joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fe13
Capabilities:
Set registry value

Disassembly:
mov eax, 0x101c998
call fcn.01018068
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x38]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.01007f34
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x100ff0d
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x100fef8
cmp dword [ebp - 0x1c], 2
jne 0x100fe7a
mov dword [ebp - 0x10], 0x80070050
jmp 0x100feeb
push 4
pop eax
push eax
lea ecx, [ebp - 0x20]
push ecx
push eax
push ebx
push 0x1001c0c
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x100fee8
push 0x254
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x100fec3
push ebx
push dword [esi + 0x54]
push ebx
push esi
call fcn.0100f839
mov edi, eax
jmp 0x100fec5
xor edi, edi
cmp edi, ebx
mov byte [ebp - 4], bl
je 0x100fee1
push dword [ebp + 8]
lea ecx, [edi + 0x78]
call fcn.01008b4d
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
inc dword [esi + 0x30]
jmp 0x100fee8
mov dword [ebp - 0x10], 0x8007000e
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x100ff14
jg 0x100feff
mov dword [ebp - 0x10], edi
jmp 0x100ff14
and edi, 0xffff
or edi, 0x80070000
jmp 0x100fefa
mov dword [ebp - 0x10], 0x8000ffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x1010de6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 1]
push eax
mov esi, ecx
lea eax, [ebp - 1]
xor edi, edi
push eax
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.01010b89
mov dword [esi + 0x30], edi
push 0xfa0
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], edi
call fcn.01007ed8
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push 0x1001c40
push 0x80000002
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1010e7a
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x54]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1001c28
push dword [ebp - 8]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], 4
mov dword [ebp - 0xc], eax
je 0x1010e6c
mov dword [ebp - 0xc], 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
je 0x1010e81
mov dword [esi + 0x54], 0x1e
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1011235
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x3f44
call fcn.01018150
mov eax, dword [0x1020128]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x3f44]
push 0x1f9f
push eax
call dword [sym.imp.msvcrt.dll__vsnwprintf]
add esp, 0x10
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x3f44]
jne 0x101127d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1011293
push dword [ebp + 8]
push eax
call dword [sym.imp.msvcrt.dll_fputws]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0xc
mov ecx, dword [ebp - 4]
call fcn.01017bb1
leave
ret

Function at 0x10112a2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001d00
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10112e9
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], esi
pop esi
je 0x10112f8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x1011301
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2944
call fcn.01018150
mov eax, dword [0x1020128]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2938]
push eax
xor esi, esi
xor edi, edi
inc esi
push esi
push edi
push 0x1001dd0
push 0x80000002
mov dword [ebp - 0x2944], edi
mov ebx, 0x1001dc0
mov dword [ebp - 0x2938], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10113bc
lea eax, [ebp - 0x2934]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2940]
push eax
push edi
push 0x1001da0
push dword [ebp - 0x2938]
mov dword [ebp - 0x2940], esi
mov dword [ebp - 0x2934], 0x42
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10113b0
cmp dword [ebp - 0x2940], esi
jne 0x10113b0
push 0x40
pop eax
cmp dword [ebp - 0x2934], eax
jbe 0x10113ad
cmp word [ebp - 8], di
jne 0x10113a5
mov dword [ebp - 0x2934], eax
cmp dword [ebp - 0x2934], eax
ja 0x10113b0
lea ebx, [ebp - 0x48]
push dword [ebp - 0x2938]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x293c]
push eax
mov esi, 0x28e8
push esi
lea eax, [ebp - 0x2930]
push eax
push ebx
push edi
mov dword [ebp - 0x293c], edi
call sub.REGAPI.dll_RegWinStationQueryW
test eax, eax
jne 0x10113ef
cmp dword [ebp - 0x293c], esi
mov eax, dword [ebp - 0x2888]
jae 0x10113f5
mov eax, dword [ebp - 0x2944]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01017bb1
leave
ret
Function at 0x10114f2
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1020128]
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
add eax, 0x488
push eax
push 0x1001ea0
lea eax, [ebp - 0x210]
push 0x1001e94
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
push esi
push 0x1001e20
push edi
call fcn.01011235
add esp, 0xc
test esi, esi
jle 0x101155f
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.01017bb1
leave
ret 4

Function at 0x101166c
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x1002150
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.01011235
pop ecx
pop ecx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x10116be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1001f40
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
jmp 0x1011777
push 2
lea ecx, [esi + 0x286]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10116f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f80
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.01011235
add esp, 0xc
jmp 0x101175f
lea ecx, [esi + 0x84]
push edi
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1011728
call edi
push eax
push 0x1002100
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.01011235
add esp, 0xc
add esi, 0x488
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x101175e
call edi
push eax
push 0x10020b0
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.01011235
add esp, 0xc
pop edi
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x101176f
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call esi
mov esi, dword [ebp - 4]
push esi
push 0x1002048
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
xor eax, eax
cmp esi, ebx
pop esi
sete al
pop ebx
leave
ret 4
Function at 0x101179a
Capabilities:
Create service
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1020128]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10022a0
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [ebp - 0x210], ebx
call fcn.01011235
pop ecx
pop ecx
push edi
mov ecx, esi
call fcn.010115ae
test eax, eax
je 0x10117ee
push 0x1002268
push edi
call fcn.01011235
pop ecx
pop ecx
mov dword [ebp - 0x210], ebx
jmp 0x10118f1
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x214], eax
jne 0x1011825
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f40
push edi
mov dword [ebp - 0x210], eax
call fcn.01011235
add esp, 0xc
jmp 0x10118f1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push 0x1002258
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 1
push 3
push 0x10
push 0xf01ff
lea eax, [esi + 0x488]
push eax
lea eax, [esi + 0x286]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
mov dword [ebp - 0x21c], eax
jne 0x10118a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002218
push edi
mov dword [ebp - 0x210], eax
call fcn.01011235
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10118f1
lea ecx, [ebp - 0x218]
push ecx
push 1
add esi, 0x84
push eax
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x10118db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002100
push edi
mov dword [ebp - 0x210], eax
call fcn.01011235
add esp, 0xc
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x210]
push 0x10021c8
push edi
call fcn.01011235
mov ecx, dword [ebp - 4]
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0x210], ebx
pop edi
pop esi
sete al
pop ebx
call fcn.01017bb1
leave
ret 4
Function at 0x1011924
Capabilities:
Delete service
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x10023c0
push dword [ebp + 8]
xor edi, edi
mov esi, ecx
inc edi
call fcn.01011235
pop ecx
pop ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.010115ae
test eax, eax
jne 0x1011964
push 0x1002380
push dword [ebp + 8]
call fcn.01011235
pop ecx
pop ecx
jmp 0x10119ff
push ebx
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
jne 0x1011993
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f40
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
jmp 0x10119fe
push 0x10020
add esi, 0x286
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, edi
jne 0x10119c1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f80
jmp 0x1011986
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
test edi, edi
jne 0x10119f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002340
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop ebx
push 0x10022f0
push dword [ebp + 8]
call fcn.01011235
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1011ea7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0x1002ae0
push dword [ebp + 8]
call fcn.01011235
and dword [ebp - 0x10], 0
push 0x1002aa4
push dword [ebp + 8]
call fcn.01011235
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov esi, 0x1001c40
push esi
mov edi, 0x80000002
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1011fd4
push ebx
lea eax, [ebp - 4]
push eax
mov esi, 0x1002a88
push esi
mov ebx, 0x1002a30
push ebx
push edi
call fcn.01017538
test eax, eax
jne 0x1011f4a
push dword [ebp - 4]
push 0x1002a08
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
push ebx
push edi
call fcn.01016f72
push 4
pop ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x10], 1
jmp 0x1011fb2
push 0x10029cc
push dword [ebp + 8]
call fcn.01011235
pop ecx
pop ecx
push 4
pop ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
mov dword [ebp - 0xc], eax
je 0x1011f99
cmp dword [ebp - 0x18], ebx
jne 0x1011f99
push dword [ebp - 4]
push 0x1002978
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
jmp 0x1011fb5
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x1002918
push dword [ebp + 8]
call fcn.01011235
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
jmp 0x1011fe6
push eax
push esi
push 0x10028c0
push dword [ebp + 8]
call fcn.01011235
add esp, 0x10
cmp dword [ebp - 0x10], 1
jne 0x1012012
push 0x1002830
push dword [ebp + 8]
call fcn.01011235
pop ecx
pop ecx
push 0x1001a40
push edi
call fcn.01016f72
push 0
mov ecx, 0x10202fc
call fcn.0100e195
push 0x10027fc
push dword [ebp + 8]
call fcn.01011235
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x1012177
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1020128]
push esi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1001504
lea eax, [ebp - 0x210]
push eax
call esi
push 0x1002c04
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push 0x1002bfc
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
mov esi, eax
push 0x1002bb8
push esi
call fcn.01011235
add esp, 0x10
push 0
push 0x10019e4
call fcn.01016aa3
test eax, eax
je 0x1012200
push eax
push 0x1002b50
push esi
call fcn.01011235
add esp, 0xc
push esi
call fcn.01011ea7
push 0x1002b14
push esi
call fcn.01011235
test esi, esi
pop ecx
pop ecx
je 0x1012227
push esi
call dword [sym.imp.msvcrt.dll_fflush]
push esi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01017bb1
leave
ret
Function at 0x10124ba
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov ebx, ecx
mov edi, 0x2000
push edi
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x10124ea
mov eax, 0x8007000e
jmp 0x1012653
push eax
mov ecx, ebx
call fcn.010123c1
test eax, eax
jge 0x10124fd
mov edi, eax
jmp 0x1012643
lea eax, [ebp - 2]
push eax
push dword [ebp - 0x10]
call fcn.01012237
test eax, eax
jne 0x1012517
mov edi, 0x80020009
jmp 0x1012643
push edi
call esi
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0xc], esi
jne 0x101252e
mov edi, 0x8007000e
jmp 0x1012643
mov ecx, ebx
call fcn.01012398
push esi
mov ecx, ebx
call fcn.010123c1
test eax, eax
jl 0x1012639
movzx eax, word [ebp - 2]
sub eax, 8
je 0x101261e
sub eax, 9
je 0x1012581
dec eax
dec eax
jne 0x101262a
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.01011b64
jmp 0x101262a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
je 0x1012599
mov edi, 0x80004005
jmp 0x101263b
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.01018150
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, esp
mov dword [ebp - 4], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
je 0x101258f
cmp dword [ebp - 8], edi
jle 0x1012605
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
push eax
call fcn.010122c1
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x10125cf
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101262a
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.01011b87
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.010123c1
test eax, eax
jge 0x1012651
mov edi, eax
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
jmp 0x1012653
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1012ffb
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x101301e
mov eax, 0x80004003
jmp 0x10130d0
cmp dword [ebp + 8], ebx
jne 0x101302d
mov eax, 0x80070057
jmp 0x10130d0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi], ebx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1013065
cmp eax, ebx
jle 0x10130cf
and eax, 0xffff
or eax, 0x80070000
jmp 0x10130cf
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x101307f
mov eax, 0x8007000e
jmp 0x10130cf
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x10130bf
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
push ebx
call edi
test eax, eax
jne 0x10130c4
call fcn.0101114e
push dword [esi]
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
mov dword [esi], ebx
pop ecx
mov ebx, edi
jmp 0x10130c4
mov ebx, 0x8007000e
push dword [ebp + 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10132dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020388]
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x1013304
mov esi, 0x54f
jmp 0x1013451
lea ecx, [ebp - 0xc]
push ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0x1002e64
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea eax, [ebp - 4]
push eax
push ebx
jne 0x101336c
mov edi, 0x1002df0
push edi
mov dword [ebp - 4], ebx
call sub.mstlsapi.dll_LsCsp_RetrieveSecret
mov esi, eax
cmp esi, ebx
je 0x1013340
cmp esi, 2
jne 0x101344d
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1013394
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.mstlsapi.dll_LsCsp_RetrieveSecret
mov esi, eax
cmp esi, ebx
jne 0x1013451
xor edi, edi
inc edi
jmp 0x10133b5
push 2
call sub.mstlsapi.dll_LsCsp_GetServerData
mov esi, eax
cmp esi, 2
je 0x1013382
cmp esi, ebx
jne 0x1013451
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x101339f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101344b
lea ecx, [ebp - 4]
push ecx
push eax
push 2
call sub.mstlsapi.dll_LsCsp_GetServerData
mov esi, eax
cmp esi, ebx
jne 0x1013451
push 0x1020368
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0101be3f
mov esi, eax
cmp esi, ebx
jne 0x1013451
call fcn.01016b17
test eax, eax
jne 0x101344d
cmp edi, ebx
jne 0x101344d
push dword [0x1020380]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [0x1020380]
push 4
push 1
push dword [0x1020388]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, eax
cmp esi, ebx
jne 0x1013451
mov eax, dword [0x1020384]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x101342a
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
test eax, eax
jne 0x1013424
call edi
mov esi, eax
mov dword [0x1020384], ebx
push 8
push 0xffffffffffffffff
push ebx
push 0x10111bd
push dword [0x1020380]
push 0x1020384
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x101344d
call edi
mov esi, eax
cmp esi, ebx
je 0x1013463
push dword [0x1020368]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [0x1020368], ebx
cmp dword [ebp - 8], ebx
je 0x1013471
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
jle 0x1013481
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10137a9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x101caa0
call fcn.01018068
sub esp, 0x218
mov eax, dword [0x1020128]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], esi
call fcn.01011afe
cmp eax, esi
jne 0x1013852
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1013809
lea eax, [ebp - 0x210]
push eax
call fcn.010137a9
cmp eax, esi
jne 0x1013851
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x10137f9
call fcn.01011a8b
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01011a8b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01017bb1
leave
ret 4