmp eax, edi
je 0x102dbf4
test byte [eax + 0x24], 0x10
jne 0x102dbec
mov ecx, dword [ebp - 0x21c]
mov dword [ecx], 1
push eax
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x102dbf9
mov edi, 0x54b
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret 0xc
Function at 0x102dc6b
Capabilities:
Impersonate user
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x10723e4]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 8]
xor ebx, ebx
push eax
mov dword [ebp - 0x124], ebx
call fcn.0102dc16
mov dword [esi + 0xb0], eax
lea eax, [ebp - 0x128]
push eax
push 0x20019
push ebx
push 0x1013460
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102dcf8
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
push 0x101343c
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x692
push ebx
push ebx
call fcn.0103b9e9
add esp, 0xc
push 8
pop ecx
xor eax, eax
cmp dword [ebp - 0x124], ebx
lea edi, [ebp - 0x14c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14c], 0x20
pop edi
je 0x102dd2f
or dword [ebp - 0x148], 1
mov eax, dword [esi + 0xc8]
mov dword [ebp - 0x144], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x140], eax
mov eax, dword [esi + 0x94]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x14c]
push eax
push dword [esi + 0x28]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x102ddc4
mov eax, dword [ebp - 0x130]
mov dword [esi + 0x8c], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x102ddc0
test byte [ebp - 7], 2
jne 0x102ddc0
mov eax, dword [esi + 0xb0]
cmp eax, ebx
je 0x102ddc0
push dword [esi + 0x98]
push dword [esi + 0x90]
push dword [esi + 0xc8]
push dword [ebp - 0x130]
push dword [esi + 0x28]
push eax
call dword [sym.imp.USERENV.dll_Ordinal_130]
xor eax, eax
jmp 0x102ddd0
mov dword [esi + 0x8c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0103d24a
leave
ret 4
Function at 0x102e377
Capabilities:
Check for time delay via gettickcount
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10723e4]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x218], eax
push 0x1010c88
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x210], 0x258
mov dword [ebp - 0x228], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x10], esi
je 0x102e578
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x214]
push eax
push 0x20019
push esi
push 0x1011048
mov ebx, 0x80000002
push ebx
call edi
test eax, eax
jne 0x102e43c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push 0x1013678
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
push 0x20019
push esi
push 0x1013560
push ebx
call edi
test eax, eax
jne 0x102e492
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push 0x1013678
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
cmp eax, esi
jne 0x102e4a5
or dword [ebp - 0x210], 0xffffffff
jmp 0x102e4c4
cmp eax, 0x7d00
jb 0x102e4b8
mov dword [ebp - 0x210], 0x1e84800
jmp 0x102e4c4
imul eax, eax, 0x3e8
mov dword [ebp - 0x210], eax
call fcn.0103cd0f
mov ebx, eax
cmp ebx, esi
je 0x102e5b2
push 1
push ebx
call fcn.0103c8aa
push ebx
push esi
push 0x400
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x230]
xor eax, eax
cmp dword [ebp + 0xc], esi
push dword [ebp - 0x220]
sete al
push eax
push dword [ebp - 0x218]
call fcn.0103c5d9
cmp eax, esi
mov dword [ebp - 0x224], eax
je 0x102e5a8
cmp dword [ebp + 0xc], esi
je 0x102e529
push 2
push dword [ebp - 0x218]
call fcn.010317b0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push dword [ebp - 0x210]
mov dword [ebp - 0x220], eax
push ebx
call fcn.0103c7ab
test eax, eax
jne 0x102e54e
push esi
push ebx
call fcn.0103c7ea
call edi
sub eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x210]
jb 0x102e5a8
push esi
push esi
push esi
push 0x800004c1
push 2
push dword [ebp - 0x218]
call fcn.0101ff19
add esp, 0x18
jmp 0x102e5a8
cmp dword [ebp + 0xc], esi
lea eax, [ebp - 0x20c]
je 0x102e593
push eax
push ebx
push edi
push dword [ebp - 0x218]
call fcn.0103b8ef
jmp 0x102e5b2
push esi
push esi
push esi
push ebx
push esi
push esi
push 4
push edi
push eax
call fcn.01029452
mov ebx, dword [ebp - 0x228]
cmp ebx, esi
je 0x102e5b2
push ebx
call fcn.0103cdcd
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret 0x14
Function at 0x102e5c7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x1013768
mov edi, 0x80000002
push edi
call esi
test eax, eax
jne 0x102e625
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1013744
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
xor ebx, ebx
push ebx
push 0x10136d0
push edi
call esi
test eax, eax
jne 0x102e66e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1013744
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102e665
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x102e6a6
push 0x10136b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x102e6a6
push 0x101369c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x102e69f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102f4c2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10723e4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
push esi
mov esi, 0x258
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x124], esi
jne 0x102f6a1
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x102f6a1
test byte [ebp - 7], 2
jne 0x102f6a1
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x128]
push eax
push 0x20019
push 0
push 0x1011048
mov ebx, 0x80000002
push ebx
call edi
test eax, eax
jne 0x102f582
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x134]
push eax
push 0
push 0x1013678
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x128]
push eax
push 0x20019
push 0
push 0x1013560
push ebx
call edi
xor ebx, ebx
test eax, eax
jne 0x102f5db
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x134]
push eax
push ebx
push 0x1013678
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
cmp eax, ebx
jne 0x102f5ee
or eax, 0xffffffff
mov dword [ebp - 0x124], eax
cmp dword [0x1073938], ebx
mov edi, 0xe10
je 0x102f645
cmp eax, edi
ja 0x102f601
mov eax, edi
push eax
push 0x10139ec
push ebx
push dword [ebp - 0x130]
call fcn.0102df65
neg eax
sbb eax, eax
inc eax
push eax
push 2
push 0x102ebc8
call fcn.01038e83
mov eax, dword [ebp - 0x124]
cmp eax, esi
ja 0x102f631
mov eax, esi
push eax
push 0x10139b4
push ebx
push ebx
push 3
push 0x102ef4e
call fcn.01038e83
push edi
push 0x1013984
push ebx
mov edi, fcn.0102df72
push edi
push ebx
push 0x102e074
call fcn.01038f08
mov eax, dword [ebp - 0x124]
cmp eax, esi
ja 0x102f669
mov eax, esi
push eax
push 0x1013950
push ebx
push ebx
push 1
push 0x102f0af
call fcn.01038e83
cmp dword [ebp - 0x124], esi
jbe 0x102f68b
mov esi, dword [ebp - 0x124]
push esi
push 0x1013910
push ebx
push edi
push 8
push 0x102f224
call fcn.01038f08
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0103d24a
leave
ret 4

Function at 0x102f6ae
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1011048
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x102f6db
xor eax, eax
jmp 0x102f711
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1013a24
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102f706
cmp dword [ebp - 0xc], esi
je 0x102f706
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x1030101
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10723e4]
push ebx
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1013c30
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
mov word [ebp - 6], bx
call fcn.0102f993
test eax, eax
je 0x103013f
xor eax, eax
jmp 0x10301a9
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x1030182
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1013c18
push edi
call esi
test eax, eax
je 0x1030182
push 1
push edi
call esi
cmp eax, ebx
mov dword [0x10733dc], eax
je 0x1030182
push 2
push edi
call esi
cmp eax, ebx
mov dword [0x10733e0], eax
jne 0x103018a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10301a7
push ebx
push ebx
push ebx
push 0x32
push ebx
push ebx
push ebx
call dword [0x10733dc]
cmp eax, ebx
jl 0x10301a0
xor eax, eax
jmp 0x10301a7
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0103d24a
leave
ret 4
Function at 0x1030640
Capabilities:
Check processdebugport
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x10723e4]
push ebx
push edi
push dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1f0fff
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x218], edi
je 0x1030747
push esi
lea eax, [ebp - 0x21c]
push eax
push 4
lea eax, [ebp - 0x214]
push eax
push 7
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jl 0x103073e
cmp dword [ebp - 0x214], ebx
jne 0x103073e
lea eax, [ebp - 0x210]
push eax
push 0x2000000
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x103073e
push 0x11
xor eax, eax
pop ecx
push dword [ebp + 8]
lea edi, [ebp - 0x270]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
push 0x1013ccc
push eax
mov dword [ebp - 0x270], 0x44
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x270]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1030736
push dword [ebp - 0x228]
call esi
push dword [ebp - 0x22c]
call esi
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x218]
call esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0103d24a
leave
ret 4
Function at 0x1030755
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x10723e4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
push 0x2000000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1030841
push ebx
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
xor esi, esi
push esi
push dword [ebp - 0x40]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x14
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x103083a
push dword [ebp + 8]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x44], eax
je 0x1030829
push 0x1013cf8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
je 0x1030824
push edi
push 0x1013ce8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x4c]
push ecx
push 4
push esi
push eax
push 0x8000
push esi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
cmp edi, esi
je 0x1030823
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call ebx
pop edi
push dword [ebp - 0x44]
call ebx
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x40]
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0103d24a
leave
ret 4
Function at 0x1030e8b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
push 0x1013f08
call fcn.0103d528
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov edi, dword [ebp + 8]
push dword [edi + 8]
call fcn.0102cd2c
test eax, eax
je 0x1030f08
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x1c]
push eax
push 0x2001b
push esi
push 0x1013e98
mov eax, dword [edi + 8]
push dword [eax + 0x68]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x30], eax
cmp eax, esi
jne 0x1030f08
mov dword [ebp - 0x20], 4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push 0x1013e70
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x30], eax
or dword [ebp - 4], 0xffffffff
call fcn.01030f21
mov eax, dword [ebp - 0x28]
call fcn.0103d563
ret 4
Function at 0x1031970
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, 0x3c
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 4], eax
je 0x10319de
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push edi
jmp 0x10319c0
cmp esi, edi
jle 0x10319d9
push 0x42
lea eax, [esi + esi]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
mov edi, esi
je 0x10319cc
mov dword [ebp - 4], eax
push esi
push eax
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jne 0x10319a3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret 4

Function at 0x10319e3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x78
pop edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1031a66
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
jmp 0x1031a2c
cmp dword [ebp - 8], 0xea
jne 0x1031a46
push 0x42
add edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
je 0x1031a5a
lea ecx, [ebp - 4]
push ecx
mov ebx, eax
push eax
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp - 8], eax
jne 0x1031a0c
jmp 0x1031a63
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1031a63
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x1031b21
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push edi
push 0
push 0x1011048
push 0x80000002
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x1031b80
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x101403c
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x1031be0
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.0102cd2c
test eax, eax
je 0x1031be0
lea eax, [ebp - 4]
push eax
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
push 0
push 0x1013560
push dword [eax + 0x68]
call esi
test eax, eax
jne 0x1031bd8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x101403c
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi + 8]
call fcn.0102cda5
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1032e71
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call sub.MSGINA.dll_Ordinal_22
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x1032ee4
xor eax, eax
cmp dword [ebp + 8], edi
push 0x11
setne al
mov dword [esi + 4], 3
inc eax
inc eax
mov dword [esi], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x1032eb4
or byte [esi + 7], 0x80
cmp dword [ebp + 0xc], edi
je 0x1032ebd
or byte [esi + 7], 0x40
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1032d43
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x1032edd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1032ee4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
leave
ret 8
Function at 0x10385d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 0x8001
call esi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push 0x10142f4
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x103861c
push dword [ebp - 4]
call esi
mov eax, 0xc0000034
jmp 0x1038658
push edi
lea eax, [ebp - 8]
push eax
push 0x10
push 0x10736d0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1038645
cmp dword [ebp - 8], 0x10
jne 0x1038645
mov dword [0x10733fc], 1
jmp 0x103864a
mov edi, 0xc0000102
push dword [ebp - 4]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1038949
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1014308
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10389c1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1014354
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10389b8
push dword [ebp - 0xc]
call fcn.01038817
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push 0x103893f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10736c4], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret