joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005344
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push 0x2001f
push ebx
push 0x1008dc0
push 0x80000002
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x10053b6
push 4
lea eax, [ebp - 8]
pop edi
mov esi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x1009c70
mov dword [ebp - 8], edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x1009c3c
push dword [ebp - 4]
call esi
cmp dword [ebp - 0x10], ebx
jne 0x101421e
cmp dword [ebp - 0xc], ebx
jne 0x101421e
cmp dword [ebp - 4], ebx
je 0x10053d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [0x10212e4]
cmp eax, ebx
je 0x1014242
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [0x10212e4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x10212e4], ebx
call fcn.0101ac6e
push 1
call fcn.01005c87
cmp dword [ebp - 0xc], ebx
jne 0x101429c
push 0x100be7c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10053c8
push 0x100be6c
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x1014282
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x10]
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push 0x1009c70
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
jmp 0x10053c8
push dword [ebp + 8]
call fcn.010142a9
jmp 0x10053c8
Function at 0x10053e0
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebx
push esi
push 1
pop ebx
shl ebx, cl
push 0x1021160
mov dword [esp + 0xc], ebx
call dword [sym.imp.NTDLL.DLL_RtlEnterCriticalSection]
mov esi, dword [0x1021150]
cmp esi, 0x1021150
je 0x1005421
push edi
push ebp
mov eax, dword [esi + 0xc]
mov edi, esi
test eax, ebx
jne 0x1005433
mov esi, dword [esi]
cmp esi, 0x1021150
jne 0x100540c
pop ebp
pop edi
push 0x1021160
call dword [sym.imp.NTDLL.DLL_RtlLeaveCriticalSection]
pop esi
pop ebx
pop ecx
pop ecx
ret 8
xor ebp, ebp
cmp dword [esi + 0x10], ebp
jne 0x1005441
test eax, 0x40000
je 0x10054ad
push 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
cmp edi, ebp
je 0x1005415
mov ebx, dword [esi + 0xc]
mov eax, dword [esp + 0x20]
shr ebx, 0x11
and ebx, 1
cmp eax, 1
je 0x1018cf7
cmp eax, 3
je 0x1018cf7
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], eax
lea eax, [esp + 0x14]
mov dword [edi + 8], esi
push eax
push ebp
push edi
push 0x10054d9
push ebp
push ebp
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x1018d0f
test ebx, ebx
je 0x10054bd
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, dword [esp + 0x10]
jmp 0x1005415
push ebx
push esi
call fcn.01005cb1
test eax, eax
jne 0x1005441
jmp 0x1018ce0
xor edi, edi
cmp dword [esi + 0x1c], edi
jbe 0x100549d
push 0x1388
push ebp
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x100549d
jmp 0x1018cfe
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov esi, dword [esi]
push edi
mov dword [ecx], eax
mov dword [eax + 4], ecx
call fcn.01018b91
jmp 0x1005417
xor ebx, ebx
jmp 0x100546f
add edi, 5
cmp edi, dword [esi + 0x1c]
jb 0x10054c4
jmp 0x100549d
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x10054a4
Function at 0x1005c36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1009eec
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x1005c80
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push esi
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x1005c77
push 1
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8
Function at 0x1005cb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, 0x1021160
push edi
call dword [sym.imp.NTDLL.DLL_RtlEnterCriticalSection]
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x1018bbd
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x1018bc3
push 4
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x1021178
lea edi, [esi + 0x20]
pop ebx
jmp 0x1005d1c
mov ecx, dword [ebp - 0x10]
push 1
pop eax
shl eax, cl
or dword [ebp + 8], eax
add dword [ebp - 0xc], ebx
inc dword [ebp - 0x10]
add edi, ebx
cmp dword [ebp - 0xc], 0x10211a0
jae 0x1005d67
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push 0
push dword [eax]
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x1005d0b
cmp dword [ebp - 4], 1
jne 0x1005d0b
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
mov dword [edi], eax
jne 0x1005d00
jmp 0x1018bd1
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x1009f6c
mov dword [ebp - 8], ebx
push dword [esi + 0x14]
call edi
test eax, eax
jne 0x1005d9a
cmp dword [ebp - 4], ebx
jne 0x1005d9a
cmp dword [ebp - 0x14], eax
je 0x1005d9a
or byte [ebp + 0xa], 2
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x1009f54
push dword [esi + 0x14]
call edi
test eax, eax
jne 0x1005e07
cmp dword [ebp - 4], ebx
jne 0x1005e07
cmp dword [ebp - 0x14], eax
je 0x1005e07
mov eax, dword [ebp + 8]
or eax, 0x10000
test eax, eax
je 0x1018bd1
test dword [ebp + 0xc], eax
je 0x1018bd1
push dword [esi + 0x14]
mov dword [esi + 0xc], eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 0x18]
and dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
push 0x1021160
call dword [sym.imp.NTDLL.DLL_RtlLeaveCriticalSection]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
jmp 0x1005dcb
push edi
jmp 0x1005df7
push edi
call dword [sym.imp.NTDLL.DLL_RtlLeaveCriticalSection]
xor eax, eax
jmp 0x1005e00
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
xor eax, eax
push 0x1021160
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
jmp 0x1018bc4
Function at 0x1005e0c
Capabilities:
Delete file
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push esi
mov esi, 0x105
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005e9e
jmp 0x1005e46
lea eax, [ebp - 0x20c]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
test eax, eax
je 0x1005e97
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x1005e33
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.MSVCRT.DLL_wcscpy]
pop ecx
lea eax, [ebp - 0x43c]
pop ecx
push 0x1009f88
push eax
call dword [sym.imp.MSVCRT.DLL_wcscat]
pop ecx
lea eax, [ebp - 0x43c]
pop ecx
push eax
call fcn.01005ea2
test eax, eax
je 0x1005e33
jmp 0x1014614
push edi
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
pop edi
pop esi
leave
ret
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x1005e33

Function at 0x1005ea2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 8], 0xffffffff
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
push 0x1009fa0
xor ebx, ebx
push 0x3e8
push 0xa
mov dword [ebp - 0xc], ebx
xor esi, esi
call fcn.01005f26
mov edi, eax
cmp edi, 1
jne 0x1005efd
push ebx
push 0x80
push 3
push ebx
push eax
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x1005ef4
xor edi, edi
cmp edi, 1
je 0x101458f
cmp esi, ebx
jne 0x10145fa
cmp dword [ebp - 8], 0xffffffff
jne 0x1014606
cmp dword [ebp - 0xc], ebx
je 0x1005f1d
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_DeregisterEventSource]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, 0x8000
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10145f6
lea eax, [ebp - 4]
push ebx
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffffe
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edi, eax
cmp edi, 1
jne 0x1005efd
mov eax, dword [ebp - 4]
push esi
push edi
push ebx
mov byte [esi + eax], bl
mov eax, dword [ebp - 4]
push ebx
push 0x400003e9
push 4
push ebx
mov byte [esi + eax + 1], bl
call fcn.01011b17
add esp, 0x1c
test eax, eax
je 0x1005efd
xor edi, edi
jmp 0x1005efd
xor edi, edi
jmp 0x10145bd
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x1005f05
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1005f0f
Function at 0x10068f1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x78
pop esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
test edi, edi
je 0x1006931
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x101771b
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10
cmp ebx, 0xea
jne 0x101773a
add esi, esi
push 0x42
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LocalReAlloc]
test eax, eax
je 0x101774f
mov edi, eax
jmp 0x100690a
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x100692e
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor edi, edi
jmp 0x100692e

Function at 0x1006c68
Capabilities:
Impersonate user
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.01006d4a
mov dword [esi + 0xb0], eax
lea eax, [ebp + 8]
push eax
push 0x20019
push ebx
push 0x100a104
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x1006cd1
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x100a0e4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 0x692
push ebx
push ebx
call fcn.01004ffc
add esp, 0xc
xor eax, eax
cmp dword [ebp - 4], ebx
lea edi, [ebp - 0x2c]
push 8
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2c], 0x20
jne 0x1016631
mov eax, dword [esi + 0xc8]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x94]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x28]
call dword [sym.imp.USERENV.DLL_LoadUserProfileW]
test eax, eax
je 0x101665e
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x8c], eax
mov eax, dword [esi + 0xb0]
cmp eax, ebx
jne 0x101663a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
or dword [ebp - 0x28], 1
jmp 0x1006cfa
push dword [esi + 0x98]
push dword [esi + 0x90]
push dword [esi + 0xc8]
push dword [ebp - 0x10]
push dword [esi + 0x28]
push eax
call dword [sym.imp.USERENV.DLL_Ordinal_130]
jmp 0x1006d41
mov dword [esi + 0x8c], ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x1006d43
Function at 0x1006dad
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
push edi
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
add eax, 0x28
push eax
call fcn.0100a927
mov esi, eax
cmp esi, edi
je 0x1016592
push 2
call fcn.01006e91
mov ebx, eax
cmp ebx, edi
je 0x101659d
push esi
call fcn.0100a9e8
mov ax, word [ebx]
mov esi, ebx
jmp 0x1006e02
inc esi
inc esi
mov ax, word [esi]
cmp ax, di
je 0x1006e0d
cmp ax, 0x5c
jne 0x1006dfd
cmp word [esi], 0x5c
jne 0x10165b2
lea eax, [ebp - 8]
mov word [esi], di
push eax
lea eax, [ebp - 0x214]
inc esi
push eax
inc esi
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
je 0x10165c1
lea eax, [ebp - 0x214]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x10165d7
lea eax, [ebp - 4]
push eax
push 0x20
push edi
push edi
push ebx
push edi
call dword [0x1023084]
mov esi, eax
cmp esi, edi
jne 0x10165c9
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 0x10
je 0x10165fc
push dword [ebp - 4]
call fcn.01006efc
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x1006e8a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
mov edi, eax
call fcn.0100a9e8
mov eax, edi
jmp 0x1006e8a
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push 0xd
pop eax
jmp 0x1006e8a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, esi
jmp 0x1006e8a
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push edi
call fcn.0101d13d
test eax, eax
jne 0x1006e52
mov eax, dword [ebp + 0xc]
push dword [ebp - 0xc]
mov dword [eax], 1
jmp 0x1006e7c
push dword [ebp + 8]
call fcn.01016536
test eax, eax
jne 0x1006e79
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x1006e79

Function at 0x1006e91
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
push esi
push edi
mov dword [ebp - 4], 0x4b
je 0x10164e9
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10164f5
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call sub.SECUR32.DLL_GetUserNameExW
test al, al
je 0x1016502
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
mov dword [ebp - 4], 0xc8
jmp 0x1006eab
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
jmp 0x1006eda
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp edi, 0x534
je 0x1016528
inc ebx
cmp ebx, 3
ja 0x1016528
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x1006ec3
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor esi, esi
jmp 0x1006eda
Function at 0x1007971
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
push ebx
push esi
push edi
xor edi, edi
push 0x1008ef8
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.DLL_RegisterEventSourceW]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x1007a42
push dword [ebp + 8]
lea eax, [ebp - 0x524]
push 0x100a500
push eax
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x524]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push edi
push edi
push eax
push 0x400
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push 0x1100
call dword [sym.imp.KERNEL32.DLL_FormatMessageW]
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x100d969
mov eax, dword [ebp + 0x1c]
cmp eax, edi
jne 0x100d978
cmp dword [ebp + 0x14], edi
jne 0x100d988
mov eax, dword [ebp + 0xc]
shr eax, 0x1e
sub eax, edi
je 0x100da0f
dec eax
je 0x100da03
dec eax
je 0x100d9f7
dec eax
jne 0x1007a26
mov dword [ebp - 8], 1
lea eax, [ebp - 0x24]
push edi
push eax
push edi
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.DLL_ReportEventW]
cmp dword [ebp - 0x14], edi
je 0x1007a50
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.DLL_DeregisterEventSource]
cmp word [ebp - 4], 2
jne 0x1007a64
cmp dword [ebp - 0x20], edi
je 0x1007a64
push dword [ebp - 0x20]
call fcn.01002494
pop edi
pop esi
pop ebx
leave
ret 0x18
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
jmp 0x10079ec
movzx ecx, word [ebp - 4]
inc dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x24], eax
jmp 0x10079f7
lea ecx, [ebp - 0xc]
mov eax, 0x100
push ecx
mov esi, dword [sym.imp.ADVAPI32.DLL_GetTokenInformation]
mov dword [ebp - 0xc], eax
push eax
lea eax, [ebp - 0x124]
push eax
push 1
push dword [ebp + 0x14]
call esi
test eax, eax
jne 0x100d9ef
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x1007a00
push dword [ebp - 0xc]
call fcn.01005a7e
mov ebx, eax
cmp ebx, edi
je 0x1007a00
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push 1
push dword [ebp + 0x14]
call esi
test eax, eax
je 0x1007a00
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
jmp 0x1007a00
mov eax, dword [ebp - 0x124]
jmp 0x100d9e7
mov dword [ebp - 8], 2
jmp 0x1007a26
mov dword [ebp - 8], 4
jmp 0x1007a26
mov dword [ebp - 8], edi
jmp 0x1007a26
Function at 0x1007db5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [0x102103c], ebx
je 0x1007e5d
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProfileIntW]
push ebx
mov edi, 0x1008ef8
push 0x100a5b0
push edi
call esi
dec eax
push ebx
neg eax
sbb eax, eax
push 0x100a590
inc eax
push edi
mov byte [0x1021788], al
call esi
dec eax
push ebx
neg eax
sbb eax, eax
push 0x100a574
inc eax
push edi
mov byte [0x102178c], al
call esi
mov dword [0x1021790], eax
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], bx
mov word [ebp - 6], bx
mov word [ebp - 0xc], 0x41
jmp 0x1007e3a
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.01007e62
inc word [ebp - 0xc]
cmp word [ebp - 0xc], 0x5a
jae 0x1007e5b
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
dec eax
dec eax
je 0x1007e23
sub eax, 3
jne 0x1007e2f
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0100802c
jmp 0x1007e2f
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x100849d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp byte [0x10219a0], bl
jne 0x1017b46
push 1
pop eax
pop ebx
leave
ret 4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x1017bd9
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.TempPageFile
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x1017b96
cmp dword [ebp - 0x10], 4
jne 0x1017b96
cmp dword [ebp - 8], 4
je 0x1017b99
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp - 4], 1
jne 0x10084b2
push ebx
push dword [ebp + 8]
call fcn.01005f67
push 0x10
push 0x62d
push 0x62c
push ebx
push dword [ebp + 8]
call fcn.01011b97
cmp eax, 0x66
jne 0x10084b2
push eax
jmp 0x10084b4
mov dword [ebp - 4], ebx
jmp 0x1017ba2

Function at 0x10086f8
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xc], 0xc
mov esi, dword [eax + 8]
mov eax, dword [esi + 0x38]
add esi, 0x28
push edi
push dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
or al, 4
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
cmp edi, ebx
je 0x10138bd
push edi
push esi
call fcn.0100a927
cmp eax, ebx
je 0x1008761
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
je 0x1008761
mov dword [ebp + 8], 1
cmp dword [ebp + 8], ebx
je 0x10138c4
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
xor eax, eax
jmp 0x100876c
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edi, edi
jmp 0x100876a
Function at 0x1008991
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
lea eax, [ebp - 0x21c]
xor edi, edi
push 0x100a71c
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x258
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
cmp dword [ebp + 0x10], edi
jne 0x1016c05
cmp dword [ebp + 0xc], edi
je 0x1016d49
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0100aee2
cmp esi, edi
jne 0x1016d3e
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x14
mov esi, dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
lea eax, [ebp - 8]
mov ebx, 0x20019
push eax
push ebx
push edi
mov edi, 0x80000002
push 0x1008dc0
push edi
call esi
test eax, eax
jne 0x1016c53
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x100c388
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0x1008e2c
push edi
call esi
test eax, eax
jne 0x1016c92
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x100c388
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1016d1d
or dword [ebp - 4], 0xffffffff
call fcn.0101a80d
mov esi, eax
test esi, esi
je 0x1016d16
push 1
push esi
call fcn.0101ac28
push esi
push 0
lea eax, [ebp - 0x21c]
push 0x400
push eax
xor eax, eax
push dword [ebp + 0x18]
cmp dword [ebp + 0xc], eax
push dword [ebp + 0x14]
sete al
push eax
push dword [ebp + 8]
call fcn.0101a917
test eax, eax
mov dword [ebp - 0x10], eax
je 0x1016d16
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x1016cf4
push 2
push dword [ebp + 8]
call fcn.010025fb
mov edi, eax
push dword [ebp - 4]
push esi
call fcn.0101aae4
test eax, eax
jne 0x1016d08
push eax
push esi
call fcn.0101ab1f
test edi, edi
je 0x1016d16
push 3
push dword [ebp + 8]
call fcn.010025fb
xor edi, edi
jmp 0x10089e4
cmp eax, 0x7d00
jb 0x1016d30
mov dword [ebp - 4], 0x1e84800
jmp 0x1016ca1
imul eax, eax, 0x3e8
mov dword [ebp - 4], eax
jmp 0x1016ca1
push esi
call fcn.0101aba8
jmp 0x10089ec
push edi
push edi
push edi
lea eax, [ebp - 0x21c]
push dword [ebp + 0x18]
push edi
push edi
push dword [ebp + 0x14]
push eax
call fcn.01003c3c
jmp 0x10089e4