joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10546f9
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [ebp - 0x40], esi
mov ebx, 0x8007000e
mov dword [ebp - 0x30], edi
call fcn.01054439
cmp eax, edi
mov dword [ebp - 0x48], eax
je 0x105473c
push esi
push 0x1008d48
push eax
call fcn.0105b47d
mov dword [ebp - 0x34], eax
jmp 0x105473f
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], edi
je 0x1054855
xor ebx, ebx
cmp dword [ebp + 0xc], edi
je 0x105482c
lea eax, [ebp - 0x38]
push eax
xor esi, esi
inc esi
push esi
push edi
push dword [ebp - 0x34]
mov dword [ebp - 0x38], edi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105482c
push 0x28
pop ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x1008d40
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x44], ebx
call esi
test eax, eax
jne 0x10547c9
cmp dword [ebp - 0x3c], 1
jne 0x10547c9
lea eax, [ebp - 0x2c]
push 0x1007490
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10547c9
push edi
push edi
push dword [ebp - 0x40]
call fcn.0105aed9
cmp eax, edi
jge 0x10547c9
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x1008d30
push dword [ebp - 0x38]
mov dword [ebp - 0x44], ebx
call esi
test eax, eax
jne 0x1054812
cmp dword [ebp - 0x3c], 1
jne 0x1054812
lea eax, [ebp - 0x2c]
push 0x1007490
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1054812
push edi
push dword [ebp - 0x40]
call fcn.0105b22b
cmp eax, edi
jge 0x1054812
mov dword [ebp - 0x30], eax
push 1
push edi
push edi
push 1
push edi
push dword [ebp - 0x40]
call fcn.0105c64d
push dword [ebp - 0x38]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x34]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x34]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
cmp ebx, edi
pop ecx
jge 0x1054858
cmp dword [ebp - 0x30], 0xd2af9
mov dword [ebp - 0x30], 0xc00d2afb
je 0x1054858
mov dword [ebp - 0x30], ebx
cmp ebx, 0xd2af9
jne 0x1054876
xor eax, eax
cmp dword [ebp - 0x30], edi
setl al
dec eax
and eax, 0x3ffffffe
add eax, 0xc00d2afb
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 8
Function at 0x1055afa
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0x1009698
push 4
mov dword [ebp - 4], 1
call fcn.0105e5ad
mov eax, dword [ebp + 8]
xor esi, esi
add esp, 0xc
cmp eax, esi
je 0x1055b2f
cmp word [eax], si
jne 0x1055b2f
xor eax, eax
push 0xf003f
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
jne 0x1055b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x1055b52
push 0x57
pop eax
push eax
push edi
push 0x1009664
push 2
call fcn.0105e5ad
add esp, 0x10
xor eax, eax
jmp 0x1055cd3
push 0xf01ff
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x1055ba5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x1055b8b
push 0x57
pop eax
push eax
push edi
push 0x100962c
push 2
call fcn.0105e5ad
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1055b63
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1055bef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, esi
jne 0x1055bc1
push 0x57
pop edi
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0xc]
call esi
cmp edi, 0x420
jne 0x1055be1
xor eax, eax
inc eax
jmp 0x1055cd3
push edi
push dword [ebp + 0xc]
push 0x10095f4
jmp 0x1055b59
cmp dword [ebp + 0x10], esi
je 0x1055c9d
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp + 0x10], 0x927c0
call ebx
test eax, eax
jne 0x1055c2a
push edi
push 0x10095d0
push 2
call fcn.0105e5ad
add esp, 0xc
mov dword [ebp - 4], esi
jmp 0x1055c9d
cmp dword [ebp - 0x28], 4
je 0x1055c9d
mov edi, 0x1f4
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add esi, 0x7530
cmp esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jle 0x1055c6d
mov dword [ebp + 0x10], esi
jmp 0x1055c6d
cmp dword [ebp - 0x28], 4
je 0x1055c71
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
je 0x1055cda
sub esi, edi
add dword [ebp - 8], edi
test esi, esi
jg 0x1055c4e
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 8], eax
jg 0x1055c87
cmp dword [ebp - 0x28], 4
je 0x1055c9d
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jne 0x1055c35
push dword [ebp + 0xc]
push 0x10095b8
push 2
call fcn.0105e5ad
add esp, 0xc
and dword [ebp - 4], 0
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 4], 0
mov eax, 0x1009538
jne 0x1055cbd
mov eax, 0x1009528
push eax
push dword [ebp + 0xc]
push 0x100959c
push 4
call fcn.0105e5ad
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 0xc]
push 0x1009578
jmp 0x1055c8f
Function at 0x1055ce9
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], 1
je 0x1055dc7
cmp dword [ebp + 0x10], edi
je 0x1055dc7
cmp dword [ebp + 0x14], edi
je 0x1055dc7
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1055d24
cmp word [eax], di
jne 0x1055d24
xor eax, eax
mov esi, 0xf003f
push esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
je 0x1055da2
push edi
push 0x100970c
push dword [ebp + 0x18]
push edi
push edi
push dword [ebp + 0x14]
push 1
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, edi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x1055d7a
push eax
call esi
push 0x1009538
push dword [ebp + 0xc]
push 0x10096f0
push 4
jmp 0x1055d95
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x1055d8a
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x10096b8
push 2
call fcn.0105e5ad
add esp, 0x10
push ebx
call esi
jmp 0x1055dca
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x1055db2
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x1009664
push 2
call fcn.0105e5ad
add esp, 0x10
jmp 0x1055dca
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x1055dd9
Capabilities:
Delete service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov dword [ebp - 4], 1
jne 0x1055df7
mov dword [ebp - 4], ebx
jmp 0x1055ee0
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x1055e06
cmp word [edi], bx
jne 0x1055e06
xor edi, edi
push dword [ebp + 0xc]
push ebx
call fcn.010558f3
test eax, eax
je 0x1055ebc
mov esi, 0xf003f
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1055ea1
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x1055e88
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1055e71
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1055e5e
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100978c
push 2
call fcn.0105e5ad
add esp, 0x10
push dword [ebp + 0xc]
push 0x1009764
push 4
call fcn.0105e5ad
add esp, 0xc
push edi
call esi
jmp 0x1055e9a
push dword [ebp + 0xc]
push 0x1009740
push 4
call fcn.0105e5ad
add esp, 0xc
push dword [ebp + 8]
call esi
jmp 0x1055edf
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1055eb1
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x1009664
jmp 0x1055ed5
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1055ecc
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100978c
push 2
call fcn.0105e5ad
add esp, 0x10
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x10560d5
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push 0x100984c
push 4
mov dword [ebp - 4], 1
mov dword [ebp - 8], ebx
call fcn.0105e5ad
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, ebx
je 0x1056119
push 0x100954c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1056119
xor esi, esi
push 0xf003f
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1056143
push 0xf01ff
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x105614e
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
jmp 0x10561d7
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1056143
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 2
push 0x40
mov dword [eax], ecx
call edi
mov esi, eax
cmp esi, ebx
je 0x10561e2
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 0xc]
push eax
push 1
push esi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x10561d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10561d7
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x10561e2
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0xc]
push esi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x10561c2
and dword [ebp - 4], eax
jmp 0x10561d7
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x14]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x10561d7
xor esi, esi
test esi, esi
je 0x10561e2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10561f4
push dword [ebp + 8]
call esi
cmp dword [ebp - 8], edi
je 0x10561fe
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], edi
pop edi
pop esi
pop ebx
mov eax, 0x1009538
jne 0x1056210
mov eax, 0x1009528
push eax
push dword [ebp + 0xc]
push 0x1009830
push 4
call fcn.0105e5ad
mov eax, dword [ebp - 4]
add esp, 0x10
leave
ret 0x10

Function at 0x1056f16
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1056f38
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1056f38
test al, 0x10
jne 0x1056f38
xor eax, eax
inc eax
jmp 0x1056f3a
xor eax, eax
pop ebp
ret 4

Function at 0x1056f43
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1056f65
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1056f65
test al, 0x10
jne 0x1056f65
xor eax, eax
inc eax
jmp 0x1056f67
xor eax, eax
pop ebp
ret 4
Function at 0x1056f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x1056fa9
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1056fa9
push dword [ebp + 8]
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1056f99
push 2
pop eax
jmp 0x1056fae
test ax, 0x800
je 0x1056fa5
mov dword [esi], 1
xor eax, eax
jmp 0x1056fae
mov eax, 0xa0
pop esi
pop ebp
ret 8

Function at 0x1056fbb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x198]
xor ebx, ebx
push eax
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x1a4], 0x80
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x198], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x105700f
xor edx, edx
jmp 0x1057134
push esi
mov esi, dword [ebp - 0x194]
xor eax, eax
shld eax, esi, 0x10
mov eax, dword [ebp - 0x190]
shl esi, 0x10
or esi, eax
cmp dword [ebp - 0x188], 2
lea eax, [ebp - 0x19c]
push eax
push 1
mov dword [ebp - 0x1ac], ebx
push ebx
jne 0x10570b9
push 0x1009ab8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105712b
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push 0x1009a8c
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105711f
cmp dword [ebp - 0x1a0], 1
jne 0x105711f
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov ecx, 0x10000
mov dword [ebp - 0x1a4], eax
mul ecx
add dword [ebp - 0x1ac], eax
adc esi, edx
jmp 0x105711f
push 0x1009a38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105712b
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ebx
push 0x1009a1c
push dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105711f
cmp dword [ebp - 0x1a0], 1
jne 0x105711f
lea eax, [ebp - 0x84]
push eax
call fcn.01056c56
mov dword [ebp - 0x1ac], eax
mov esi, edx
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1ac]
mov edx, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret
Function at 0x105733e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1009b14
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10573ac
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x1003e1c
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10573a2
cmp dword [ebp - 8], esi
jne 0x10573a2
cmp dword [ebp - 0xc], 1
jne 0x10573a2
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
leave
ret

Function at 0x105749a
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x10], 0xffffffff
push ebx
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push 0x20008
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1057595
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call edi
push dword [ebp - 0x14]
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
je 0x1057585
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x105757e
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x105757e
cmp dword [esi], ebx
mov dword [ebp - 0x18], ebx
jbe 0x1057575
lea edi, [esi + 4]
push dword [edi]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x105756e
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add edi, 8
cmp eax, dword [esi]
jb 0x1057550
jmp 0x1057575
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
je 0x1057595
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret
Function at 0x10575aa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push 0x1009b6c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10575f3
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push 0x1009b50
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x1057708
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x105777d
push esi
lea eax, [ebp - 0x10]
push eax
push 0x1009c00
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x105776e
push 0x80040002
push 1
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
cmp dword [ebp - 4], esi
pop esi
je 0x105777d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x1057784
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1009c40
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10577f2
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x1009c28
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10577e8
cmp dword [ebp - 8], esi
jne 0x10577e8
cmp dword [ebp - 0xc], 1
jne 0x10577e8
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
leave
ret
Function at 0x1057b5d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1009d00
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1057bca
cmp dword [ebp + 0xc], esi
push edi
mov edi, 0x10040f0
jne 0x1057b98
mov edi, 0x1009cf8
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1057b9d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 8

Function at 0x1057d79
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1009de0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1057dd0
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x1009db0
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1057de0
push esi
push 0x1009d68
push 2
call fcn.0105e5ad
add esp, 0xc
pop esi
leave
ret

Function at 0x1057de8
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ebx, ebx
call edi
test eax, eax
jne 0x1057e53
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x1057e10
push 0x57
pop eax
cmp eax, 5
mov ebx, eax
jne 0x1057e52
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1057e52
test al, 1
je 0x1057e52
and eax, 0xfffffffe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1057e52
push dword [ebp + 8]
call edi
test eax, eax
je 0x1057e47
xor ebx, ebx
jmp 0x1057e52
call esi
test eax, eax
jne 0x1057e50
push 0x57
pop eax
mov ebx, eax
pop esi
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x1058684
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1058777
push esi
lea eax, [ebp - 0x210]
push eax
push 0x2001f
xor esi, esi
push esi
push ebx
push edi
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1058776
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
mov ebx, 0x103
jmp 0x1058754
cmp eax, esi
jne 0x1058758
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.01058684
test eax, eax
jne 0x1058758
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call edi
cmp eax, ebx
jne 0x1058715
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 8

Function at 0x105878c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
jne 0x10587a2
push 6
pop eax
jmp 0x10587e8
cmp dword [ebp + 8], esi
jne 0x10587d0
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10587d0
cmp dword [ebp + 0x10], esi
jne 0x10587c9
cmp dword [ebp - 4], 2
jbe 0x10587d0
mov eax, 0xb7
jmp 0x10587e8
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
leave
ret 0x1c