joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105bcc5
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], ecx
je 0x105be8d
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x214]
push eax
mov ebx, 0x20019
push ebx
push ecx
push 0x100ad68
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x224], 0x20a
mov dword [ebp - 0x214], ecx
call esi
test eax, eax
jne 0x105bda6
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x100ad44
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105bd8d
cmp dword [ebp - 0x21c], 1
jne 0x105bd8d
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.01034c79
test eax, eax
jl 0x105bd8d
mov dword [ebp - 0x218], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], 0
jne 0x105be8a
lea ecx, [ebp - 0x214]
push ecx
xor eax, eax
push ebx
push eax
push 0x100acd8
push edi
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x224], 0x20a
call esi
test eax, eax
jne 0x105be49
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x100ad44
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105be34
xor esi, esi
inc esi
cmp dword [ebp - 0x21c], esi
jne 0x105be34
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.01034c79
test eax, eax
jl 0x105be34
mov dword [ebp - 0x218], esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], 0
jne 0x105be8a
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x105be8a
lea eax, [ebp - 0x210]
push eax
push 0x100acc0
push dword [ebp + 0xc]
push dword [ebp - 0x220]
call fcn.01034d76
add esp, 0x10
test eax, eax
jl 0x105be8a
mov dword [ebp - 0x218], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.01047417
leave
ret 8
Function at 0x105bea6
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x1009fd0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105c00b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push edi
push 4
pop edi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
push esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x430], edi
push esi
jmp 0x105bfe3
lea eax, [ebp - 0x20c]
push eax
push 0x100a038
push 0x1002b4c
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.01034d76
add esp, 0x14
test eax, eax
jl 0x105bfb3
lea eax, [ebp - 0x420]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105bfb3
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push esi
push 0x10046ec
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x41c]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
push esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
mov dword [ebp - 0x424], 0x104
call ebx
test eax, eax
je 0x105bf3a
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
push 0x1009fd0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret
Function at 0x105c3f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x41c], 0
test eax, eax
push edi
mov edi, dword [ebp + 0xc]
je 0x105c4f7
push ebx
push eax
push 0x100af10
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01034d76
add esp, 0x10
test eax, eax
jl 0x105c4f6
and dword [ebp - 0x418], 0
push esi
mov esi, 0x20019
call fcn.0105e7ec
test eax, eax
je 0x105c45f
mov esi, 0x20119
lea eax, [ebp - 0x418]
push eax
push esi
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105c4f5
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x424]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push 0
push 0x100aef0
push dword [ebp - 0x418]
xor esi, esi
inc esi
mov dword [ebp - 0x420], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105c4e9
cmp dword [ebp - 0x420], esi
jne 0x105c4e9
push ebx
lea eax, [ebp - 0x414]
push eax
push edi
mov dword [ebp - 0x41c], esi
call fcn.010591a0
test eax, eax
je 0x105c4e9
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x10]
push edi
call fcn.01034c79
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop edi
call fcn.01047417
leave
ret 0xc
Function at 0x105ca6e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x105cb42
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x105cb31
push edi
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01034c79
push 0x100b14c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034cee
lea eax, [ebp - 0x414]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
je 0x105cb31
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034cee
lea eax, [ebp - 0x20c]
push eax
call fcn.01056f43
test eax, eax
je 0x105cb31
xor esi, esi
inc esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0105a63b
test eax, eax
jne 0x105cb31
push eax
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0105c64d
push edi
push 0x100b128
push 4
call fcn.0105e5ad
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01047417
leave
ret 4
Function at 0x105dc05
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10821f4]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
je 0x105dc3a
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x105dc3a
push dword [ebp + 8]
push esi
push 0x5c6
push dword [0x10821f4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105dc81
cmp dword [ebp + 8], esi
jne 0x105dc61
mov dword [ebp + 8], 1
push 4
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x1001db8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x105dc8b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10821f4]
and dword [ebp - 4], 0
test eax, eax
je 0x105dcbf
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x105dcbf
push dword [ebp + 8]
push 0
push 0x5c7
push dword [0x10821f4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105dcfc
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x1001de0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4
Function at 0x105e83f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
push esi
xor esi, esi
inc esi
push edi
mov dword [ebp - 0xc], esi
call fcn.0105e7ec
test eax, eax
je 0x105e864
mov dword [ebp - 0xc], 0x101
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0x1004d98
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
push 4
pop esi
jne 0x105e8d7
and dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x100bb6c
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105e8c4
and dword [ebp - 8], eax
cmp dword [ebp - 0x10], esi
jne 0x105e8c4
cmp dword [ebp - 0x14], eax
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x105e98f
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 0
push 0x100bb10
push ebx
call edi
xor ebx, ebx
test eax, eax
jne 0x105e930
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x100baf4
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105e927
cmp dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
jne 0x105e927
cmp dword [ebp - 0x10], ebx
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x105e98f
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push ebx
push 0x100ba80
push SysReAllocString
call edi
test eax, eax
jne 0x105e98f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x100ba44
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105e986
cmp dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
jne 0x105e986
cmp dword [ebp - 0x10], ebx
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x105f398
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0xffffffffffffffff
xor edi, edi
push 0x1001e8c
mov dword [ebp - 8], edi
call fcn.0107a7d6
mov ebx, eax
cmp ebx, edi
jl 0x105f546
lea ecx, [ebp - 0x30]
call fcn.0107a032
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0x7fff
call fcn.0107a032
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.0107a78e
mov ebx, eax
cmp ebx, edi
jge 0x105f3fd
lea ecx, [ebp - 0x24]
call fcn.0107a784
lea ecx, [ebp - 0x30]
call fcn.0107a784
jmp 0x105f546
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x105f42e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x105f41e
push 0x57
pop eax
cmp eax, edi
jle 0x105f42a
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x105f3e8
push esi
push 0x44
pop esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x105f44c
mov ebx, 0x8007000e
jmp 0x105f525
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0xc], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x14], esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
test ebx, ebx
jne 0x105f494
cmp eax, 0x7a
je 0x105f494
test eax, eax
jle 0x105f48d
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x105f525
lea ecx, [ebp - 0x3c]
call fcn.0107a032
mov eax, dword [ebp - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x3c]
call fcn.0107a78e
mov ebx, eax
test ebx, ebx
jl 0x105f51d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push dword [ebp - 0x24]
push 0
call edi
mov edi, eax
call esi
test edi, edi
jne 0x105f4e0
test eax, eax
jle 0x105f51b
and eax, 0xffff
or eax, 0x80070000
jmp 0x105f51b
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x105f4fb
call esi
test eax, eax
jne 0x105f4d2
push 0x57
pop eax
jmp 0x105f4d0
push 0xffffffffffffffff
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.0107a7d6
mov ebx, eax
test ebx, ebx
jl 0x105f51d
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x30]
call fcn.0107a9a4
mov ebx, eax
lea ecx, [ebp - 0x3c]
call fcn.0107a784
lea ecx, [ebp - 0x24]
call fcn.0107a784
lea ecx, [ebp - 0x30]
call fcn.0107a784
xor edi, edi
cmp dword [ebp - 4], edi
pop esi
je 0x105f546
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x105f554
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x105f561
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x101
xor edi, edi
push edi
push 0x1001b08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105f5cb
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100be04
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105f5be
cmp dword [ebp - 0xc], esi
je 0x105f5c1
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x105f7d2
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x210], ebx
xor edi, edi
mov dword [ebp - 0x214], ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x22c], 0x104
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
je 0x105f91f
cmp esi, 0xea
jne 0x105f881
cmp dword [ebp - 0x210], ebx
je 0x105f889
push dword [ebp - 0x210]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x210], ebx
jne 0x105f8e3
mov edi, dword [ebp - 0x220]
shr edi, 4
inc edi
shl edi, 4
push edi
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x210], eax
jne 0x105f80c
push 0xe
pop esi
cmp dword [ebp - 0x210], ebx
je 0x105f8c2
push dword [ebp - 0x210]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp esi, ebx
jne 0x105f9ee
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x214], ebx
push ebx
jmp 0x105f9ce
cmp esi, ebx
jne 0x105f90f
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
push dword [ebp - 0x228]
push ebx
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
inc dword [ebp - 0x214]
cmp esi, ebx
je 0x105f80c
jmp 0x105f8ae
xor esi, esi
jmp 0x105f8ae
lea eax, [ebp - 0x210]
push eax
push 0x109
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x105f98c
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x20106
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x105f98c
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call fcn.0105f7d2
cmp dword [ebp - 0x210], ebx
je 0x105f9a6
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x218], ebx
je 0x105f9ba
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x214]
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
cmp esi, ebx
je 0x105f923
cmp esi, 0x103
jne 0x105f9ee
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 8
Function at 0x105fde7
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x624], esi
je 0x106003a
cmp ecx, esi
je 0x106003a
lea ecx, [ebp - 0x624]
push ecx
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x105febf
push ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x624]
mov ebx, 0x104
push esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x634], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x105ff6b
mov esi, 0x1001e8c
lea eax, [ebp - 0x20c]
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x105fece
test dx, dx
je 0x105febb
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x105fece
add ecx, 4
add eax, 4
test dx, dx
jne 0x105fe99
xor eax, eax
jmp 0x105fed3
mov dword [ebp - 0x620], 0x80070057
jmp 0x106001d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x105ff0d
mov eax, dword [ebp - 0x638]
cmp eax, 6
je 0x105ff5c
cmp eax, 8
je 0x105ff5c
cmp eax, 9
je 0x105ff5c
cmp eax, 3
je 0x105ff5c
cmp eax, 7
je 0x105ff5c
push dword [ebp - 0x628]
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.01034cb3
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x61c]
push eax
mov dword [ebp - 0x628], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x105ff89
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x105ff3f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x620], eax
test eax, eax
jl 0x106001c
mov dword [ebp - 0x620], 0x80004005
jmp 0x106001c
mov dword [ebp - 0x620], 0x80070523
jmp 0x106001c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x105ff7f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x620], eax
cmp eax, esi
jmp 0x105ff47
lea eax, [ebp - 0x414]
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x105ffb7
test dx, dx
je 0x105ffb3
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x105ffb7
add ecx, 4
add eax, 4
test dx, dx
jne 0x105ff91
xor eax, eax
jmp 0x105ffbc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1060007
push 0xffffffffffffffff
lea eax, [ebp - 0x61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x1060007
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x1002b4c
push dword [ebp + 0x10]
push dword [ebp - 0x62c]
call fcn.01034db1
add esp, 0x14
jmp 0x106001c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x62c]
call fcn.01034cb3
pop ebx
cmp dword [ebp - 0x624], 0
je 0x1060032
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x620]
jmp 0x106003f
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047417
leave
ret 0xc
Function at 0x1060588
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.01059beb
test eax, eax
je 0x10605ee
push 0x100c330
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01034d30
lea eax, [ebp - 0x20c]
push eax
call fcn.01056f43
test eax, eax
je 0x10605ee
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01047417
leave
ret

Function at 0x10605ff
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
push 0x104
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01059beb
test eax, eax
je 0x1060701
push ebx
push esi
push 0x100c330
mov esi, 0x208
push esi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov dword [ebp - 0x418], ebx
call fcn.01034d30
cmp edi, ebx
je 0x1060691
push edi
push 0x100c360
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01034db1
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
push 0x20106
push ebx
lea eax, [ebp - 0x414]
push eax
push SysStringLen
jmp 0x10606a8
lea eax, [ebp - 0x418]
push eax
push 0x20106
push ebx
push 0x10041d8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x418], ebx
je 0x10606ff
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x10606c5
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100c34c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop edi
call fcn.01047417
leave
ret 4