joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100117f0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x310
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x30c], eax
push ebx
xor ebx, ebx
cmp esi, ebx
jne 0x10011823
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.1001c89c
add esp, 0x310
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1001180b
push 0x103
lea eax, [esp + 9]
push ebx
push eax
mov byte [esp + 0x10], bl
call fcn.1001eb30
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call sym.QQUtil.dll_GetQQPath
push str.qq.exe
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x103
lea eax, [esp + 0x211]
push ebx
push eax
mov byte [esp + 0x218], bl
call fcn.1001eb30
push 0x103
lea ecx, [esp + 0x119]
push ebx
push ecx
mov byte [esp + 0x120], bl
call fcn.1001eb30
add esp, 0x18
push 0x104
lea edx, [esp + 0x210]
push edx
mov ebx, esi
call fcn.10011660
push 0x104
lea eax, [esp + 0x10c]
push eax
lea ebx, [esp + 0xc]
call fcn.10011660
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [esp + 0x310]
neg eax
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.1001c89c
add esp, 0x310
ret

Function at 0x10011990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x100119cf
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret 4
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10011a09
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret 4
push 0x3e
lea ecx, [esp + 0x10e]
xor eax, eax
push edi
push ecx
mov ebx, 1
mov dword [esp + 0x18], edi
mov word [esp + 0x114], ax
call fcn.1001eb30
push 0xf4
lea edx, [esp + 0x24]
push edi
push edx
mov dword [esp + 0x28], edi
call fcn.1001eb30
add esp, 0x18
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x10011a99
mov edx, dword [esp + 0x144]
push 0
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x144], 0
je 0x10011a99
push 0
lea eax, [esp + 0x10]
push eax
push 0xf8
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
test eax, eax
je 0x10011a99
mov ebx, dword [esp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret 4
Function at 0x10011b50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x320], eax
push esi
push 0x103
lea eax, [esp + 0x115]
push 0
push eax
mov byte [esp + 0x11c], 0
call fcn.1001eb30
add esp, 0xc
push 0x104
lea ecx, [esp + 0x114]
push ecx
call sym.QQUtil.dll_GetQQPath
test eax, eax
je 0x10011c65
push 0x103
lea edx, [esp + 0xd]
push 0
push edx
mov byte [esp + 0x14], 0
call fcn.1001eb30
push 0x103
lea eax, [esp + 0x229]
push 0
push eax
mov byte [esp + 0x230], 0
call fcn.1001eb30
push str.dbghelp.dll
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x28]
push str._s_s
push edx
call fcn.1001ca7b
add esp, 0x28
push 0x1c
push 0x10042164
push 0x10042164
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [0x10042168]
push 0x104
lea eax, [esp + 0x21c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x218]
push edx
call fcn.10011990
mov esi, eax
lea eax, [esp + 8]
push eax
call fcn.10011990
cmp esi, eax
jne 0x10011c65
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10011c65
mov eax, 1
pop esi
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x324]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1001c89c
mov esp, ebp
pop ebp
ret

Function at 0x10011c90
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54c
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x548], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
xor edi, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push 0x124
lea eax, [esp + 0x430]
push ebx
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x434], 0x128
call fcn.1001eb30
add esp, 0xc
lea ecx, [esp + 0x428]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10011d10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x548]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x44c]
push 0x100374b4
push edx
call fcn.10024c19
add esp, 8
test eax, eax
jne 0x10011d8a
mov eax, dword [esp + 0x430]
push eax
push ebx
push 0x431
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40c
lea ecx, [esp + 0x20]
push ebx
push ecx
mov esi, eax
mov dword [esp + 0x24], ebx
call fcn.1001eb30
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x410
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x24], ebx
call sub.PSAPI.DLL_EnumProcessModules
mov edi, eax
cmp edi, ebx
je 0x10011d7f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x428]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10011d10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x554]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret
Function at 0x10011dc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov esi, eax
lea eax, [esp + 0x10]
push edi
push eax
mov dword [esp + 0x14], 0x128
call fcn.1001eb30
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10011e30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x2c]
push 0x100374b4
push edx
call fcn.10024c19
add esp, 8
test eax, eax
je 0x10011e57
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10011e30
jmp 0x10011e5c
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret
Function at 0x100121a0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp]
push eax
push 0xf01ff
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100121f7
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp]
test eax, eax
jne 0x100121fd
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
lea eax, [esp + 4]
push eax
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10012230
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x1c
ret

Function at 0x10012250
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x240
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
push 0
push str.inject_to_qq
push str._s__d
call fcn.10005ce0
add esp, 0xc
call fcn.100121a0
push 0x103
lea eax, [esp + 0x13d]
push 0
push eax
mov dword [section.seg_flag], 1
mov byte [esp + 0x144], 0
call fcn.1001eb30
add esp, 0xc
push 0x1c
push 0x10042164
push 0x10042164
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [0x10042168]
push 0x104
lea ecx, [esp + 0x13c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov ebx, eax
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x1c], 0x128
call fcn.1001eb30
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10012330
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.1001c89c
add esp, 0x240
ret
push 1
push str.inject_to_qq
push str._s__d
call fcn.10005ce0
add esp, 0xc
lea edx, [esp + 0x34]
push 0x100374b4
push edx
call fcn.10024c19
add esp, 8
test eax, eax
je 0x1001236b
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10012330
jmp 0x100123a9
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0x138]
mov edi, eax
push edx
call fcn.100123d0
mov esi, eax
push esi
push edi
push str.inject_to_qq
push str._s_hProc:_d_lRet:_d
call fcn.10005ce0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x244]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x240
ret
Function at 0x100123d0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push ebx
push esi
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 4
push 0x1000
push 0x104
push 0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0x104
lea ecx, [esp + 0x14]
push ecx
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push ebx
push 0x100375ac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.inject_dll
push str._s:hThread:_d__err:_d
call fcn.10005ce0
add esp, 0x10
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0x104
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [esp + 0x110]
xor eax, eax
test esi, esi
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x10c
ret 4
Function at 0x10013400
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
sub esp, 0x534
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x530], eax
push ebx
push esi
mov esi, dword [esp + 0x544]
xor ebx, ebx
push 0x10013650
push str.MyService
mov dword [0x10042140], 0x30
mov dword [0x10042144], 2
mov dword [0x10042148], 1
mov dword [0x1004214c], ebx
mov dword [0x10042150], ebx
mov dword [0x10042154], ebx
mov dword [0x10042158], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x1004215c], eax
cmp eax, ebx
jne 0x10013487
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__MY_SERVICE__RegisterServiceCtrlHandler_failed__d_n
call fcn.10005ce0
add esp, 8
jmp 0x10013631
push 0x10042140
push eax
mov dword [0x10042144], 4
mov dword [0x10042154], ebx
mov dword [0x10042158], ebx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x100134c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__MY_SERVICE__SetServiceStatus_error__ld_n
call fcn.10005ce0
add esp, 8
push ebx
push str.__MY_SERVICE__Returning_the_Main_Thread__n
call fcn.10005ce0
mov eax, dword [esi]
mov ecx, dword [esp + 0x548]
push eax
push ecx
push str.ServiceMain__d__S
call fcn.10005ce0
push 0x103
lea edx, [esp + 0x141]
push ebx
push edx
mov byte [esp + 0x148], bl
call fcn.1001eb30
mov eax, dword [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x14c]
push 0x100353a8
push ecx
call esi
lea ecx, [esp + 0x154]
call fcn.10017e90
push 0x103
lea edx, [esp + 0x55]
push ebx
push edx
mov byte [esp + 0x5c], bl
call fcn.1001eb30
add esp, 0x38
push 0x104
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.safeTime.Bak
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10013631
push 0x103
lea ecx, [esp + 0x231]
push ebx
push ecx
mov byte [esp + 0x238], bl
call fcn.1001eb30
add esp, 0xc
push 0x1c
push 0x10042164
push 0x10042164
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [0x10042168]
push 0x104
lea edx, [esp + 0x230]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x207
lea ecx, [esp + 0x335]
push ebx
push ecx
mov byte [esp + 0x33c], bl
call fcn.1001eb30
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x23c]
push eax
lea ecx, [esp + 0x344]
push str.__s__DllCmd__ps__s
push ecx
call esi
add esp, 0x1c
push 0x10035375
lea ecx, [esp + 0xc]
call fcn.100024d0
push ebx
push ebx
lea edx, [esp + 0x338]
push edx
push 0x10036b98
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x20], 0x10
jb 0x10013631
mov eax, dword [esp + 0xc]
push eax
call fcn.1001c891
add esp, 4
mov ecx, dword [esp + 0x538]
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x534
ret 8
Function at 0x100139d0
Capabilities:
Delete registry value
Delete service
Stop service

Disassembly:
sub esp, 0x108
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0x10020
mov ebx, eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0x10042140
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10013a2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__DeleteDllService_FAIL._d__n
jmp 0x10013a6d
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.1001eb30
add esp, 0xc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea edx, [esp + 0xc]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push esi
push str.__DeleteDllService_SUCCESS._d__n
call fcn.10005ce0
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x108
ret
Function at 0x10014390
Capabilities:
Print debug messages

Disassembly:
push 0x1000
push 0
push 0x10042318
call fcn.1001eb30
mov ecx, dword [esp + 0x10]
add esp, 0xc
lea eax, [esp + 8]
push eax
push ecx
push 0x10042318
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0x10042318
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret

Function at 0x10014a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x10014a70
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10014a80
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10014ab0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x128
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x13c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x10014b2a
xor eax, eax
cmp ecx, ebp
je 0x10014b12
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x10014b38
cmp ecx, ebp
je 0x10014bcb
push ecx
jmp 0x10014bc5
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x10014b9a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.10014ab0
mov ebx, eax
cmp ebx, ebp
jne 0x10014be8
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x10014b60
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x10014bad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.100149a0
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x10014bcb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x128
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x10014bf7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10014bcd
Function at 0x10017bc0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10b8
call fcn.10023d10
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x10b0], eax
push esi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push 0
mov dword [esp + 0x20], 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
mov eax, dword [esp + 4]
cmp eax, 0x104
jb 0x10017c0a
mov eax, 0x104
mov dword [esp + 4], eax
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
jne 0x10017c2b
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10b0]
xor ecx, esp
call fcn.1001c89c
add esp, 0x10b8
ret
mov esi, dword [esp + 0xc]
push eax
lea edx, [esp + 0x74]
push esi
push edx
call fcn.10021c90
add esp, 0xc
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
jbe 0x10017c6c
lea ecx, [esp + 0x78]
cmp dword [ecx], 0
je 0x10017c61
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10017c52
jmp 0x10017c6c
lea eax, [eax + eax*2]
mov ecx, dword [esp + eax*4 + 0x70]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x10], 0
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x10017c13
mov edx, dword [esp + 8]
lea ecx, [esp + 0x24]
push ecx
push 1
push 2
push 0
push 0xf01ff
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x10017c13
push 0x40
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x34], 0x44
call fcn.1001eb30
xor ecx, ecx
push 0x40e
xor eax, eax
push ecx
lea edx, [esp + 0xcb6]
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0xcb8], cx
call fcn.1001eb30
push ebx
lea eax, [esp + 0xcbc]
push 0x100374a8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xcc0]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push str.ShellExecInService:pid_d__hproc_d__err_d
call fcn.10005ce0
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x10b4]
pop esi
xor ecx, esp
call fcn.1001c89c
add esp, 0x10b8
ret
Function at 0x10017e90
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x110], eax
cmp dword [0x10042314], 0
push esi
mov esi, ecx
jne 0x10017f6d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push 0x10043318
call edi
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x18]
push ecx
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x18]
push edx
call esi
push str.Parameters
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push str.Interval
lea ecx, [esp + 0x24]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop edi
test eax, eax
jne 0x10017f50
mov eax, dword [esp + 4]
test eax, eax
je 0x10017f50
mov dword [0x100403d0], eax
push 0x1004341c
push 0
push 0
push 0x10017d80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10042314], eax
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.1001c89c
add esp, 0x114
ret

Function at 0x10017f90
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x10042314], 0
je 0x10017fcd
push 1
push str.WebUnInit__d
call fcn.10005ce0
mov eax, dword [0x10042314]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x10042314]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10042314], 0
ret