joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1038a16
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10723e4]
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x10736a0
mov dword [ebp - 4], eax
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x1038a48
xor esi, esi
inc esi
jmp 0x1038bae
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x11c], eax
jne 0x1038a62
xor esi, esi
jmp 0x1038bae
push edi
mov dword [ebp - 0x10c], ebx
lea edi, [esi + 0x24]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push dword [ebx*4 + 0x1072318]
mov dword [ebp - 0x114], 0x104
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1038ad4
cmp dword [ebp - 0x110], 1
jne 0x1038ad4
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [edi], eax
je 0x1038b97
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
or dword [ebp - 0x10c], eax
inc ebx
add edi, 4
cmp ebx, 0xc
jb 0x1038a6c
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0x101440c
push dword [esi + 0x14]
mov dword [ebp - 0x114], ebx
call edi
test eax, eax
jne 0x1038b28
cmp dword [ebp - 0x110], ebx
jne 0x1038b28
cmp dword [ebp - 0x118], eax
je 0x1038b28
or byte [ebp - 0x10a], 2
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0x10143f4
push dword [esi + 0x14]
mov dword [ebp - 0x114], ebx
call edi
test eax, eax
jne 0x1038b6a
cmp dword [ebp - 0x110], ebx
jne 0x1038b6a
cmp dword [ebp - 0x118], eax
je 0x1038b6a
or byte [ebp - 0x10a], 1
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x1038b97
test dword [ebp + 0xc], eax
je 0x1038b97
push dword [esi + 0x14]
mov dword [esi + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x11c]
and dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
xor esi, esi
inc esi
jmp 0x1038bad
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
xor esi, esi
pop edi
push 0x10736a0
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0103d24a
leave
ret 8
Function at 0x1038bc9
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x10723e4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x54
xor ebx, ebx
push 0x40
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x520], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1038d14
lea eax, [ebp - 0x520]
push eax
push 0x20019
push ebx
push dword [ebp - 0x52c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1038cfa
cmp dword [ebp + 0x10], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
je 0x1038c71
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x524]
push eax
push ebx
push 0x1014448
push dword [ebp - 0x520]
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x51c], 4
call edi
mov dword [ebp - 0x528], 1
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x524]
push eax
push ebx
push 0x1014438
push dword [ebp - 0x520]
mov dword [ebp - 0x51c], 0x208
call edi
test eax, eax
jne 0x1038cfa
push 0x104
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x51c], eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push ebx
lea eax, [ebp - 0x518]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x1038cfa
lea eax, [ebp - 0x20c]
push eax
call fcn.01032328
cmp eax, ebx
mov dword [esi + 8], eax
jne 0x1038d1b
cmp dword [ebp - 0x520], ebx
je 0x1038d0e
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.010389e5
xor eax, eax
jmp 0x1038da6
mov eax, dword [ebp - 0x520]
mov dword [esi + 0x14], eax
lea ecx, [ebp - 0x51c]
push ecx
lea eax, [esi + 0x1c]
push eax
mov dword [eax], 0x3c
lea eax, [ebp - 0x524]
push eax
push ebx
mov dword [esi + 0x10], ebx
push 0x1014428
push dword [ebp - 0x520]
mov dword [ebp - 0x51c], 4
call edi
xor edi, edi
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x524]
push eax
push ebx
push dword [edi*4 + 0x1072318]
mov dword [ebp - 0x51c], 0x104
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1038d9e
cmp dword [ebp - 0x524], 1
jne 0x1038d9e
inc eax
mov ecx, edi
shl eax, cl
or dword [esi + 0xc], eax
inc edi
cmp edi, 0xc
jb 0x1038d59
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret 0xc
Function at 0x1038db5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10723e4]
mov dword [ebp - 4], eax
call fcn.0102f993
test eax, eax
je 0x1038dd8
xor eax, eax
jmp 0x1038e79
push esi
push 0x54
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1038df0
xor eax, eax
jmp 0x1038e78
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1014480
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
call fcn.01032328
test eax, eax
mov dword [esi + 8], eax
jne 0x1038e23
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1038de9
push ebx
push eax
mov dword [esi + 0xc], 0x20102
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1038e6e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101446c
push ebx
mov dword [esi + 0x10], ebx
call edi
push 0x101445c
push ebx
mov dword [esi + 0x28], eax
call edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x44], eax
pop edi
je 0x1038e67
test eax, eax
je 0x1038e67
mov eax, esi
jmp 0x1038e77
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
call fcn.0103d24a
leave
ret
Function at 0x1038f89
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10723e4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, 0x10736b8
mov ebx, 0x10736a0
xor edi, edi
push ebx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 0x105
mov dword [ebp - 0x218], edi
mov dword [0x10736bc], esi
mov dword [0x10736b8], esi
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
test eax, eax
jge 0x1038fe2
xor eax, eax
jmp 0x103911e
lea eax, [ebp - 0x214]
push eax
push 0x20019
push edi
push 0x10144e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103911b
push ebx
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x1073938], edi
je 0x1039031
call fcn.01038db5
cmp eax, edi
je 0x1039031
mov ecx, dword [0x10736bc]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x10736bc], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
jmp 0x10390f4
cmp dword [0x10733a0], edi
je 0x103907d
lea eax, [ebp - 0x210]
push 0x10144cc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1039095
cmp dword [0x10733a0], edi
jne 0x10390c6
lea eax, [ebp - 0x210]
push 0x10144bc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10390c6
mov eax, dword [ebp - 0x220]
push dword [eax + 0x30]
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call fcn.01038bc9
cmp eax, edi
je 0x10390c6
mov ecx, dword [0x10736bc]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [0x10736bc], eax
inc dword [ebp - 0x218]
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x105
push dword [ebp - 0x214]
call ebx
test eax, eax
je 0x1039055
push 0x10736a0
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret 4
Function at 0x10392b1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
inc edi
shl edi, cl
push 0x10736a0
mov dword [ebp - 8], edi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov esi, dword [0x10736b8]
cmp esi, 0x10736b8
je 0x10393d3
push ebx
mov eax, dword [esi + 0xc]
test edi, eax
mov ebx, esi
je 0x10393c4
cmp dword [esi + 0x10], 0
jne 0x1039320
test eax, 0x40000
jne 0x1039320
push edi
push esi
call fcn.01038a16
test eax, eax
jne 0x1039320
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov esi, dword [esi]
mov dword [ecx], eax
push ebx
mov dword [eax + 4], ecx
call fcn.010389e5
jmp 0x10393c6
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10393c4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1039349
push dword [ebp + 8]
call eax
mov edi, eax
neg edi
sbb edi, edi
inc edi
jmp 0x1039352
mov edi, dword [esi + 0xc]
shr edi, 0x11
and edi, 1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x103935f
cmp eax, 3
jne 0x1039361
xor edi, edi
mov ecx, dword [ebp + 8]
mov dword [ebx + 4], eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push 0x1039156
push 0x10000
push 0
mov dword [ebx + 8], esi
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp - 4], eax
je 0x10393ba
test edi, edi
jne 0x10393af
cmp dword [esi + 0x1c], edi
jbe 0x10393af
push 0x1388
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10393af
add edi, 5
cmp edi, dword [esi + 0x1c]
jb 0x1039395
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10393c1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 8]
mov esi, dword [esi]
cmp esi, 0x10736b8
jne 0x10392e4
pop ebx
push 0x10736a0
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor esi, esi
cmp dword [0x107393c], esi
jne 0x103941c
cmp dword [ebp + 0xc], esi
je 0x10393f3
cmp dword [ebp + 0xc], 1
jne 0x103941c
lea eax, [ebp - 0xc]
push eax
xor eax, eax
cmp dword [ebp + 0xc], esi
push esi
setne al
add eax, 5
push eax
push 0x103912d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x103941c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 8
Function at 0x103a252
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x10723e4]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], eax
inc ebx
call fcn.0103a232
test eax, eax
je 0x103a296
push eax
push 0x1014880
lea eax, [ebp - 0x204]
push 0x1014870
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x204]
jmp 0x103a29b
mov eax, 0x1014880
push 0
push eax
push 0xa
push 0x1014860
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
mov esi, 0x6cc
je 0x103a2c0
cmp eax, esi
je 0x103a2c0
push eax
push 0x101482c
jmp 0x103a2e7
push 0x103a12a
push 0xa
push 0x21
push 0
push 0
push dword [0x1072430]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
je 0x103a2f0
cmp eax, esi
je 0x103a2f0
push eax
push 0x10147f8
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
xor ebx, ebx
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
pop ebx
call fcn.0103d24a
leave
ret

Function at 0x103b93f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x1011048
mov edi, 0x80000002
push edi
call esi
test eax, eax
jne 0x103b99d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10148c0
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x1013560
push edi
call esi
test eax, eax
pop edi
pop esi
pop ebx
jne 0x103b9df
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10148c0
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov dword [0x1073448], eax
leave
ret
Function at 0x103bb68
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x200
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x103bc96
push 5
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x103bc8d
push ebx
push esi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call esi
mov ebx, eax
cmp ebx, edi
je 0x103bc82
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
jne 0x103bc11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x103bc7b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
push 0x40
call esi
mov ebx, eax
test ebx, ebx
je 0x103bc82
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x103bc7b
cmp dword [ebx + 4], 2
jne 0x103bc7b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xc], eax
call edi
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
ja 0x103bc7b
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x103bc7b
mov eax, dword [ebp - 0x28]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x103bc58
cmp dword [ebp - 0x20], 0x435
jne 0x103bc7b
jmp 0x103bc6c
cmp eax, 4
je 0x103bc72
cmp eax, 5
je 0x103bc72
cmp eax, 6
je 0x103bc72
cmp eax, 7
je 0x103bc72
push 0x32
call esi
jmp 0x103bc75
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x103bc28
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
leave
ret 8
Function at 0x103bc9e
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1011048
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103bcfa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x1014958
push dword [ebp - 8]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], esi
push 0x14
pop ebx
jne 0x103bd1f
cmp dword [ebp - 0xc], esi
je 0x103bd1f
push 0x1d4c0
push 0x1014934
call fcn.0103bb68
test eax, eax
je 0x103bd1f
mov ebx, 0x258
push 0x10148e0
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
cmp edi, esi
jne 0x103bd58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x103bd54
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x103bd1f
xor eax, eax
jmp 0x103bd72
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x103c069
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp dword [eax + 0x30], edi
mov ebx, 0x3a98
mov esi, 0x1d4c0
je 0x103c08a
mov ebx, esi
push 0x69a
push edi
push edi
call fcn.0103b9e9
add esp, 0xc
push ebx
push 0x1014ac0
call fcn.0103bb68
push 0x6db
push edi
push 1
call fcn.0103b9e9
add esp, 0xc
push esi
push 0x1014ab4
call fcn.0103bb68
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1011048
push 0x80000002
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103c10b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1014958
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0103bfe2
cmp dword [ebp - 8], edi
mov dword [ebp - 0x10], eax
jne 0x103c120
cmp eax, edi
jne 0x103c1b5
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], edi
jne 0x103c1b5
push eax
call fcn.0102df65
test eax, eax
je 0x103c1b5
push 0x1013888
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebx, eax
cmp ebx, edi
je 0x103c16c
push 0x699
push edi
push edi
call fcn.0103b9e9
add esp, 0xc
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x68b
push edi
push edi
call fcn.0103b9e9
add esp, 0xc
push esi
push 0x1013874
call fcn.0103bb68
push 0x6dd
push edi
push 1
call fcn.0103b9e9
add esp, 0xc
push dword [ebp - 0x10]
push esi
call fcn.0103bc9e
push 0x6dc
push edi
push 1
call fcn.0103b9e9
add esp, 0xc
push esi
call fcn.0103bd79
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x103c1bc
Capabilities:
Get domain controller name
Get hostname

Disassembly:
push 0x68
push 0x1014ad0
call fcn.0103d528
mov eax, dword [0x10723e4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], 0x10
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x103c204
mov word [ebp - 0x3c], si
push edi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x103c24b
mov dword [ebp - 4], esi
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov dword [ebp - 0x78], eax
or dword [ebp - 4], 0xffffffff
jmp 0x103c240
cmp eax, esi
jne 0x103c273
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
jmp 0x103c270
cmp word [ebp - 0x3c], si
je 0x103c273
mov word [ebp - 0x5e], 0x5c
mov word [ebp - 0x60], 0x5c
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov edi, dword [ebp - 0x70]
add edi, 0x484
lea eax, [ebp - 0x6c]
push eax
mov esi, 0x9e8
push esi
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x68]
call sub.REGAPI.dll_RegUserConfigQuery
mov ebx, eax
test ebx, ebx
je 0x103c2a8
lea eax, [ebp - 0x6c]
push eax
push esi
push edi
push dword [ebp - 0x68]
call sub.REGAPI.dll_RegDefaultUserConfigQueryW
mov ebx, eax
cmp dword [ebp - 0x64], 0
je 0x103c2b6
push dword [ebp - 0x64]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x480], ebx
mov eax, ebx
mov ecx, dword [ebp - 0x1c]
call fcn.0103d24a
call fcn.0103d563
ret 0xc
Function at 0x103c5d9
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x20]
inc edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 2
mov dword [ebp - 0x3c], eax
je 0x103c6cd
cmp dword [ebp + 0xc], esi
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
jne 0x103c67d
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
push esi
add eax, 0x28
push eax
call fcn.01026af5
cmp eax, esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx + 0x28]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
je 0x103c6bf
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x14]
or eax, 0x404
push eax
push esi
push esi
push esi
push dword [ebp + 0x18]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 8], esi
mov dword [ebp + 0xc], eax
je 0x103c6c6
push dword [ebp - 8]
call fcn.01026bd2
jmp 0x103c6ee
lea eax, [ebp + 0x10]
push eax
push 0xf01ff
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, esi
jl 0x103c6bf
mov eax, dword [0x1075bb8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntdll.dll_NtFilterToken]
push dword [ebp + 0x10]
mov edi, eax
call ebx
cmp edi, esi
jge 0x103c646
xor eax, eax
jmp 0x103c757
push dword [ebp - 4]
call ebx
jmp 0x103c6ee
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp + 0x14]
push 0x404
push esi
push esi
push esi
push dword [ebp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], esi
je 0x103c754
mov ebx, 0x1073640
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x24]
mov edi, dword [ebp + 0x24]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x103c721
push dword [ebp - 0x20]
or dword [edi + 0x14], 8
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x103c72f
push 5
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp + 0xc], esi
test byte [edi + 0x14], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x103c743
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x1c], eax
jmp 0x103c748
push dword [ebp - 0x24]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x20