joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105b884
Capabilities:
Delete service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], ebx
jne 0x105b8a2
mov dword [ebp - 4], ebx
jmp 0x105b98b
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x105b8b1
cmp word [edi], bx
jne 0x105b8b1
xor edi, edi
push dword [ebp + 0xc]
push ebx
call fcn.0105b39e
test eax, eax
je 0x105b967
mov esi, 0xf003f
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x105b94c
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x105b933
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x105b91c
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x105b909
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100af08
push 2
call fcn.01055c69
add esp, 0x10
push dword [ebp + 0xc]
push 0x100aee0
push 4
call fcn.01055c69
add esp, 0xc
push edi
call esi
jmp 0x105b945
push dword [ebp + 0xc]
push 0x100aebc
push 4
call fcn.01055c69
add esp, 0xc
push dword [ebp + 8]
call esi
jmp 0x105b98a
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x105b95c
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100ade0
jmp 0x105b980
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x105b977
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100af08
push 2
call fcn.01055c69
add esp, 0x10
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x105bb80
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push 0x100afc8
push 4
mov dword [ebp - 4], 1
mov dword [ebp - 8], ebx
call fcn.01055c69
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, ebx
je 0x105bbc4
push 0x100acc8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x105bbc4
xor esi, esi
push 0xf003f
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x105bbee
push 0xf01ff
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x105bbf9
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
jmp 0x105bc82
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x105bbee
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 2
push 0x40
mov dword [eax], ecx
call edi
mov esi, eax
cmp esi, ebx
je 0x105bc8d
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 0xc]
push eax
push 1
push esi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x105bc82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x105bc82
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x105bc8d
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0xc]
push esi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x105bc6d
and dword [ebp - 4], eax
jmp 0x105bc82
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x14]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x105bc82
xor esi, esi
test esi, esi
je 0x105bc8d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
cmp dword [ebp + 8], edi
je 0x105bc9f
push dword [ebp + 8]
call esi
cmp dword [ebp - 8], edi
je 0x105bca9
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], edi
pop edi
pop esi
pop ebx
mov eax, 0x100acb4
jne 0x105bcbb
mov eax, 0x100aca4
push eax
push dword [ebp + 0xc]
push 0x100afac
push 4
call fcn.01055c69
mov eax, dword [ebp - 4]
add esp, 0x10
leave
ret 0x10
Function at 0x105c780
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
xor eax, eax
lea ecx, [ebp - 4]
push ecx
inc eax
push eax
xor edi, edi
push edi
push 0x1004a68
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
call ebx
push 4
pop esi
test eax, eax
jne 0x105c800
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100b22c
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105c7ee
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], esi
jne 0x105c7ee
cmp dword [ebp - 0x10], edi
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x105c8b7
lea eax, [ebp - 4]
push eax
push 1
push edi
push 0x100b1d0
push 0x80000002
call ebx
test eax, eax
jne 0x105c859
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x100b1b4
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105c850
mov dword [ebp - 8], edi
cmp dword [ebp - 0x10], esi
jne 0x105c850
cmp dword [ebp - 0xc], edi
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x105c8b7
lea eax, [ebp - 4]
push eax
push 1
push edi
push 0x100b140
push 0x80000001
call ebx
test eax, eax
jne 0x105c8b7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x100b104
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105c8ae
mov dword [ebp - 8], edi
cmp dword [ebp - 0x10], esi
jne 0x105c8ae
cmp dword [ebp - 0xc], edi
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105c8c4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
mov edi, 0x1001794
cmp dword [ebp + 8], esi
je 0x105c8de
mov edi, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1001c88
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105c924
lea eax, [ebp + 8]
push eax
call dword [sym.imp.msvcrt.dll_time]
pop ecx
push 4
lea eax, [ebp + 8]
push eax
push 3
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 4
Function at 0x105cbbd
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0xffffffffffffffff
xor edi, edi
push 0x1001e44
mov dword [ebp - 8], edi
call fcn.0106de5c
mov ebx, eax
cmp ebx, edi
jl 0x105cd6b
lea ecx, [ebp - 0x30]
call fcn.0106d68a
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0x7fff
call fcn.0106d68a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.0106de14
mov ebx, eax
cmp ebx, edi
jge 0x105cc22
lea ecx, [ebp - 0x24]
call fcn.0106de0a
lea ecx, [ebp - 0x30]
call fcn.0106de0a
jmp 0x105cd6b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x105cc53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x105cc43
push 0x57
pop eax
cmp eax, edi
jle 0x105cc4f
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x105cc0d
push esi
push 0x44
pop esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x105cc71
mov ebx, 0x8007000e
jmp 0x105cd4a
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0xc], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x14], esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
test ebx, ebx
jne 0x105ccb9
cmp eax, 0x7a
je 0x105ccb9
test eax, eax
jle 0x105ccb2
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x105cd4a
lea ecx, [ebp - 0x3c]
call fcn.0106d68a
mov eax, dword [ebp - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x3c]
call fcn.0106de14
mov ebx, eax
test ebx, ebx
jl 0x105cd42
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push dword [ebp - 0x24]
push 0
call edi
mov edi, eax
call esi
test edi, edi
jne 0x105cd05
test eax, eax
jle 0x105cd40
and eax, 0xffff
or eax, 0x80070000
jmp 0x105cd40
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x105cd20
call esi
test eax, eax
jne 0x105ccf7
push 0x57
pop eax
jmp 0x105ccf5
push 0xffffffffffffffff
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.0106de5c
mov ebx, eax
test ebx, ebx
jl 0x105cd42
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x30]
call fcn.0106e031
mov ebx, eax
lea ecx, [ebp - 0x3c]
call fcn.0106de0a
lea ecx, [ebp - 0x24]
call fcn.0106de0a
lea ecx, [ebp - 0x30]
call fcn.0106de0a
xor edi, edi
pop esi
cmp dword [ebp - 4], edi
je 0x105cd6b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x105cd79
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x105cd86
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x101
xor edi, edi
push edi
push 0x1001c88
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105cdf0
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100b2e4
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105cde3
cmp dword [ebp - 0xc], esi
je 0x105cde6
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x105d013
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x210], ebx
xor edi, edi
mov dword [ebp - 0x214], ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x22c], 0x104
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
je 0x105d160
cmp esi, 0xea
jne 0x105d0c2
cmp dword [ebp - 0x210], ebx
je 0x105d0ca
push dword [ebp - 0x210]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x210], ebx
jne 0x105d124
mov edi, dword [ebp - 0x220]
shr edi, 4
inc edi
shl edi, 4
push edi
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x210], eax
cmp eax, ebx
jne 0x105d04d
push 0xe
pop esi
cmp dword [ebp - 0x210], ebx
je 0x105d103
push dword [ebp - 0x210]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp esi, ebx
jne 0x105d22f
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x214], ebx
push ebx
jmp 0x105d20f
cmp esi, ebx
jne 0x105d150
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
push dword [ebp - 0x228]
push ebx
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
inc dword [ebp - 0x214]
cmp esi, ebx
je 0x105d04d
jmp 0x105d0ef
xor esi, esi
jmp 0x105d0ef
lea eax, [ebp - 0x210]
push eax
push 0x109
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x105d1cd
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x20106
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x105d1cd
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call fcn.0105d013
cmp dword [ebp - 0x210], ebx
je 0x105d1e7
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x218], ebx
je 0x105d1fb
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x214]
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
cmp esi, ebx
je 0x105d164
cmp esi, 0x103
jne 0x105d22f
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 8
Function at 0x105d629
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x624], esi
cmp eax, esi
je 0x105d87c
cmp ecx, esi
je 0x105d87c
lea ecx, [ebp - 0x624]
push ecx
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x105d701
push ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x624]
mov ebx, 0x104
push esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x634], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x105d7ad
mov esi, 0x1001e44
lea eax, [ebp - 0x20c]
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x105d710
test dx, dx
je 0x105d6fd
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x105d710
add ecx, 4
add eax, 4
test dx, dx
jne 0x105d6db
xor eax, eax
jmp 0x105d715
mov dword [ebp - 0x620], 0x80070057
jmp 0x105d85f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x105d74f
mov eax, dword [ebp - 0x638]
cmp eax, 6
je 0x105d79e
cmp eax, 8
je 0x105d79e
cmp eax, 9
je 0x105d79e
cmp eax, 3
je 0x105d79e
cmp eax, 7
je 0x105d79e
push dword [ebp - 0x628]
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.0103584b
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x61c]
push eax
mov dword [ebp - 0x628], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x105d7cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x105d781
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x620], eax
test eax, eax
jl 0x105d85e
mov dword [ebp - 0x620], 0x80004005
jmp 0x105d85e
mov dword [ebp - 0x620], 0x80070523
jmp 0x105d85e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x105d7c1
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x620], eax
cmp eax, esi
jmp 0x105d789
lea eax, [ebp - 0x414]
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x105d7f9
test dx, dx
je 0x105d7f5
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x105d7f9
add ecx, 4
add eax, 4
test dx, dx
jne 0x105d7d3
xor eax, eax
jmp 0x105d7fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x105d849
push 0xffffffffffffffff
lea eax, [ebp - 0x61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x105d849
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x100286c
push dword [ebp + 0x10]
push dword [ebp - 0x62c]
call fcn.01035948
add esp, 0x14
jmp 0x105d85e
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x62c]
call fcn.0103584b
pop ebx
cmp dword [ebp - 0x624], 0
je 0x105d874
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x620]
jmp 0x105d881
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047464
leave
ret 0xc
Function at 0x105dd64
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.01058c2d
test eax, eax
je 0x105ddca
push 0x100b908
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.010358c7
lea eax, [ebp - 0x20c]
push eax
call fcn.010561ca
test eax, eax
je 0x105ddca
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01047464
leave
ret

Function at 0x105dddb
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
push 0x104
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01058c2d
test eax, eax
je 0x105dedd
push ebx
push esi
push 0x100b908
mov esi, 0x208
push esi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov dword [ebp - 0x418], ebx
call fcn.010358c7
cmp edi, ebx
je 0x105de6d
push edi
push 0x100b938
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01035948
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
push 0x20106
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x80000003
jmp 0x105de84
lea eax, [ebp - 0x418]
push eax
push 0x20106
push ebx
push 0x1003da0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x418], ebx
je 0x105dedb
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x105dea1
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100b924
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop edi
call fcn.01047464
leave
ret 4
Function at 0x105dfc5
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x730
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x724], esi
call fcn.0105d247
lea eax, [ebp - 0x724]
push eax
push 0x20119
push esi
push 0x100bb40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x105e1f3
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x730], 0x80
mov dword [ebp - 0x728], esi
mov dword [ebp - 0x72c], esi
mov ebx, 0x208
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x728]
push dword [ebp - 0x724]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x105e1e5
inc dword [ebp - 0x728]
lea eax, [ebp - 0x72c]
push eax
push 0x20119
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x724]
mov dword [ebp - 0x730], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x105e1e5
lea eax, [ebp - 0x104]
push eax
push 0x100bb14
push 4
call fcn.01055c69
add esp, 0xc
push ebx
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0105d629
cmp eax, esi
jl 0x105e1c4
push ebx
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x720], esi
call fcn.0105d895
test eax, eax
je 0x105e1b6
lea eax, [ebp - 0x104]
push eax
push 0x100bab0
lea eax, [ebp - 0x71c]
push ebx
push eax
call fcn.01035948
add esp, 0x10
push esi
lea eax, [ebp - 0x720]
push eax
push esi
push 0x20106
push esi
push esi
push esi
lea eax, [ebp - 0x71c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105e1d4
lea eax, [ebp - 0x30c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105e13f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x30c]
push eax
push 1
push esi
push 0x100ba98
push dword [ebp - 0x720]
call edi
lea eax, [ebp - 0x514]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x105e172
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x514]
push eax
push 1
push esi
push 0x100ba74
push dword [ebp - 0x720]
call edi
push dword [ebp - 0x720]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100ba60
push 4
call fcn.01055c2f
jmp 0x105e1d4
lea eax, [ebp - 0x30c]
push eax
push 0x100ba38
jmp 0x105e1ca
push eax
push 0x100ba18
push 2
call fcn.01055c69
add esp, 0xc
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x105e030
push dword [ebp - 0x724]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047464
leave
ret