Function at 0x1000aad0
Capabilities:
Access the windows event log
Clear windows event logs
Create thread
Delete registry value
Query or enumerate registry value
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov ebx, ecx
cmp dword [ebx + 0x428], 0
push edi
lea edi, [ebx + 0x428]
jne 0x1000ab44
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.Console
push SysReAllocString
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ab39
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x28]
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x20], 1
ja 0x1000b612
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
cmp eax, 0xca
ja case.0x1000ab5c.20
movzx ecx, byte [eax + 0x1000b680]
jmp dword [ecx*4 + 0x1000b61c]
cmp dword [ebx + 0x430], 0
lea eax, [ebx + 0x430]
jne 0x1000b612
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [ebx + 8], 0
mov byte [esp + 0x13], 0xcb
jne 0x1000b612
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push 1
lea eax, [esp + 0x17]
push eax
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0xa45
jne 0x1000b612
push 0xa44
call fcn.10013162
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x20], edi
call fcn.10015af0
inc esi
mov ecx, 0x291
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x434], 1
jne 0x1000ac02
mov eax, dword [esp + 0x14]
add eax, 4
push eax
push str._s_bin
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [0x1003e6e4]
cmp esi, dword [0x1003e6e8]
je 0x1000ac5a
mov edi, dword [esp + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
lea ecx, [edi + 4]
add eax, 4
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000ac46
test dx, dx
je 0x1000ac42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000ac46
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000ac20
xor eax, eax
jmp 0x1000ac4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000acb4
add esi, 4
cmp esi, dword [0x1003e6e8]
jne 0x1000ac14
push 0xa45
call fcn.10010c34
mov edi, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0xa44
lea eax, [esi + 1]
push edi
mov byte [esi], 5
push eax
mov dword [edi + 0x204], 0
call fcn.10015250
add esp, 0xc
push esi
mov edx, 0xa45
mov ecx, ebx
call fcn.10002ba0
push edi
call fcn.10012a23
add esp, 4
push esi
call fcn.10012a23
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, 0x20c
lea eax, [edi + 0x20c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000acf6
test dx, dx
je 0x1000acf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000acf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000acd0
xor eax, eax
jmp 0x1000acfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000ad6e
test edi, edi
je 0x1000ad15
push edi
call fcn.10012a23
mov ecx, dword [esi]
add esp, 4
mov dword [ecx + 0x10], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
test eax, eax
je 0x1000ad30
push eax
call fcn.10013545
mov eax, dword [esi]
add esp, 4
mov dword [eax + 0x14], 0
mov eax, dword [esi]
test eax, eax
je 0x1000ad45
push eax
call fcn.10012a23
add esp, 4
mov dword [esi], 0
mov ecx, dword [0x1003e6e8]
lea eax, [esi + 4]
sub ecx, eax
sar ecx, 2
add ecx, ecx
add ecx, ecx
push ecx
push eax
push esi
call fcn.10012a40
add esp, 0xc
sub dword [0x1003e6e8], 4
jmp 0x1000ac5a
mov ecx, dword [esi]
push 0
push 0
push ecx
push 0x1000a420
push 0
push 0
call fcn.100134a5
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call fcn.10012a23
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa44
call fcn.10013162
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x20], edi
call fcn.10015af0
inc esi
mov ecx, 0x291
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0x208]
add esp, 0xc
push ecx
call fcn.10010c34
mov edx, dword [esi + 0x208]
mov edi, eax
mov eax, dword [ebp + 8]
add esp, 4
push edx
add eax, 0xa45
push eax
push edi
mov dword [esp + 0x24], edi
call fcn.10015250
add esp, 0xc
push 0x1c
call fcn.10013162
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], edi
lea ecx, [ebx + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 0x424]
mov dword [eax + 8], edx
mov ecx, dword [ebx + 0x42c]
mov dword [eax + 0xc], ecx
mov edx, dword [ebx + 0x434]
mov dword [eax + 0x18], edx
mov dword [esp + 0x24], eax
mov dword [eax], ebx
add esp, 4
lea eax, [esp + 0x20]
call fcn.1000cce0
mov ebx, dword [esi + 0x208]
add ebx, 0xa60
push ebx
call fcn.10010c34
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1000af22
mov edx, esi
mov edi, eax
mov ecx, 0x291
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x20]
lea edi, [eax + 0xa44]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x208]
mov edx, dword [esp + 0x18]
push ecx
push edx
add eax, 0xa60
push eax
call fcn.10015250
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push str.Console0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000af0a
push 0x1fe
call fcn.10010c34
mov ecx, dword [esp + 0x18]
add esp, 4
push 0
push 0
push 0
push 0
mov esi, eax
push 0
add ecx, 4
push esi
xor edx, edx
call fcn.10005830
mov ecx, dword [esp + 0x30]
add esp, 0x18
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
push edx
push 3
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x1000af0a
push esi
call fcn.10013545
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
push edx
call fcn.10013545
add esp, 4
mov eax, dword [esp + 0x20]
push 0
push 0
push eax
push 0x1000a420
push 0
push 0
call fcn.100134a5
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call fcn.1000b8c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.1000ba30
mov dword [esp + 0x20], eax
cmp dword [esp + 0x14], edi
jne 0x1000aff5
push 0x200
call fcn.10013162
add esp, 4
push 0x200
mov esi, eax
push edi
push esi
call fcn.10015af0
add esp, 0xc
push 0x100302e0
push 0x10030948
push str._s__s_n
lea edx, [esi + 2]
push 0xff
push edx
mov byte [esi], 1
call fcn.100132d4
add esp, 0x14
cmp dword [ebx + 8], edi
jne 0x1000afe3
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0x200
push esi
mov ecx, ebx
call edx
push esi
call fcn.10012a23
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [esp + 0x14]
inc edi
push edi
call fcn.10010c34
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
push eax
push ecx
lea edx, [esi + 1]
push edx
mov byte [esi], 3
call fcn.10015250
add esp, 0xc
push esi
mov edx, edi
mov ecx, ebx
call fcn.10002ba0
cmp dword [esp + 0x20], 0
je 0x1000b03c
mov eax, dword [esp + 0x20]
push eax
call fcn.10013545
add esp, 4
push esi
call fcn.10013545
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.1000c040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea edx, [esp + 0x20]
push edx
push 0
inc esi
push esi
mov dword [esp + 0x2c], 0
push 0x1000c750
jmp 0x1000af30
movzx eax, byte [esi + 1]
sub eax, 0
je 0x1000b0a5
dec eax
jne 0x1000b612
add esi, 2
push esi
mov edi, str.REMARK
mov eax, ebx
call fcn.1000c630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, 2
push esi
mov edi, str.GROUP
mov eax, ebx
call fcn.1000c630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
inc esi
push esi
push ebx
call fcn.1000b750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0
mov byte [esp + 0x13], 0x14
jne 0x1000b612
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 1
lea ecx, [esp + 0x17]
push ecx
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 1]
mov esi, dword [esi + 5]
push esi
push eax
xor ecx, ecx
push 1
push ecx
lea eax, [esp + 0x30]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
push eax
lea edx, [esp + 0x30]
lea ecx, [esp + 0x2c]
call fcn.1000ba30
mov edi, eax
mov eax, dword [esp + 0x20]
add eax, 5
push eax
mov dword [esp + 0x20], eax
call fcn.10010c34
mov esi, eax
mov eax, dword [esp + 0x24]
add esp, 4
push eax
lea ecx, [esi + 5]
push edi
push ecx
mov byte [esi], 0x14
mov dword [esi + 1], eax
call fcn.10015250
mov edx, dword [esp + 0x28]
add esp, 0xc
push esi
mov ecx, ebx
call fcn.10002ba0
test edi, edi
je 0x1000b16e
push edi
call fcn.10013545
add esp, 4
push esi
call fcn.10013545
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [esp + 0x24], str.Application
mov dword [esp + 0x28], str.Security
mov dword [esp + 0x2c], str.System
xor edi, edi
mov edx, dword [esp + edi*4 + 0x24]
push edx
push 0
call ebx
mov esi, eax
test esi, esi
je 0x1000b1bf
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc edi
cmp edi, 3
jl 0x1000b1a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1000c6e0
call fcn.1000aa40
push 0
call fcn.100145f7
mov ecx, 1
call fcn.100076f0
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.100076f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076f0
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.100076f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076f0
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.100076f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x11
call fcn.10002c90
mov eax, dword [ebx + 0x434]
add esp, 4
sub eax, 0
je 0x1000b2e1
dec eax
jne 0x1000b612
push 0x200
mov dword [ebx + 0x434], eax
call fcn.10013162
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10015af0
add esp, 0xc
push 0x100309d8
push 0xff
lea eax, [esi + 2]
push eax
mov byte [esi], 1
call fcn.100132f2
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b2cf
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0x200
push esi
mov ecx, ebx
call eax
push esi
call fcn.10012a23
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x200
mov dword [ebx + 0x434], 1
call fcn.10013162
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10015af0
add esp, 0xc
push 0x100309bc
push 0xff
lea ecx, [esi + 2]
push ecx
jmp 0x1000b2ac
push 0x7d2
call fcn.10013162
mov ecx, dword [ebp + 0xc]
add esp, 4
push ecx
mov edi, eax
push esi
push edi
call fcn.10015250
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x14]
push str.IpDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
dec ecx
push ecx
lea esi, [edi + 2]
push esi
push 3
push 0
push str.IpDate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x200
test eax, eax
je 0x1000b3ee
call fcn.10013162
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10015af0
add esp, 0xc
push 0x10030a04
lea eax, [esi + 2]
push 0xff
push eax
mov byte [esi], 1
call fcn.100132f2
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b3d1
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0x200
push esi
mov ecx, ebx
call eax
push esi
call fcn.10012a23
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.10013162
add esp, 4
push 0x200
mov edi, eax
push 0
push edi
call fcn.10015af0
add esp, 0xc
push 0x10030a18
lea edx, [edi + 2]
push 0xff
push edx
mov byte [edi], 1
call fcn.100132f2
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b437
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 0x200
push edi
call edx
push edi
call fcn.10012a23
add esp, 4
push 0
push 0x1003ab26
push 0x100308cc
push esi
call fcn.10007ba0
push 0
push 0x1003ad24
push 0x100308d4
push esi
call fcn.10007ba0
push 0x1003ad60
push 0
push 0x100308dc
push esi
call fcn.10007ba0
push 0
push 0x1003ad64
push 0x10030a2c
push esi
call fcn.10007ba0
add esp, 0x40
push 0
push 0x1003af62
push 0x10030a34
push esi
call fcn.10007ba0
push 0x1003afa0
push 0
push 0x10030a3c
push esi
call fcn.10007ba0
push 0
push 0x1003afa4
push 0x10030a44
push esi
call fcn.10007ba0
push 0
push 0x1003b1a2
push 0x10030a4c
push esi
call fcn.10007ba0
add esp, 0x40
push 0x1003b1e0
push 0
push 0x10030a54
push esi
call fcn.10007ba0
mov eax, dword [esp + 0x24]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.10013162
add esp, 4
cmp dword [ebp + 0xc], 0x7d2
mov edi, eax
jne 0x1000b612
push 0x7d2
push esi
push edi
call fcn.10015250
add esp, 0xc
push 0
push 0
push edi
push 0x1000a740
jmp 0x1000af30
cmp dword [edi], 0
je 0x1000b612
lea ecx, [esp + 0x20]
push ecx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x20]
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x20]
push 4
push edi
push 3
push 0
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi], 0
je 0x1000b612
lea edx, [esp + 0x20]
push edx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x20]
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 1], 0
jne case.0x1000ab5c.3
push 0
push ebx
call fcn.1000b8c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.10002c90
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8