joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006f94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009a25c
push 0x10148390
call fcn.1001bc40
add esp, 8
push 0x1009a260
push 0x10148390
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x10007070
mov eax, dword [ebp + 8]
push eax
push 0x101485a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1009a270
push 0x101485a0
call fcn.1001bc40
add esp, 8
push 0x1009a274
push 0x101485a0
call fcn.1001bc40
add esp, 8
push 0
push 0x101485a0
call fcn.10022e60
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x10007070
mov eax, dword [ebp - 8]
push eax
call fcn.1001fc40
add esp, 4
push 0
push 0x10148390
push 0x101485a0
call fcn.1000a921
add esp, 0xc
test eax, eax
jne 0x10007069
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100070f0
xor eax, eax
jmp 0x100070f0
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009a284
push 0x10148390
call fcn.1001bc40
add esp, 8
push 0x1009a288
push 0x10148390
call fcn.1001bc40
add esp, 8
push 0
push 0x10148390
push 0
call fcn.100174aa
add esp, 4
push eax
push 0x100ffb00
call fcn.10017152
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x10148390
push 1
call fcn.100174aa
add esp, 4
push eax
push 0x1010fb00
call fcn.10017152
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100070f0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100070f5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009a298
push 0x10148390
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x100071ad
mov eax, dword [ebp + 8]
push eax
push 0x101485a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1009a2a8
push 0x101485a0
call fcn.1001bc40
add esp, 8
push 0
push 0x101485a0
call fcn.10022e60
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100071ad
mov eax, dword [ebp - 8]
push eax
call fcn.1001fc40
add esp, 4
push 0
push 0x10148390
push 0x101485a0
call fcn.1000a921
add esp, 0xc
test eax, eax
jne 0x100071a6
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100071d1
xor eax, eax
jmp 0x100071d1
push 0
push 0x10148390
push 0xbc00
push 0x1008e558
call fcn.10017152
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100071d1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100071d6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009a2b8
push 0x10148390
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x1000728e
mov eax, dword [ebp + 8]
push eax
push 0x101485a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1009a2c4
push 0x101485a0
call fcn.1001bc40
add esp, 8
push 0
push 0x101485a0
call fcn.10022e60
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1000728e
mov eax, dword [ebp - 8]
push eax
call fcn.1001fc40
add esp, 4
push 0
push 0x10148390
push 0x101485a0
call fcn.1000a921
add esp, 0xc
test eax, eax
jne 0x10007287
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100072ce
xor eax, eax
jmp 0x100072ce
push 0
push 0x10148390
push 0xffff
push 0x1007c2b0
call fcn.10017152
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x10148390
push 0x22a3
push 0x1008c2b0
call fcn.10017152
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100072ce
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100072d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.10005fe5
test eax, eax
jne 0x100072f0
xor eax, eax
jmp 0x100073c3
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009a2d0
push 0x10148390
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x1000739f
mov eax, dword [ebp + 8]
push eax
push 0x101485a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1009a2e0
push 0x101485a0
call fcn.1001bc40
add esp, 8
push 0
push 0x101485a0
call fcn.10022e60
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1000739f
mov eax, dword [ebp - 8]
push eax
call fcn.1001fc40
add esp, 4
push 0
push 0x10148390
push 0x101485a0
call fcn.1000a921
add esp, 0xc
test eax, eax
jne 0x10007398
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100073c3
xor eax, eax
jmp 0x100073c3
push 0
push 0x10148390
push 0xde00
push 0x1006e4b0
call fcn.10017152
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100073c3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100074b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [0x10144f70], 0
jmp 0x100074d1
inc dword [0x10144f70]
cmp dword [0x10144f70], 0x3000
jge 0x100074f2
mov eax, dword [0x10144f70]
mov byte [eax + 0x10144f80], 0
jmp 0x100074cb
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1009a2f0
push 0x10148390
call fcn.1001bc40
add esp, 8
push 0x1014b7b0
push 0x10144f80
push 0x10148390
call fcn.10009a07
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1000753e
mov eax, 0xffffffff
jmp 0x1000769d
mov ax, word [0x1014b7b0]
mov word [ebp - 4], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x1000763a
push 0x1009a2fc
push 0x1014b7c0
call fcn.1001bc30
add esp, 8
test byte [ebp + 0xc], 2
je 0x10007594
push 0x1014b7b0
push 0x10144f80
call fcn.10007977
add esp, 8
cmp eax, 0xffffffff
jne 0x10007594
mov eax, 0xffffffff
jmp 0x1000769d
test byte [ebp + 0xc], 1
je 0x100075c3
push 0x1014b7b0
push 0x10144f80
call fcn.10007b7b
add esp, 8
cmp eax, 0xffffffff
jne 0x100075c3
mov eax, 0xffffffff
jmp 0x1000769d
jmp 0x10007653
mov ax, word [0x1014b7b0]
mov word [ebp - 4], ax
test byte [ebp + 0xc], 1
je 0x10007601
push 0x1014b7b0
push 0x10144f80
call fcn.10007e76
add esp, 8
cmp eax, 0xffffffff
jne 0x10007601
mov eax, 0xffffffff
jmp 0x1000769d
test byte [ebp + 0xc], 2
je 0x10007630
push 0x1014b7b0
push 0x10144f80
call fcn.100076a2
add esp, 8
cmp eax, 0xffffffff
jne 0x10007630
mov eax, 0xffffffff
jmp 0x1000769d
jmp 0x10007653
cmp dword [ebp - 8], 1
je 0x100075c8
cmp dword [ebp - 8], 2
je 0x10007553
jmp 0x10007653
mov eax, dword [ebp - 4]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x1014b7b0]
cmp eax, ecx
je 0x10007696
push 0x1014b7b0
push 0x10144f80
push 0x10148390
call fcn.10009b50
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10007696
mov eax, 0xffffffff
jmp 0x1000769d
xor eax, eax
jmp 0x1000769d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000877f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1009a4ec
push 0x10148390
call fcn.1001bc40
add esp, 8
push 0x10148390
call fcn.1000a8f4
add esp, 4
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1009a4f8
push 0x10148390
call fcn.1001bc40
add esp, 8
push 0x10148390
call fcn.1000a8f4
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10008847
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 0x204], 0
push 0x200
push 0x10147f80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 2
je 0x10008923
push 0x10147f80
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push 0x1009a508
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.100087e8
add esp, 4
test eax, eax
je 0x100088cd
push 0x200400b
call fcn.1000427e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x10147f80
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push 0x1009a514
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.100087e8
add esp, 4
test eax, eax
je 0x10008923
push 0x200400a
call fcn.1000427e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
test byte [ebp + 8], 1
je 0x100089ed
push 0x10147f80
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push 0x1009a524
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
push 0x1009a528
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.100087e8
add esp, 4
test eax, eax
je 0x10008997
push 0x2004017
call fcn.1000427e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x10147f80
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push 0x1009a538
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.100087e8
add esp, 4
test eax, eax
je 0x100089ed
push 0x2004015
call fcn.1000427e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
jmp 0x100089f8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100089fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x10148390
push 0x1014b7d0
call fcn.1001bc30
add esp, 8
push 0x1009a548
push 0x10148390
call fcn.1001bc40
add esp, 8
push 2
push 0x10148390
call fcn.100261f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008abb
call fcn.1001c670
cmp dword [eax], 2
je 0x10008a97
cmp dword [ebp - 4], 0
je 0x10008a92
push 0x2010003
call fcn.1000427e
add esp, 4
push 0x80005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10008b32
jmp 0x10008abb
push 0x2010003
call fcn.1000427e
add esp, 4
push 0x80006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10008b32
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009a554
push 0x10148390
call fcn.1001bc40
add esp, 8
push 2
push 0x10148390
call fcn.100261f0
add esp, 8
mov dword [ebp - 4], eax
call fcn.1001c670
cmp dword [eax], 2
je 0x10008b2b
cmp dword [ebp - 4], 0
je 0x10008b2b
push 0x2010004
call fcn.1000427e
add esp, 4
push 0x80005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10008b32
xor eax, eax
jmp 0x10008b32
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a101
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0
push 0x200
push 0x10147f80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10147f80
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push 0x1009a998
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
push 0x1009a99c
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.10017361
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0xffffffff
jne 0x1000a1ad
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
push 0x10147f80
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc30
add esp, 8
push str.Api_1lnm.dll
lea eax, [ebp - 0x200]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.1001739e
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x1000a201
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1000a219
add esp, 4
xor eax, eax
jmp 0x1000a214
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a5a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x200
push 0x10148390
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
push 0x10148390
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x1000a5f2
push str._hasp_
lea eax, [ebp - 0x88]
push eax
call fcn.1001bc30
add esp, 8
jmp 0x1000a606
push str._HARDLOCK_
lea eax, [ebp - 0x88]
push eax
call fcn.1001bc30
add esp, 8
mov dword [0x10144f70], 0
jmp 0x1000a61b
inc dword [0x10144f70]
cmp dword [0x10144f70], 0x3000
jge 0x1000a63c
mov eax, dword [0x10144f70]
mov byte [eax + 0x10144f80], 0
jmp 0x1000a615
push 0x1014b7b0
push 0x10144f80
push 0x10148390
call fcn.10009a07
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1000a666
mov eax, 0xffffffff
jmp 0x1000a7bd
push 0x10148594
mov ax, word [0x1014b7b0]
push eax
push 0x10144f80
lea eax, [ebp - 0x88]
push eax
call fcn.100073c8
add esp, 0x10
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x1000a6b0
push 0x80002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000a7bd
push 0x1014ba20
xor eax, eax
mov ax, word [0x1014b7b0]
xor ecx, ecx
mov cx, word [0x10148594]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push 0x1009aa18
call fcn.100073c8
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x1000a700
mov ax, word [0x1014ba20]
mov word [ebp - 4], ax
jmp 0x1000a717
xor eax, eax
mov ax, word [0x1014b7b0]
xor ecx, ecx
mov cx, word [0x10148594]
sub eax, ecx
mov word [ebp - 4], ax
push 0x10148596
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.100073c8
add esp, 0x10
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x1000a7a5
push pe_nt_image_headers32
mov eax, dword [ebp + 0xc]
push eax
call fcn.1001bd20
add esp, 4
mov ecx, dword [ebp - 0x90]
add ecx, eax
inc ecx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.1001c8f0
add esp, 0xc
push 0x1009a158
mov eax, dword [ebp + 8]
push eax
call fcn.1001bee0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a796
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x1000a7a0
mov eax, dword [ebp + 8]
mov byte [eax + 0x80], 0
jmp 0x1000a7b6
push 0x1009aa1c
mov eax, dword [ebp + 8]
push eax
call fcn.1001bc30
add esp, 8
xor eax, eax
jmp 0x1000a7bd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a921
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000a95a
push 0x180
mov eax, dword [ebp + 0xc]
push eax
call fcn.100262d0
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x1000a962
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b3f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
push 0x101436e8
push 0xf003f
push 0
push 0x100d6204
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b473
cmp dword [0x101430c0], 2
je 0x1000b46e
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b6a5
jmp 0x1000b4bc
mov dword [ebp - 0x20], 1
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b4bc
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b6a5
push 0x101436e8
push 0xf003f
push 0
push 0x100d623c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b533
cmp dword [0x101430c0], 2
je 0x1000b520
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b6a5
cmp dword [ebp - 0x20], 1
jne 0x1000b52e
or dword [ebp - 0x10], 2
jmp 0x1000b69d
or dword [ebp - 0x10], 1
mov dword [ebp - 8], 0xc
push 0x100d6268
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b599
push 0x100d6270
lea eax, [ebp - 0x1c]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x1c]
push eax
push 0x1014b7c0
call fcn.1001bc30
add esp, 8
push 0x100d6278
lea eax, [ebp - 0x1c]
push eax
call fcn.1001bf60
add esp, 8
test eax, eax
jge 0x1000b5d6
cmp dword [ebp - 0x20], 1
jne 0x1000b5d1
or dword [ebp - 0x10], 2
jmp 0x1000b65b
push 0x100d6280
lea eax, [ebp - 0x1c]
push eax
call fcn.1001bf60
add esp, 8
test eax, eax
jg 0x1000b5f8
or dword [ebp - 0x10], 2
jmp 0x1000b65b
push 0x100d6288
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b64d
or dword [ebp - 0x10], 2
test byte [ebp - 4], 2
je 0x1000b65b
or dword [ebp - 0x10], 2
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b69d
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b6a5
mov eax, dword [ebp - 0x10]
jmp 0x1000b6a5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b6aa
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x101436e8
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesHaspnt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b70a
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b84a
mov dword [ebp - 4], 0xc
push 0x100d62bc
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b77f
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b84a
push 0x100d62c4
lea eax, [ebp - 0x14]
push eax
call fcn.1001bf60
add esp, 8
test eax, eax
jl 0x1000b801
push 0x100d62cc
push 0x10143080
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b801
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b84a
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101430c0], eax
cmp dword [0x101430c0], 0
je 0x1000b843
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000b84a
xor eax, eax
jmp 0x1000b84a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000bf49
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
cmp dword [0x10034ed4], 0
je 0x1000c037
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0x100d634c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000c037
mov dword [ebp - 4], 4
push 0x100d6384
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [ebp - 8], 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10143080
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000c02d
push 0x100d63a4
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [ebp - 0x18], 0
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000c01e
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000c037
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x1000c03f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000c044
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [0x10034ed4], 0
je 0x1000c0ca
cmp dword [ebp + 8], 1
jne 0x1000c0ca
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesPerfProcPerformance
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000c0ca
push str.Disable_Performance_Counters
push 0x10143080
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push 0x10143080
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000cac9
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x100d66d4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000cafc
xor eax, eax
jmp 0x1000cc1f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0x100d6708
push 0
push 0x100d670c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000cb41
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000cc1f
push 0x100d672c
call fcn.1001bd20
add esp, 4
push eax
push 0x100d6738
push 1
push 0
push 0x100d6744
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x1000cb85
xor eax, eax
jmp 0x1000cc1f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0x100d674c
push 0
push 0x100d6750
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000cbca
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000cc1f
push 0x100d6780
call fcn.1001bd20
add esp, 4
push eax
push 0x100d678c
push 1
push 0
push 0x100d6798
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x1000cc18
xor eax, eax
jmp 0x1000cc1f
xor eax, eax
jmp 0x1000cc1f
pop edi
pop esi
pop ebx
leave
ret