joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102102a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x10743c4], 0
jne 0x1021061
call fcn.0102032f
test eax, eax
je 0x1021061
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x1020ed3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4
Function at 0x102201d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x107342c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [0x1074a18], ebx
mov dword [ebp - 0x14], eax
je 0x10220db
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileIntW]
push edi
push ebx
push 0x1012148
mov edi, 0x1010d8c
push edi
call esi
dec eax
neg eax
push ebx
sbb al, al
push 0x1012128
inc al
push edi
mov byte [0x10743d0], al
call esi
dec eax
neg eax
push ebx
sbb al, al
push 0x101210c
inc al
push edi
mov byte [0x10743d1], al
call esi
pop edi
mov dword [0x10743dc], eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], bx
mov word [ebp - 0xa], bx
mov word [ebp - 0x10], 0x41
pop esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x10220c1
sub eax, 3
jne 0x10220d0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.01021e7f
jmp 0x10220d0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.01021f2a
inc word [ebp - 0x10]
cmp word [ebp - 0x10], 0x5a
jb 0x102209d
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0103e4d8
leave
ret 8
Function at 0x1023055
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x107342c]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
movzx eax, cx
push ebx
push esi
dec eax
cmp eax, 0xd
push edi
mov edi, dword [ebp + 8]
ja case.0x102307e.7
jmp dword [eax*4 + 0x1023251]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10743f8]
mov esi, eax
sub eax, ecx
cmp esi, ecx
ja 0x102309a
dec eax
cmp eax, 0x1388
jbe case.0x102307e.7
xor ebx, ebx
push ebx
push ebx
push edi
push 0x1017d1d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je case.0x102307e.7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10743f8], esi
jmp case.0x102307e.7
mov word [ebp - 0xc], 0x32
mov word [ebp - 0xa], 0x31
push dword [edi + 8]
call fcn.01017cb3
neg eax
sbb eax, eax
neg eax
add eax, 0x30
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xac]
push 0x10124f0
xor ebx, ebx
push eax
mov word [ebp - 6], bx
call esi
add esp, 0xc
push 0x2000000
push ebx
push ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
cmp eax, ebx
mov dword [ebp - 0x2b8], eax
je case.0x102307e.7
mov eax, dword [edi + 8]
push dword [eax + 8]
lea eax, [ebp - 0x2b4]
push 0x10124e8
push eax
call esi
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea ecx, [ebp - 0x2bc]
push ecx
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp + eax*2 - 0x2b4]
push eax
push 2
push dword [ebp - 0x2b8]
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
call fcn.0103dac9
mov esi, eax
cmp esi, ebx
je 0x10231bc
push 0x493e0
push esi
call fcn.0103d332
push 2
push esi
call fcn.0103d664
push esi
push ebx
push ebx
lea eax, [ebp - 0xac]
push eax
push ebx
lea eax, [ebp - 0x2b4]
push eax
xor eax, eax
cmp dword [edi + 0x1c], ebx
sete al
push eax
push edi
call fcn.0103d393
push esi
call fcn.0103db87
push dword [ebp - 0x2b8]
call dword [sym.imp.USER32.dll_CloseDesktop]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.0103e4d8
leave
ret 0xc
mov word [ebp - 0xc], 0x32
mov word [ebp - 0xa], 0x32
jmp 0x10230dd
mov word [ebp - 0xc], 0x32
mov word [ebp - 0xa], 0x33
jmp 0x10230dd
mov word [ebp - 0xc], 0x32
mov word [ebp - 0xa], 0x34
jmp 0x10230dd
mov word [ebp - 0xc], 0x32
mov word [ebp - 0xa], 0x35
jmp 0x10230dd
mov word [ebp - 0xa], 0x30
jmp 0x1023239
mov word [ebp - 0xc], 0x30
mov word [ebp - 0xa], 0x31
jmp 0x102323f
mov word [ebp - 0xa], 0x31
mov word [ebp - 0xc], 0x31
and cl, 4
or cl, 0xc3
shr cl, 2
movzx ax, cl
jmp 0x10230ee

Function at 0x1023b64
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1023b5f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x1023b9b
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
leave
ret
Function at 0x1024757
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x107342c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 4
mov dword [ebp - 0x90c], eax
pop esi
xor eax, eax
mov ecx, 0x23d
lea edi, [ebp - 0x8f8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x8fc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10125b8
push 0x80000002
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x904], esi
mov dword [ebp - 0x900], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x1024833
cmp dword [ebp - 0x8fc], ebx
je 0x10247f6
lea eax, [ebp - 0x908]
push eax
lea eax, [ebp - 0x900]
push eax
lea eax, [ebp - 0x904]
push eax
push ebx
push 0x101259c
push dword [ebp - 0x8fc]
mov dword [ebp - 0x908], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1024833
jmp dword [0x1072700]
jmp dword [0x1072440]

Function at 0x10249a8
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0x1012620
push 0
mov ebx, 0x100000
push ebx
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x1024b68
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1e
push eax
call esi
test eax, eax
je 0x1024a25
jmp dword [0x10727a0]
push 0x10125fc
push 0
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, eax
test edi, edi
je 0x1024b59
push 0
push edi
call esi
test eax, eax
je 0x1024b4f
jmp dword [0x10725a4]
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp dword [0x107257c]
Function at 0x1024f92
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push edi
xor ebx, ebx
push ebx
add eax, 0x28
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
xor edi, edi
call fcn.010270ab
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1025038
push esi
call fcn.01032293
test eax, eax
je 0x1025024
movzx eax, word [ebp + 0x10]
cmp eax, 0xe
jb 0x1024fd3
xor eax, eax
jmp dword [0x1072678]
push dword [ebp - 0xc]
call fcn.01027188
cmp edi, ebx
je 0x1025038
xor eax, eax
inc eax
jmp 0x1025312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x1025252
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov edi, 0x1076ce0
push edi
mov dword [esi + 8], eax
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword [ebp + 0x10]
cmp eax, dword [0x1076cc8]
jne 0x1025139
jmp dword [0x10724f8]
mov eax, dword [0x1076d04]
mov dword [esi], 0x1076d00
mov dword [esi + 4], eax
mov dword [eax], esi
inc dword [0x1076cf8]
cmp dword [0x1076ccc], ebx
mov dword [0x1076d04], esi
jne 0x102516a
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [0x1076ccc], eax
jmp 0x1025173
push ebx
push ebx
push ebx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov ebx, dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push edi
call ebx
cmp dword [ebp - 4], 0
je 0x1025235
jmp dword [0x10723a8]
cmp dword [ebp - 8], 0
je 0x1025250
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
jmp dword [0x10725f8]
jmp dword [0x1072604]
Function at 0x10271bb
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 8]
push edi
push dword [ebp + 0x18]
add esi, 0x28
mov dword [ebp - 0xc], 0xc
mov eax, dword [esi + 0x10]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
or eax, 4
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x102722c
push edi
push esi
call fcn.010270ab
test eax, eax
je 0x1027218
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x102722a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x1027232
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 8
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
jge 0x1027257
xor eax, eax
jmp 0x10272ba
cmp dword [ebp - 0xc], 1
jne 0x102729d
lea eax, [ebp - 8]
push eax
push 2
push 2
push 0
push 0x2000c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x10272b3
lea eax, [ebp - 4]
push eax
push dword [0x1076c98]
push dword [ebp - 8]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x1027292
and dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10272b7
lea eax, [ebp - 4]
push eax
push dword [0x1076c98]
push dword [ebp + 8]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x10272b7
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x1027812
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x107342c]
push ebx
xor ebx, ebx
cmp byte [0x10749e4], bl
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x1027a48
cmp dword [0x1074a1c], ebx
je 0x1027a48
push ebx
push 4
lea eax, [ebp - 0xa4]
push eax
push 0x46
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1027a48
cmp dword [ebp - 0xa4], ebx
je 0x1027a48
cmp esi, ebx
je 0x1027888
lea eax, [ebp - 0x140]
push eax
push 0x4c
lea eax, [ebp - 0x50]
push eax
push 1
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
jge 0x102788f
xor eax, eax
jmp 0x1027a4b
push edi
push dword [0x1074a1c]
lea eax, [ebp - 0x9c]
push 0x10128f4
push 0x26
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x13c]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xbc]
push eax
push 0x60000
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xbc], 0x18
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call dword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
mov edi, eax
cmp edi, ebx
jl 0x1027a3e
mov eax, dword [0x1076c94]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x134], eax
mov eax, dword [0x1076c90]
mov dword [ebp - 0x128], eax
mov eax, dword [0x1076c98]
mov dword [ebp - 0x11c], eax
mov eax, 0x2000f
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xf8], eax
mov eax, dword [0x1076c88]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe0], eax
mov eax, dword [0x1076c8c]
mov edx, 0x10000000
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x110], ecx
mov ecx, 0xf000f
push 0xa
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x130], 2
mov byte [ebp - 0x12c], bl
mov dword [ebp - 0x124], 3
mov byte [ebp - 0x120], 2
mov byte [ebp - 0x114], bl
mov byte [ebp - 0x108], bl
mov dword [ebp - 0x100], edx
mov byte [ebp - 0xfc], 0xb
mov dword [ebp - 0xf4], ecx
mov byte [ebp - 0xf0], bl
mov dword [ebp - 0xe8], edx
mov byte [ebp - 0xe4], 0xb
mov dword [ebp - 0xdc], ecx
mov byte [ebp - 0xd8], bl
mov dword [ebp - 0xd0], edx
mov byte [ebp - 0xcc], 0xb
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 0xc0], bl
call fcn.01027421
mov esi, eax
cmp esi, ebx
je 0x1027a2d
push esi
push 4
push dword [ebp - 0xa0]
call dword [sym.imp.ntdll.dll_NtSetSecurityObject]
push esi
mov edi, eax
call fcn.01027004
jmp 0x1027a32
mov edi, 0xc0000017
push dword [ebp - 0xa0]
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
cmp edi, ebx
setge al
pop edi
jmp 0x1027a4b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0103e4d8
leave
ret 8
Function at 0x102838a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
cmp dword [0x1074a1c], 0
jne 0x10283ea
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1012a44
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10283ea
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1012a30
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x10283ef
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x57
pop esi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x1012a44
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102843b
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x1012a30
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 4

Function at 0x1028447
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001b
xor esi, esi
push esi
push 0x1012a44
push 0x80000002
mov dword [ebp - 8], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10284c4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, 0x1012a60
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10284bb
cmp dword [ebp - 0x10], 4
jne 0x10284bb
mov eax, dword [ebp - 8]
cmp eax, 2
ja 0x10284bb
mov ecx, dword [ebp + 8]
push esi
push dword [ebp - 4]
mov dword [ecx], eax
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x10284cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1012a44
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028523
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1012a8c
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
je 0x1028545
push 0x10
push 0x5f4
push 0x636
push esi
push dword [ebp + 8]
call fcn.01020161
push dword [ebp + 8]
call fcn.0101ec8c
pop esi
leave
ret 4
Function at 0x102854a
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push 0x1011308
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10285b1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov esi, 0x1012aec
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10285a8
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x10285e1
push 0x1012ad0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10285e1
push 0x1012ab8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10285da
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
leave
ret

Function at 0x102870b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x107342c]
push edi
push 0x47
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x120]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10287c0
cmp byte [ebp - 6], 1
jne 0x10287c0
lea eax, [ebp - 0x124]
push eax
push 0x2001f
xor edi, edi
push edi
push 0x1011308
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10287c0
push esi
push edi
push edi
push edi
push edi
mov esi, 0x1012afc
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10287b3
push 4
lea eax, [ebp - 0x128]
push eax
push 4
push edi
push esi
push dword [ebp - 0x124]
mov dword [ebp - 0x128], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.01028686
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.0103e4d8
leave
ret
Function at 0x10287cb
Capabilities:
Create process on windows
Delete file
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x107342c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1012bb8
push 0x80000002
call ebx
cmp eax, esi
jne 0x102897b
push edi
lea eax, [ebp - 0x430]
push eax
push esi
push esi
push esi
push 0x1012ba8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 0xea
jne 0x102883a
xor edi, edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x102897a
push esi
push dword [ebp - 0x41c]
call fcn.0103bcb6
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x474]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x474], 0x44
mov dword [ebp - 0x448], 0x80
mov dword [ebp - 0x46c], 0x1012b84
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1012b6c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push 0x4000000
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102897a
push dword [ebp - 0x428]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0xffffffffffffffff
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x102891e
push esi
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x42c]
call edi
lea eax, [ebp - 0x418]
push eax
push 0x2001f
push esi
push 0x1011308
push 0x80000002
call ebx
test eax, eax
jne 0x1028960
push 0x1012b38
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x78
push dword [ebp - 0x41c]
call fcn.0103bcb6
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0103e4d8
leave
ret 4
Function at 0x1028a66
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x2001f
push ebx
push 0x1011308
push 0x80000002
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028adb
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x1012ca4
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x1012b38
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
pop edi
cmp dword [ebp - 0x10], ebx
jne 0x1028ae5
cmp dword [ebp - 0xc], ebx
je 0x1028b64
mov eax, dword [0x1074478]
cmp eax, ebx
je 0x1028b09
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x1074478]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1074478], ebx
call fcn.0103dc0f
push 1
call fcn.0103c8f0
cmp dword [ebp - 0xc], ebx
jne 0x1028b5c
push 0x1012c88
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x1028b64
push 0x1012c78
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1028b45
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x10]
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1012ca4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1028b64
push dword [ebp + 8]
call fcn.010287cb
call fcn.0102870b
cmp dword [ebp - 4], ebx
pop esi
pop ebx
je 0x1028b79
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
leave
ret 4