joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x10259b1
call fcn.0100192d
mov ebx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
push esi
call edi
cmp dword [ebx + 0x9c], esi
je 0x10144ea
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 8]
push dword [ebx + 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x10144f3
cmp eax, esi
jne 0x1008fd5
push dword [ebp - 0x14]
mov ecx, edi
call fcn.01005065
xor eax, eax
inc eax
call fcn.01001641
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1007a5a
push 6
call edi
jmp 0x1008fdc
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
mov ecx, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
call fcn.01002db2
or dword [ebp - 4], 0xffffffff
jmp 0x1007a1f

Function at 0x1008899
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x14
mov eax, 0x102596d
call fcn.0100192d
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push ebx
call esi
cmp dword [edi + 0x9c], ebx
je 0x10144a0
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x20]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 8]
push dword [edi + 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0xea
je 0x10144a9
cmp eax, ebx
je 0x10144d8
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
call fcn.01001641
ret 8
push 6
call esi
jmp 0x10088ff
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
mov ecx, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
call fcn.01002db2
or dword [ebp - 4], 0xffffffff
jmp 0x10088c7
push dword [ebp - 0x14]
mov ecx, esi
call fcn.01005065
xor eax, eax
inc eax
jmp 0x1008901

Function at 0x1008d82
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x1008db6
and dword [esi + 0x10], 0
lea eax, [esi + 0x18]
push eax
push 0
push esi
push 0x1008dc2
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
je 0x10126b7
xor eax, eax
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1008db8
and eax, 0xffff
or eax, 0x80070000
jmp 0x1008db8
Function at 0x1009edc
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x10234a1
call fcn.0100192d
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x1010e10
cmp dword [ebp + 8], esi
je 0x1010e1a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1010e50
mov eax, dword [ebp - 0x18]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or eax, ecx
push eax
call dword [0x102b89c]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x1009fa5
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, esi
pop ecx
mov dword [edi], eax
je 0x1009f9e
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1010e39
xor ebx, ebx
push dword [ebp - 0x14]
call dword [0x102b8a0]
mov eax, ebx
call fcn.01001641
ret 8
mov ebx, 0x8007000e
jmp 0x1009f8b
mov ebx, 0x8007000e
jmp 0x1009f94
mov eax, 0x80004003
jmp 0x1009f96
mov eax, 0x80070057
jmp 0x1009f96
call fcn.0100a5bd
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x1009f8b
push eax
call fcn.0101924d
mov ebx, eax
jmp 0x1009f94
Function at 0x100a267
Capabilities:
Get token privileges

Disassembly:
mov edx, dword [eax]
cmp edx, dword [ebp - 0x1c]
je 0x100a320
jmp 0x100a319
push 0x18
mov eax, 0x1023b53
call fcn.0100165a
xor ebx, ebx
mov dword [ebp - 0x18], 0x1001780
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
push 0x28
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1011294
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 3
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x100a2c8
call esi
cmp eax, 0x7a
jne 0x10112af
push dword [ebp - 0x10]
call dword [0x102b89c]
mov ebx, eax
test ebx, ebx
je 0x10112b3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 3
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x10112bb
lea eax, [ebp - 0x20]
push eax
push 0x100a368
xor edi, edi
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor ecx, ecx
cmp dword [ebx], edi
jbe 0x100a328
lea eax, [ebx + 8]
mov edx, dword [eax - 4]
cmp edx, dword [ebp - 0x20]
je 0x100a252
mov dword [eax + 4], 4
inc ecx
add eax, 0xc
cmp ecx, dword [ebx]
jb 0x100a30d
push edi
push edi
push dword [ebp - 0x10]
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10112dd
push ebx
mov byte [ebp - 4], 0
call dword [0x102b8a0]
xor esi, esi
call esi
jmp 0x101129a
call esi
test eax, eax
jle 0x10112a8
jmp 0x101129e
call esi
test eax, eax
jle 0x10112cb
and eax, 0xffff
or eax, 0x80070000
push ebx
mov esi, eax
mov byte [ebp - 4], 0
call dword [0x102b8a0]
jmp 0x100a34d
call esi
cmp eax, edi
jle 0x10112cb
jmp 0x10112c1
Function at 0x100b66b
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
je 0x1015610
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x100b709
dec ecx
jne 0x100b6fd
cmp edx, 5
je 0x1015628
cmp edx, 4
jbe 0x1015663
cmp edx, 6
jne 0x100b6fa
cmp dword [ebp - 0x118], 0
jne 0x100b6fa
cmp dword [ebp - 0x114], 0x1554
jb 0x1015692
push 0x20
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001750
leave
ret
cmp edx, 4
je 0x101566b
jmp 0x100b6fd
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
jmp 0x100b6b5
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x101565c
dec ecx
je 0x1015651
dec ecx
je 0x101563f
push 0x14
jmp 0x100b6fc
cmp word [ebp - 0xc], 1
jb 0x1015649
push 0x10
pop eax
or eax, 4
jmp 0x100b6fd
cmp word [ebp - 0xc], 2
jb 0x1015649
push 8
jmp 0x1015648
push 4
jmp 0x100b6fc
push 2
pop eax
jmp 0x100b709
cmp dword [ebp - 0x118], 0
je 0x101568a
cmp dword [ebp - 0x118], 0xa
je 0x101568a
cmp dword [ebp - 0x118], 0x5a
jne 0x100b6fd
xor eax, eax
inc eax
jmp 0x100b6fd
push 0x40
jmp 0x100b6fc
Function at 0x100c69d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0100c771
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100c73f
cmp dword [ebp - 0x94], 5
jb 0x100c712
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100c75c
call fcn.0100c2cb
test eax, eax
jl 0x1013c01
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01001750
leave
ret
cmp dword [ebp - 0x88], 1
je 0x1013be9
jmp 0x100c712
cmp dword [ebp - 0x90], 0
jbe 0x100c712
jmp 0x100c70e
cmp dword [ebp - 0x94], 4
ja 0x100c70e
je 0x100c74e
jmp 0x100c712
mov byte [0x102ba18], 1
jmp 0x100c730

Function at 0x100c919
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1007060
call fcn.01006e48
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10291c4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1013c0d
xor esi, esi
inc esi
mov eax, dword [0x1029088]
cmp eax, esi
je 0x1013c2c
mov eax, dword [0x1029088]
test eax, eax
jne 0x1006fae
mov dword [0x1029088], esi
push 0x1007058
push 0x100704c
call fcn.0100bdd8
pop ecx
pop ecx
test eax, eax
jne 0x1013c39
mov eax, dword [0x1029088]
cmp eax, esi
jne 0x1006f63
push 0x1007048
push 0x1006fb8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1029088], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1006f70
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x102b930], ebx
jne 0x1013c47
push dword [0x10292a4]
push dword [0x10292a8]
push dword [0x10292a0]
call fcn.0100be75
add esp, 0xc
mov dword [0x1029074], eax
cmp dword [0x1029068], ebx
jne 0x1013ca3
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov dword [0x102ba64], esi
jmp 0x1006f3f
call fcn.0100c928
jmp 0x1006ed0
cmp eax, esi
jne 0x1013c1c
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1006f06
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006ef2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006f3f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1013cbd
push 0x102b930
call fcn.0101e0f4
pop ecx
test eax, eax
je 0x1006f7c
push ebx
push 2
push ebx
call dword [0x102b930]
jmp 0x1006f7c
cmp dword [0x102ba64], ebx
jne 0x1013cb1
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1029074]
call fcn.01006e8d
ret
Function at 0x101aac5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x101aae0
push 0x80004005
call fcn.0101a7fa
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x101aae2
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x101b1d3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.0101aa23
mov edi, eax
cmp edi, esi
je 0x101b235
lea ecx, [ebp - 0x208]
call fcn.0101a9b0
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001750
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101b253
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x208]
call fcn.0101b1d3
cmp eax, esi
jne 0x101b29b
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
je 0x101b23d
lea ecx, [ebp - 0x208]
call fcn.0101a9b0
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.0101a9b0
mov eax, esi
jmp 0x101b224
Function at 0x101c66c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10240b1
call fcn.01002df2
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
mov dword [ebp - 0x41c], eax
jne 0x101c6c5
call fcn.0100a5bd
mov esi, eax
jmp 0x101c7ca
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x101c6de
call fcn.0100a5bd
jmp 0x101c7bc
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x428], eax
je 0x101c6d4
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp - 0x420], edi
jae 0x101c744
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x101c72a
lea ecx, [ebp - 0x418]
call fcn.0101b172
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.0101b081
mov eax, esi
call fcn.01002e32
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0101b710
mov dword [ebp - 4], 1
jmp 0x101c770
cmp dword [ebp - 0x418], esi
jne 0x101c77f
mov esi, 0x8007000e
jmp 0x101c7be
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x101c6d4
mov ecx, dword [ebp - 0x418]
push dword [ebp + 0x14]
mov word [ecx + eax*2], si
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.0101c352
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x101c72f
lea ecx, [ebp - 0x418]
call fcn.0101b172
jmp 0x101c72f

Function at 0x101e075
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x101e088
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x101e084
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x101e0a9
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x101e0e8
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x101e0de
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x101e0ea
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x101e0ce
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x101efd9
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x83c
mov eax, 0x102585d
call fcn.0100280e
mov ebx, dword [ebp + 8]
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x828], ebx
je 0x101f0dd
cmp word [ebx], ax
je 0x101f0dd
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
push eax
mov esi, 0x101f0ec
push esi
call edi
mov ecx, ebx
lea edx, [ecx + 2]
mov bx, word [ecx]
inc ecx
inc ecx
test bx, bx
jne 0x101f019
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + eax + 0x104]
lea ecx, [ebp - 0x824]
call fcn.01002fac
and dword [ebp - 4], 0
push ebx
push ebx
lea ecx, [ebp - 0x824]
call fcn.01002db2
push eax
push esi
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x824]
call fcn.0101ea5f
mov eax, dword [ebp - 0x824]
push 0xffffffffffffffff
push dword [ebp - 0x818]
lea ecx, [ebp - 0x824]
push 0x101f0e8
call dword [eax + 0x10]
mov eax, dword [ebp - 0x824]
push 0xffffffffffffffff
push dword [ebp - 0x818]
lea ecx, [ebp - 0x824]
push dword [ebp - 0x828]
call dword [eax + 0x10]
push dword [ebp - 0x820]
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x101f0d2
push 0x8000ffff
lea ecx, [ebp - 0x848]
call fcn.01019efc
mov esi, eax
lea edi, [ebp - 0x838]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1026770
lea eax, [ebp - 0x838]
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll__CxxThrowException
lea ecx, [ebp - 0x824]
call fcn.01002feb
xor eax, eax
call fcn.0100284b
ret 4

Function at 0x102016c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x10163c8
push 0x10
xor ebx, ebx
push eax
mov byte [ebp - 0x25], bl
call fcn.0100914c
add esp, 0x10
test eax, eax
jl 0x10201ee
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push 8
lea eax, [ebp - 0x24]
push eax
push edi
push SysStringLen
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0x14
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x10201ee
cmp dword [ebp - 0x2c], 0x14
jne 0x10201ee
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.0102013f
mov byte [ebp - 0x25], al
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x25]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001750
leave
ret 4
Function at 0x1020207
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x10163c8
push 0x10
push eax
xor bl, bl
call fcn.0100914c
add esp, 0x10
test eax, eax
jl 0x1020277
lea eax, [ebp - 0x28]
push eax
push 2
push 0
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020277
push 0x14
push esi
push 3
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x102026e
inc bl
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.01001750
leave
ret 4

Function at 0x102028f
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x1029004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi], 2
jne 0x1020421
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jle 0x1020420
push dword [esi + 0x14]
lea ecx, [ebp - 0x16c]
call fcn.0101fe54
push 0x1020440
lea ecx, [ebp - 0x16c]
call fcn.0102016c
test al, al
je 0x102030d
mov eax, dword [ebp - 0x16c]
cmp eax, dword [esi]
jne 0x102030d
mov eax, dword [ebp - 0x168]
cmp eax, dword [esi + 4]
jne 0x102030d
mov eax, dword [ebp - 0x164]
cmp eax, dword [esi + 8]
jne 0x102030d
mov eax, dword [ebp - 0x15c]
cmp eax, dword [esi + 0x10]
je 0x1020420
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x1020438
push 0x10
push eax
call fcn.0100914c
add esp, 0x10
test eax, eax
jl 0x1020420
push dword [esi + 0x10]
lea eax, [ebp - 0x44]
push 0x1020430
push 0x10
push eax
call fcn.0100914c
add esp, 0x10
test eax, eax
jl 0x1020420
push edi
push 0x2710
push dword [esi + 8]
push dword [esi + 4]
call fcn.01006726
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - 0x148], edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x1020420
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x17c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x1020420
push 0x80
lea eax, [ebp - 0x144]
push eax
push edi
lea eax, [ebp - 0x164]
push eax
push edi
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
jle 0x1020420
lea eax, [ebp - 0x24]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14c], eax
push 0x1016398
lea eax, [ebp - 0x144]
push edi
mov dword [ebp - 0x154], 0x10027b4
mov dword [ebp - 0x148], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x1020420
push edi
lea eax, [ebp - 0x154]
push eax
push edi
push 4
push edi
push 0x800003f7
push 1
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01001750
leave
ret
Function at 0x1021802
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [ebp + 8], 2
mov dword [ebp - 0xc], eax
je 0x1021826
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [ebp + 8], 1
je 0x1021894
mov edi, dword [esi + 0x68]
test edi, edi
je 0x1021894
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1021839
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x6c]
push 0
add ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ecx
push eax
push dword [ebp + 0xc]
mov ebx, 0x4e4
push 9
push ebx
mov dword [ebp - 8], eax
call edi
mov ecx, dword [esi + 0x6c]
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
cmp eax, 0x7ffe2
jbe 0x1021879
mov ecx, esi
call fcn.0102163c
push dword [ebp - 4]
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x68]
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
push 9
push ebx
call edi
add eax, eax
add dword [esi + 0x6c], eax
pop ebx
test byte [ebp + 8], 8
mov esi, dword [sym.imp.msvcrt.dll_fprintf]
mov edi, 0x10218e0
je 0x10218b7
push dword [ebp + 0xc]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push edi
push eax
call esi
add esp, 0xc
test byte [ebp + 8], 4
je 0x10218cf
push dword [ebp + 0xc]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push edi
push eax
call esi
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
leave
ret 8

Function at 0x10218e8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [ebp + 8], 2
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x102190c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test byte [ebp + 8], 1
je 0x1021951
cmp dword [esi + 0x68], 0
je 0x1021951
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1021932
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1021924
sub eax, edx
sar eax, 1
lea edi, [eax + eax]
push edi
mov ecx, esi
call fcn.0102177e
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x68]
push edi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add dword [esi + 0x6c], edi
test byte [ebp + 8], 8
mov esi, dword [sym.imp.msvcrt.dll_fprintf]
mov edi, 0x1021998
je 0x1021972
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
add eax, 0x40
push edi
push eax
call esi
add esp, 0xc
test byte [ebp + 8], 4
je 0x1021988
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
add eax, 0x20
push edi
push eax
call esi
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
leave
ret 0xc