joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463576
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4921d8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0046350b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00446ab0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4635c5
cmp dword [ebp - 0x1c], 5
jb 0x4635dd
jmp 0x4635d9
cmp dword [ebp - 0x10], 1
jne 0x4635dd
cmp dword [ebp - 0x1c], 4
ja 0x4635d9
jne 0x4635dd
cmp dword [ebp - 0x18], 0
jbe 0x4635dd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4798e4
call fcn.004633df
test eax, eax
jge 0x4635fe
mov byte [0x4985fc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00446969
add ebp, 0x78
leave
ret
Function at 0x10006760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067e1f
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x100aa321
call fcn.10066665
cmp byte [0x100a7f48], 0
mov dword [esi], 0
je 0x100067b7
mov ecx, 0x10080298
call fcn.1000e6b0
jmp 0x10006922
lea ecx, [ebp - 0x364]
call fcn.100054e0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x364]
call fcn.1000eb10
test al, al
je 0x10006922
cmp dword [ebp - 0x14c], 0
je 0x100068af
push 0x100802b8
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 4
call fcn.100034a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x364]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006820
sub ecx, edx
lea eax, [ebp - 0x364]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.100076c0
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push 0x10080338
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x1c], 0
jne 0x1000687a
mov ecx, str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
call fcn.1000e6b0
or dword [esi], 1
call fcn.10006b20
test al, al
jne 0x10006890
mov ecx, str.DHCP
call fcn.1000e6b0
or dword [esi], 4
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.100039c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp 0x1000690c
mov ecx, 0x10080410
call fcn.1000e6b0
mov edx, dword [ebp - 0x154]
mov ecx, edx
mov eax, dword [ebp - 0x158]
and ecx, eax
and eax, dword [ebp - 0x15c]
mov dword [ebp - 0x20], 8
cmp eax, ecx
jne 0x100068f3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x15c]
push edx
call dword [sym.imp.IPHLPAPI.DLL_SendARP]
test eax, eax
je 0x100068f6
or dword [esi], 1
call fcn.10006b20
test al, al
jne 0x1000690c
mov ecx, 0x10080428
call fcn.1000e6b0
or dword [esi], 4
call fcn.10006c10
test al, al
jne 0x10006922
mov ecx, 0x10080444
call fcn.1000e6b0
or dword [esi], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4
Function at 0x10006940
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x338
mov eax, dword [0x100a7008]
xor eax, esp
mov dword [esp + 0x334], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, 0x100aa321
call fcn.10066665
mov ebx, dword [ebp + 8]
mov dword [esi], 0
test ebx, ebx
je 0x10006b02
test bl, 2
je 0x10006ad4
push 0x208
lea eax, [esp + 0x134]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.1000f5c0
test al, al
je 0x10006a05
movzx eax, word [0x100805b0]
movq xmm0, qword [str.Tcpip]
mov word [esp + 0x138], ax
mov eax, dword [0x100805b4]
mov dword [esp + 0x13c], eax
movzx eax, word [0x100805b8]
mov word [esp + 0x140], ax
movzx eax, word [0x100805c4]
movq qword [esp + 0x130], xmm0
movq xmm0, qword [str.NetBT]
mov word [esp + 0x14c], ax
mov eax, 0x20
movq qword [esp + 0x144], xmm0
jmp 0x10006a84
lea ecx, [esp + 0x10]
call fcn.1002fa40
test al, al
je 0x10006abb
cmp dword [esp + 0x14], 5
ja 0x10006a2e
jne 0x10006abb
cmp dword [esp + 0x18], 1
jb 0x10006abb
mov eax, dword [0x100805c8]
mov dword [esp + 0x130], eax
movzx eax, word [0x100805cc]
mov word [esp + 0x134], ax
mov eax, dword [0x100805d0]
mov dword [esp + 0x138], eax
movzx eax, word [0x100805d4]
mov word [esp + 0x13c], ax
mov eax, dword [0x100805b4]
mov dword [esp + 0x140], eax
movzx eax, word [0x100805b8]
mov word [esp + 0x144], ax
mov eax, 0x18
push eax
lea eax, [esp + 0x134]
push eax
push 7
push str.DependOnService
push str.SYSTEMCurrentControlSetServicesDhcp
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x10006ab4
mov byte [esp + 0xb], 1
mov ecx, str.Set_DependOnService_success_r_n
jmp 0x10006ac5
mov ecx, str.Set_DependOnService_Failed_r_n
jmp 0x10006ac0
mov ecx, str.IsWindowsXPorLater_return_false
mov byte [esp + 0xb], 0
call fcn.1000e6b0
cmp byte [esp + 0xb], 0
jne 0x10006ad4
or dword [esi], 2
test bl, 4
je 0x10006af1
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call fcn.10006f70
mov eax, dword [esp + 0xc]
or dword [esi], eax
test bl, 1
je 0x10006b02
call fcn.10007150
test al, al
jne 0x10006b02
or dword [esi], 1
mov ecx, dword [esp + 0x33c]
pop esi
pop ebx
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 8
Function at 0x10006b20
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x100a7008]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov ecx, 0x100aa321
call fcn.10066665
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x10006b74
mov ecx, str.::OpenSCManager_Failed_r_n
call fcn.1000e6b0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
push 5
push str.Dhcp
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x10006bad
mov ecx, str.::OpenService_Failed_r_n
call fcn.1000e6b0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xc]
push eax
push 0x24
lea eax, [esp + 0x18]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10006bf2
mov ecx, str.QueryServiceStatusEx_failed_r_n
call fcn.1000e6b0
mov bl, 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [esp + 0x34]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x10006bd0
cmp eax, 4
je 0x10006bd0
xor bl, bl
jmp 0x10006bd2
Function at 0x10006c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x100a7008]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
mov ecx, 0x100aa321
call fcn.10066665
push 0x208
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 7
push 0
push eax
xor bl, bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x208
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push str.DependOnService
push str.SYSTEMCurrentControlSetServicesDhcp
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x10006ca6
mov ecx, str.DOS_error_r_n
call fcn.1000e6b0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
call fcn.1000f5c0
test al, al
je 0x10006d11
lea ecx, [esp + 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006cb6
sub ecx, edx
sar ecx, 1
je 0x10006dac
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0x18]
push str.Tcpip
push eax
xor esi, esi
xor edi, edi
call ebx
add esp, 8
test eax, eax
jne 0x10006cf0
mov edi, 6
lea esi, [eax + 1]
lea eax, [esp + 0x18]
lea eax, [eax + edi*2]
push 0x100805b4
push eax
call ebx
add esp, 8
test eax, eax
jne 0x10006d0a
add edi, 4
inc esi
push str.NetBT
jmp 0x10006d7a
call fcn.1000f6c0
test al, al
je 0x10006dac
lea ecx, [esp + 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006d25
sub ecx, edx
sar ecx, 1
je 0x10006dac
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0x18]
push 0x100805c8
push eax
xor esi, esi
xor edi, edi
call ebx
add esp, 8
test eax, eax
jne 0x10006d5b
mov edi, 4
lea esi, [eax + 1]
lea eax, [esp + 0x18]
lea eax, [eax + edi*2]
push 0x100805d0
push eax
call ebx
add esp, 8
test eax, eax
jne 0x10006d75
add edi, 4
inc esi
push 0x100805b4
lea eax, [esp + 0x1c]
lea eax, [eax + edi*2]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x10006d8c
inc esi
cmp esi, 3
jne 0x10006c85
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x224]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
Function at 0x10006f70
Capabilities:
Check for time delay via gettickcount
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x100a7008]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x100aa321
call fcn.10066665
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x10006fcc
mov ecx, str.::OpenSCManager_Failed_r_n
call fcn.1000e6b0
or dword [edi], 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4
push 0xf01ff
push str.Dhcp
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x1000700d
mov ecx, str.::OpenService_Failed_r_n
call fcn.1000e6b0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or dword [edi], 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4
push str.Dhcp
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x10007068
mov ecx, str.ChangeServiceConfig_failed_r_n
call fcn.1000e6b0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, str.Set_Dhcp_Service_failed__r_n
call fcn.1000e6b0
or dword [edi], 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1000711e
cmp dword [esp + 0x14], 1
jne 0x1000711e
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x10007118
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x10007118
mov ecx, 0x2710
nop word [eax + eax]
mov eax, 0xcccccccd
mul dword [esp + 0x28]
shr edx, 3
cmp edx, 0x3e8
jae 0x100070db
mov edx, 0x3e8
jmp 0x100070e4
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], 4
je 0x1000711e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x28]
ja 0x10007118
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ecx, 0x2710
cmp eax, 1
je 0x100070c0
or dword [edi], 0x10000
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, str.Set_Dhcp_Service_succedss__r_n
call fcn.1000e6b0
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4
Function at 0x10007150
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067e8e
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100aa321
call fcn.10066665
lea ecx, [ebp - 0x36c]
call fcn.100054e0
lea edx, [ebp - 0x374]
mov dword [ebp - 0x374], 0
lea ecx, [ebp - 0x36c]
call fcn.1000eb10
test al, al
je 0x10007394
lea eax, [ebp - 0x36c]
push eax
call fcn.100073b0
push 0x100802b8
lea ecx, [ebp - 0x44]
call fcn.100034a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x36c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100071e0
sub ecx, edx
lea eax, [ebp - 0x36c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.100076c0
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x370]
push ecx
push 0xf003f
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor bl, bl
test eax, eax
jne 0x10007375
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push 0x10080338
push dword [ebp - 0x370]
mov dword [ebp - 0x14], 1
call esi
call fcn.1000f5c0
test al, al
je 0x10007324
push 0
push 0
push 7
push 0
push str.DefaultGateway
push dword [ebp - 0x370]
call esi
push 0
push 0
push 7
push 0
push str.DefaultGatewayMetric
push dword [ebp - 0x370]
call esi
push str.0.0.0.0
lea ecx, [ebp - 0x2c]
call fcn.100034a0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x2c]
add eax, eax
push eax
push ecx
push 7
push 0
push str.IPAddress
push dword [ebp - 0x370]
call esi
push 0
push 0
push 1
push 0
push str.NameServer
push dword [ebp - 0x370]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.IPAutoconfigurationAddress
push dword [ebp - 0x370]
call esi
push str.IPAutoconfigurationMask
push dword [ebp - 0x370]
call esi
push str.IPAutoconfigurationSeed
push dword [ebp - 0x370]
call esi
push str.DefaultGateway
push dword [ebp - 0x370]
call esi
mov bl, 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.100039c0
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
jmp 0x10007369
call fcn.1000f6c0
test al, al
je 0x10007369
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.DefaultGateway
push dword [ebp - 0x370]
call esi
push str.DefaultGatewayMetric
push dword [ebp - 0x370]
call esi
push str.IPAddress
push dword [ebp - 0x370]
call esi
push str.NameServer
push dword [ebp - 0x370]
call esi
mov bl, 1
push dword [ebp - 0x370]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x44]
call fcn.100039c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006413c
mov esp, ebp
pop ebp
ret
Function at 0x100073b0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067f0a
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x100aa321
call fcn.10066665
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.1000fb20
test al, al
jne 0x1000743b
mov ecx, esi
call fcn.1000e6b0
mov ecx, 0x10080860
call fcn.1000e6b0
xor al, al
jmp 0x100075c9
lea ecx, [ebp - 0x418]
call fcn.1000f870
push 0x10080888
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000747a
mov ecx, str.netsh.exe
call fcn.1000e6b0
xor al, al
jmp 0x100075c9
push str.interface_ip_set_address__
lea ecx, [ebp - 0x448]
call fcn.100034a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x430]
push str.interface_ip_set_dns__
call fcn.100034a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100074b0
sub eax, edx
lea ecx, [ebp - 0x448]
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.100076c0
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100074e0
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x430]
call fcn.100076c0
push 6
push str.__dhcp
lea ecx, [ebp - 0x448]
call fcn.100076c0
push 6
push str.__dhcp
lea ecx, [ebp - 0x430]
call fcn.100076c0
cmp dword [ebp - 0x434], 8
lea eax, [ebp - 0x448]
push 0
cmovae eax, dword [ebp - 0x448]
push 0
push eax
lea eax, [ebp - 0x418]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5dc
call esi
cmp dword [ebp - 0x41c], 8
lea eax, [ebp - 0x430]
push 0
cmovae eax, dword [ebp - 0x430]
push 0
push eax
lea eax, [ebp - 0x418]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x5dc
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x430]
call fcn.100039c0
mov byte [ebp - 4], 0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x448]
call fcn.100039c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4
Function at 0x10008070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006813f
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov ecx, 0x100aa321
call fcn.10066665
cmp dword [ebp + 8], 0
mov dword [edi], 0
je 0x100081af
lea ecx, [ebp - 0x35c]
call fcn.100054e0
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x35c]
call fcn.1000eb10
test al, al
je 0x100081a9
push 0x100802b8
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 4
call fcn.100034a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x35c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008117
sub ecx, edx
lea eax, [ebp - 0x35c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.100076c0
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push 0x10080338
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x14], 0
je 0x1000817a
cmp dword [esi + 0x18], 0
jne 0x100081cd
cmp dword [esi + 0x1c], 0
jne 0x100081cd
mov ecx, 0x100809bc
call fcn.1000e6b0
lea eax, [ebp - 0x35c]
push eax
call fcn.10008a50
mov bl, al
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.100039c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne 0x100081af
mov dword [edi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1008099c
call fcn.1000e6b0
lea eax, [ebp - 0x35c]
push eax
call fcn.100088f0
jmp 0x10008186
Function at 0x100087b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100682c4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
mov eax, dword [0x100a7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100aa321
mov dword [ebp - 0x10], 0
call fcn.10066665
push 0x10080a04
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10008811
push str.DnsFlushResolverCache
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000880a
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
push eax
call fcn.10002d10
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x10008830
mov eax, dword [eax]
push 0
push ecx
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.1002e9d0
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [eax + 0x14], 0x10
jb 0x1000884f
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x100088a0
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10008896
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10008896
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1006414d
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x44]
call fcn.100039c0
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
test esi, esi
setne al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100088f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068316
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, 0x100aa321
call fcn.10066665
push 0x10080a04
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10008951
push str.DnsFlushResolverCache
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000894a
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
push edi
call fcn.10008df0
test al, al
jne 0x10008a28
push 0x100802b8
lea ecx, [ebp - 0x2c]
call fcn.100034a0
mov dword [ebp - 4], 0
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008980
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.100076c0
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x30]
push ecx
push 0xf003f
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100089e3
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.100039c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x10008a2a
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 1
push 0
push str.NameServer
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.100039c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006413c
mov esp, ebp
pop ebp
ret 4