joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017e27
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.01016760
call fcn.0100d921
pop ebp
jmp fcn.01002e94

Function at 0x10191b3
Capabilities:
Set registry value

Disassembly:
push 0x10
push 0x1019220
call fcn.010015a0
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x20006
push esi
push dword [ebp + 8]
push dword [ecx + 0x7c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x1019207
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x10201d2
mov dword [ebp - 4], 0xfffffffe
call fcn.01019241
mov eax, dword [ebp - 0x20]
call fcn.01001580
ret 0xc
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1019207
test byte [eax + 0x1c], 0x20
je 0x1019207
cmp byte [eax + 0x19], 2
jb 0x1019207
push dword [ebp - 0x20]
push 0x100186c
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x1019207

Function at 0x10280d6
Capabilities:
Shutdown system

Disassembly:
push 0x10
push 0x1028258
call fcn.010015a0
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x19], bl
push dword [ebp + 0xc]
push 0x1028238
call fcn.010028d6
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x19]
push eax
push dword [ebp + 8]
push 1
push 0x13
call fcn.0103a57a
mov esi, eax
cmp esi, ebx
jge 0x1028147
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102813b
test byte [eax + 0x1c], 1
je 0x102813b
cmp byte [eax + 0x19], 2
jb 0x102813b
push esi
push 0x100378c
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x20], eax
jmp 0x10281c2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x10281c2
mov eax, dword [0x1040184]
mov esi, 0x1040184
cmp eax, esi
je 0x1028193
test byte [eax + 0x1c], 1
je 0x1028193
cmp byte [eax + 0x19], 2
jb 0x1028193
push dword [ebp - 0x20]
push 0x100378c
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
mov eax, dword [0x1040184]
cmp dword [ebp + 0x18], ebx
je 0x10281c2
cmp eax, esi
je 0x10281ba
test byte [eax + 0x1c], 1
je 0x10281ba
cmp byte [eax + 0x19], 1
jb 0x10281ba
push 0x100378c
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
mov dword [ebp - 4], 0xfffffffe
call fcn.010281ed
push dword [ebp - 0x20]
push 0x1028248
call fcn.010028d6
mov eax, dword [ebp - 0x20]
call fcn.01001580
ret 0x14
Function at 0x10287c9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1040190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1028927
cmp eax, esi
ja 0x1028927
push 0x102896c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010059df
test eax, eax
jge 0x1028870
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102895a
test byte [eax + 0x1c], 1
je 0x102895a
cmp byte [eax + 0x19], 2
jb 0x102895a
push edi
push 0x100378c
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x1028955
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10288fd
push 0x1028984
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10288b7
push 0
push esi
push 0x1042de8
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x102895a
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x102895a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x10288ea
test byte [ecx + 0x1c], 1
je 0x10288ea
cmp byte [ecx + 0x19], 2
jb 0x10288ea
push eax
push 0x100378c
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1042dec], 1
jmp 0x102895a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102895a
test byte [ecx + 0x1c], 1
je 0x102895a
cmp byte [ecx + 0x19], 2
jb 0x102895a
push eax
push 0x100378c
push 0xd
jmp 0x102894f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102895a
test byte [ecx + 0x1c], 1
je 0x102895a
cmp byte [ecx + 0x19], 2
jb 0x102895a
push eax
push 0x100378c
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010024b0
leave
ret
Function at 0x10289aa
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, dword [0x1040184]
mov esi, 0x1040184
cmp eax, esi
je 0x10289ea
test byte [eax + 0x1c], 2
je 0x10289ea
cmp byte [eax + 0x19], 5
jb 0x10289ea
push dword [0x10401b8]
push dword [0x10401bc]
push 0x1010c90
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002a94
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.01007671
test eax, eax
jne 0x1028a07
lea eax, [ebp - 4]
push eax
call fcn.01009750
jmp 0x1028a31
mov eax, dword [0x1040184]
cmp eax, esi
je 0x1028a2e
test byte [eax + 0x1c], 2
je 0x1028a2e
cmp byte [eax + 0x19], 2
jb 0x1028a2e
push 0x1010c90
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
mov dword [ebp - 4], edi
push ebx
push dword [0x10401c0]
mov ebx, 0x10403b8
push ebx
call fcn.01030da1
xor esi, esi
inc esi
cmp dword [0x10401bc], edi
mov edi, dword [ebp + 8]
je 0x1028a90
call fcn.010299c5
lea eax, [ebp + 8]
push eax
push 0x2001b
push 0
push 0x1012498
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028a8c
push 0x1025ddc
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [edi], esi
jmp 0x1028adb
cmp dword [0x10401b8], 2
jne 0x1028ae0
call fcn.010299c5
push dword [ebp + 0xc]
call fcn.01028ccb
test eax, eax
je 0x1028ad8
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1028ad4
test byte [eax + 0x1c], 2
je 0x1028ad4
cmp byte [eax + 0x19], 5
jb 0x1028ad4
push 0x1010c90
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
mov dword [edi], esi
jmp 0x1028ae0
and dword [edi], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
push ebx
call fcn.01030dc1
cmp dword [edi], 0
pop ebx
jne 0x1028b26
call fcn.01028d55
cmp eax, esi
jne 0x1028b26
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1028b1f
test byte [eax + 0x1c], 2
je 0x1028b1f
cmp byte [eax + 0x19], 5
jb 0x1028b1f
push 0x1010c90
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
mov eax, dword [ebp + 0xc]
mov dword [edi], esi
mov dword [eax], esi
pop edi
xor eax, eax
pop esi
leave
ret 8

Function at 0x1028c6e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x57
pop esi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x1012498
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028cba
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x1012744
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 4
Function at 0x1028ccb
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001b
xor esi, esi
push esi
push 0x1012498
push 0x80000002
mov dword [ebp - 8], esi
xor ebx, ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028d48
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, 0x1025ddc
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1028d3f
cmp dword [ebp - 0x10], 4
jne 0x1028d3f
mov eax, dword [ebp - 8]
cmp eax, 2
ja 0x1028d3f
mov ecx, dword [ebp + 8]
push esi
push dword [ebp - 4]
mov dword [ecx], eax
inc ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x1028d55
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1012498
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028dac
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1028dbc
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 8], esi
je 0x1028db4
xor esi, esi
inc esi
mov eax, esi
pop esi
leave
ret
Function at 0x102a425
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
push 0x102a730
call fcn.010027c0
xor edi, edi
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x230], edi
call fcn.0102a3d4
mov dword [ebp - 4], edi
lea eax, [ebp - 0x228]
push eax
push 0x20019
push edi
push 0x102a6b8
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
je 0x102a4b9
cmp eax, 2
je 0x102a4b1
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102a67d
test dword [ecx + 0x1c], 0x1000
je 0x102a67d
cmp byte [ecx + 0x19], 2
jb 0x102a67d
push eax
push 0x1001f50
push 0x56
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
jmp 0x102a67d
cmp eax, edi
jne 0x102a67d
push edi
push edi
push edi
push edi
push 0x1042df8
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x228]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
cmp eax, edi
je 0x102a50b
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102a67d
test dword [ecx + 0x1c], 0x1000
je 0x102a67d
cmp byte [ecx + 0x19], 2
jb 0x102a67d
push eax
push 0x1001f50
push 0x57
jmp 0x102a4a1
mov eax, dword [0x1042df8]
cmp eax, edi
je 0x102a67d
shl eax, 2
push eax
call fcn.01001fd2
mov dword [0x1042df4], eax
cmp eax, edi
jne 0x102a565
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102a67d
test dword [eax + 0x1c], 0x1000
je 0x102a67d
cmp byte [eax + 0x19], 2
jb 0x102a67d
push 8
push 0x1001f50
push 0x58
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x102a4a7
xor esi, esi
mov dword [ebp - 0x234], esi
cmp esi, dword [0x1042df8]
jae 0x102a66d
mov dword [ebp - 0x22c], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
push dword [ebp - 0x228]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
cmp eax, 0x103
je 0x102a66d
cmp eax, edi
je 0x102a5e7
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102a67d
test dword [ecx + 0x1c], 0x1000
je 0x102a67d
cmp byte [ecx + 0x19], 2
jb 0x102a67d
push eax
push 0x1001f50
push 0x59
jmp 0x102a4a1
xor ecx, ecx
mov eax, dword [ebp - 0x22c]
mov word [ebp + eax*2 - 0x224], cx
inc eax
mov dword [ebp - 0x22c], eax
add eax, eax
push eax
call fcn.01001fd2
mov ecx, dword [0x1042df4]
mov dword [ecx + esi*4], eax
mov eax, dword [0x1042df4]
lea eax, [eax + esi*4]
cmp dword [eax], edi
jne 0x102a64d
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102a67d
test dword [eax + 0x1c], 0x1000
je 0x102a67d
cmp byte [eax + 0x19], 2
jb 0x102a67d
push 8
push esi
push 0x1001f50
push 0x5a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002a94
jmp 0x102a67d
mov ecx, dword [ebp - 0x22c]
add ecx, ecx
push ecx
lea ecx, [ebp - 0x224]
push ecx
push dword [eax]
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc esi
jmp 0x102a567
mov dword [0x1042df8], esi
mov dword [ebp - 0x230], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.0102a696
call fcn.01002808
ret
Function at 0x102d07f
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x1040190]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push edi
push 0x104
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
mov dword [ebp - 0x624], edi
call fcn.0102d009
test eax, eax
jne 0x102d1f1
lea eax, [ebp - 0x20c]
push eax
push 0x102d228
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.01004d53
add esp, 0x10
lea eax, [ebp - 0x620]
push eax
push 0x2001b
push edi
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
je 0x102d13d
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102d1f1
test dword [ecx + 0x1c], 0x1000
je 0x102d1f1
cmp byte [ecx + 0x19], 4
jb 0x102d1f1
push eax
push 0x100186c
push 0x41
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
jmp 0x102d1f1
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x624]
push eax
push edi
push edi
mov esi, 0x102d208
push esi
push dword [ebp - 0x620]
mov dword [ebp - 0x628], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
je 0x102d19e
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102d19e
test dword [ecx + 0x1c], 0x1000
je 0x102d19e
cmp byte [ecx + 0x19], 4
jb 0x102d19e
push eax
push 0x100186c
push 0x42
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
cmp dword [ebp + 0xc], edi
je 0x102d1e4
push esi
push dword [ebp - 0x620]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
cmp eax, edi
je 0x102d1e4
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x102d1e4
test dword [ecx + 0x1c], 0x1000
je 0x102d1e4
cmp byte [ecx + 0x19], 2
jb 0x102d1e4
push eax
push 0x100186c
push 0x43
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
push dword [ebp - 0x620]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x624]
xor ecx, ebp
pop edi
call fcn.010024b0
leave
ret 8
Function at 0x102d698
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10
push 0x102d778
call fcn.010015a0
xor esi, esi
mov dword [ebp - 0x20], esi
push 8
call fcn.01001fd2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], esi
cmp eax, esi
jne 0x102d6c6
mov dword [ebp - 0x20], 0xe
jmp 0x102d758
xor ecx, ecx
cmp dword [ebp + 8], esi
setne cl
inc ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], 3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x102d6f3
mov eax, dword [ebp - 0x1c]
or dword [eax + 4], 0x80000000
cmp dword [ebp + 0xc], esi
je 0x102d702
mov eax, dword [ebp - 0x1c]
or dword [eax + 4], 0x40000000
push esi
push dword [ebp - 0x1c]
push 0x102d5bb
call dword [sym.imp.ntdll.dll_TpSimpleTryPost]
mov edi, eax
cmp edi, esi
jge 0x102d758
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102d74f
test dword [eax + 0x1c], 0x4000
je 0x102d74f
cmp byte [eax + 0x19], 2
jb 0x102d74f
push edi
push 0x1025f4c
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
lea eax, [ebp - 0x1c]
push eax
call fcn.01001fac
mov dword [ebp - 4], 0xfffffffe
call fcn.0102d774
mov eax, dword [ebp - 0x20]
call fcn.01001580
ret 8
Function at 0x102df0d
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1040184]
mov edi, 0x1040184
cmp eax, edi
je 0x102df4f
test dword [eax + 0x1c], 0x200
je 0x102df4f
cmp byte [eax + 0x19], 5
jb 0x102df4f
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ecx + 0x10]
push 0x100da8c
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002a94
call fcn.01017d3c
cmp dword [0x10401e0], 0
je 0x102e00c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x102df6e
mov edi, 0x1040184
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call fcn.0102dd03
mov ebx, eax
call fcn.01018360
test ebx, ebx
je 0x102e016
mov eax, dword [0x1040184]
cmp eax, edi
je 0x102dfbc
test dword [eax + 0x1c], 0x200
je 0x102dfbc
cmp byte [eax + 0x19], 5
jb 0x102dfbc
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ecx + 0x10]
push ebx
push 0x100da8c
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01031ed2
call esi
push 0
push dword [ebp + 0xc]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 8], eax
call esi
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0x102
je 0x102e048
mov eax, dword [ebp - 4]
sub eax, edi
cmp dword [ebp + 0xc], eax
jbe 0x102e048
cmp dword [ebp + 0xc], 0xffffffff
je 0x102dffa
sub edi, dword [ebp - 4]
add dword [ebp + 0xc], edi
call fcn.01017d3c
cmp dword [0x10401e0], 0
jne 0x102df69
call fcn.01018360
xor eax, eax
inc eax
jmp 0x102e07d
mov eax, dword [0x1040184]
cmp eax, edi
je 0x102e011
test dword [eax + 0x1c], 0x200
je 0x102e011
cmp byte [eax + 0x19], 5
jb 0x102e011
mov ecx, dword [ebp + 8]
push dword [ecx + 0x10]
push 0x100da8c
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x102e011
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102e07b
test dword [eax + 0x1c], 0x200
je 0x102e07b
cmp byte [eax + 0x19], 5
jb 0x102e07b
mov ecx, dword [ebp + 8]
push dword [ecx + 0x10]
push 0x100da8c
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x102f6c9
Capabilities:
Impersonate user

Disassembly:
push 0x1c
push 0x102f938
call fcn.010015a0
mov dword [ebp - 0x1c], 0x57
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x2c]
push eax
push edi
push 5
push edi
push 0x102f918
push 0x102f8fc
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x102f74d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102f8b9
test dword [eax + 0x1c], 0x20000
je 0x102f8b9
cmp byte [eax + 0x19], 2
jb 0x102f8b9
push dword [ebp - 0x1c]
push 0x1025f6c
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x102f8b9
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_NtFilterToken]
mov esi, eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
jge 0x102f7ab
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102f8b9
test dword [eax + 0x1c], 0x20000
je 0x102f8b9
cmp byte [eax + 0x19], 2
jb 0x102f8b9
push dword [ebp - 0x1c]
push 0x1025f6c
push 0xd
jmp 0x102f73d
lea eax, [ebp - 0x28]
push eax
push edi
push edi
push 1
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationToken]
call esi
cmp eax, 0xc0000023
je 0x102f805
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102f8b9
test dword [eax + 0x1c], 0x20000
je 0x102f8b9
cmp byte [eax + 0x19], 2
jb 0x102f8b9
push dword [ebp - 0x1c]
push 0x1025f6c
push 0xe
jmp 0x102f73d
push dword [ebp - 0x28]
call fcn.01001fd2
mov dword [ebp - 0x24], eax
cmp eax, edi
jne 0x102f820
mov dword [ebp - 0x1c], 0xe
jmp 0x102f8b9
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp - 0x28]
push eax
push 1
push dword [ebp - 0x20]
call esi
cmp eax, edi
jge 0x102f867
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102f8b9
test dword [eax + 0x1c], 0x20000
je 0x102f8b9
cmp byte [eax + 0x19], 2
jb 0x102f8b9
push dword [ebp - 0x1c]
push 0x1025f6c
push 0xf
jmp 0x102f73d
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [0x104082c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
call fcn.0100c6a1
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x102f8ae
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x102f8b9
test dword [eax + 0x1c], 0x1000
je 0x102f8b9
cmp byte [eax + 0x19], 2
jb 0x102f8b9
push dword [ebp - 0x1c]
push 0x1025f6c
push 0x10
jmp 0x102f73d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.0102f8d7
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret 8
Function at 0x1030a21
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x18
push 0x1030b70
call fcn.010015a0
mov dword [ebp - 0x1c], 0x57
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
mov esi, 0x101034c
push esi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030aa2
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030b43
test dword [eax + 0x1c], 0x40000
je 0x1030b43
cmp byte [eax + 0x19], 2
jb 0x1030b43
push dword [ebp - 0x1c]
push 0x1002538
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x1030b43
push dword [ebp - 0x20]
call fcn.01001fd2
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x1030abd
mov dword [ebp - 0x1c], 0xe
jmp 0x1030b43
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
push dword [ebp + 0xc]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030afb
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030b43
test dword [eax + 0x1c], 0x40000
je 0x1030b43
cmp byte [eax + 0x19], 2
jb 0x1030b43
push dword [ebp - 0x1c]
push 0x1002538
push 0xe
jmp 0x1030a92
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x1030b40
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1030b43
test dword [eax + 0x1c], 0x40000
je 0x1030b43
cmp byte [eax + 0x19], 2
jb 0x1030b43
push dword [ebp - 0x1c]
push 0x1002538
push 0xf
jmp 0x1030a92
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.01030b61
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret 8