joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004bb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
call sym.RtlLib.dll_RT_GetMacAddress
add esp, 4
mov byte [ebp - 0x28], 0x30
mov byte [ebp - 0x27], 0x31
mov byte [ebp - 0x26], 0x32
mov byte [ebp - 0x25], 0x33
mov byte [ebp - 0x24], 0x34
mov byte [ebp - 0x23], 0x35
mov byte [ebp - 0x22], 0x36
mov byte [ebp - 0x21], 0x37
mov byte [ebp - 0x20], 0x38
mov byte [ebp - 0x1f], 0x39
mov byte [ebp - 0x1e], 0x41
mov byte [ebp - 0x1d], 0x42
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x19], 0x46
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
jmp 0x1004bc15
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 6
jge 0x1004bc8b
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x30]
and ecx, 0xf0
sar ecx, 4
mov edx, dword [ebp - 0x34]
mov al, byte [ebp + ecx - 0x28]
mov byte [ebp + edx - 0x18], al
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x38]
movsx eax, byte [ebp + edx - 0x30]
and eax, 0xf
mov ecx, dword [ebp - 0x34]
mov dl, byte [ebp + eax - 0x28]
mov byte [ebp + ecx - 0x18], dl
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x38], 5
je 0x1004bc78
mov ecx, dword [ebp - 0x34]
mov byte [ebp + ecx - 0x18], 0x3a
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
jmp 0x1004bc89
mov eax, dword [ebp - 0x34]
mov byte [ebp + eax - 0x18], 0
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
jmp 0x1004bc0c
push 0x14
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10013640
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret

Function at 0x1004bd20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x10078324
push str.Run1X
call fcn.10003d10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004bd4f
push 0
push 0
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x100a5348], 0
je 0x1004bd67
mov dword [0x100a5348], 0
call sub.RtlIhvOid.dll_Ordinal_3
push 0
call fcn.100647f0
add esp, 4
mov byte [0x100a5346], 0
movzx edx, byte [0x1008af93]
test edx, edx
je 0x1004bd8e
push str.__LIB_UnRegister_OK_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret

Function at 0x1004c660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x1005d0a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1004cd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 1
push 4
lea eax, [ebp - 0x28]
push eax
push 0xff010902
push 1
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.10001af0
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0xc]
push edx
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x10]
push ecx
movzx edx, word [ebp - 0x12]
push edx
push str._d:_d:_d:_d
lea eax, [ebp - 0x30]
push eax
call fcn.100025d0
add esp, 0x18
lea ecx, [ebp - 4]
call fcn.10001af0
push str.RtlS5Wake
push str.SoftwareRtWLan
push 0x1007a448
lea ecx, [ebp - 4]
push ecx
call fcn.100025d0
add esp, 0x10
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
call fcn.10001ae0
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x1004ce52
lea ecx, [ebp - 0x30]
call fcn.10001330
push eax
push 0
lea ecx, [ebp - 0x30]
call fcn.100015a0
push eax
push 1
push 0
push str.WOWL
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.10001850
lea ecx, [ebp - 0x30]
call fcn.10001850
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x1004d1c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006931b
mov eax, dword fs:[0]
push eax
mov eax, 0x10030
call fcn.1001a2d0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10034], 0
lea ecx, [ebp - 0x10038]
call fcn.10001af0
mov dword [ebp - 4], 0
mov byte [0x100a5368], 0
push 0
push 0
call sub.RtlIhvOid.dll_Ordinal_10
add esp, 8
mov dword [ebp - 0x10034], eax
push 0xffff
lea eax, [ebp - 0x1002c]
push eax
push 0xff0101b0
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1004d26c
mov byte [ebp - 0x10039], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10038]
call fcn.10001850
mov al, byte [ebp - 0x10039]
jmp 0x1004d3c6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10030], 0x64
mov dword [ebp - 0x24], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10030]
sub ecx, 1
mov dword [ebp - 0x10030], ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100139b0
add esp, 0xc
push 4
lea eax, [ebp - 0x20]
push eax
push 0xff0101bd
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
and ecx, 0xff
cmp ecx, 0xaa
je 0x1004d2fe
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x28], 0
jmp 0x1004d313
cmp dword [ebp - 0x28], 0
je 0x1004d30d
mov edx, dword [ebp - 0x20]
shr edx, 8
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
movzx ecx, byte [0x1008af93]
test ecx, ecx
je 0x1004d348
mov edx, dword [ebp - 0x24]
push edx
push 0x100780b4
lea eax, [ebp - 0x10038]
push eax
call fcn.100025d0
add esp, 0xc
lea ecx, [ebp - 0x10038]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x24], 1
jne 0x1004d361
cmp dword [ebp - 0x28], 0
je 0x1004d361
cmp dword [ebp - 0x10030], 0
jne 0x1004d29a
cmp dword [ebp - 0x24], 1
je 0x1004d386
mov byte [0x100a5368], 1
movzx ecx, byte [0x1008af93]
test ecx, ecx
je 0x1004d384
push 0x100780e4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1004d3a3
mov byte [0x100a5368], 0
movzx edx, byte [0x1008af93]
test edx, edx
je 0x1004d3a3
push 0x10078100
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x100a5368]
mov byte [ebp - 0x1003a], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10038]
call fcn.10001850
mov al, byte [ebp - 0x1003a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x1004d3e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 4
push 0x1007808c
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x40], 3
lea edx, [ebp - 0x40]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], 0x1e
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x58]
sub eax, 1
mov dword [ebp - 0x58], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.100139b0
add esp, 0xc
push 4
lea edx, [ebp - 0x50]
push edx
push 0xff0101bd
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x1004d4a9
mov eax, dword [ebp - 0x50]
shr eax, 8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jne 0x1004d4bb
cmp dword [ebp - 0x54], 0
je 0x1004d4bb
cmp dword [ebp - 0x58], 0
jne 0x1004d45e
lea ecx, [ebp - 0x18]
push ecx
call sub.RtlIhvOid.dll_Ordinal_18
add esp, 4
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x44]
call fcn.10001af0
mov edx, dword [ebp - 0x5c]
push edx
push str._nIHV_Connect__Return_Code_0X_X__n
lea eax, [ebp - 0x44]
push eax
call fcn.100025d0
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.10001850
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10050110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x2584
call fcn.100165a5
add esp, 4
mov dword [0x1008b454], eax
push 0x2584
push 0
mov eax, dword [0x1008b454]
push eax
call fcn.100139b0
add esp, 0xc
push 0xb8f4
call fcn.100165a5
add esp, 4
mov dword [ebp - 4], eax
push 0xb8f4
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.100139b0
add esp, 0xc
mov edx, dword [0x1008b454]
mov eax, dword [ebp - 4]
mov dword [edx + 0xacc], eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [0x1008b454]
push edx
push 0x1003dab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x10055ab0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 8], eax
push 0xb8f4
call fcn.100165a5
add esp, 4
mov dword [ebp - 0x13c], eax
push 0xb8f4
push 0
mov eax, dword [ebp - 0x13c]
push eax
call fcn.100139b0
add esp, 0xc
push 0x12c
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.100139b0
add esp, 0xc
cmp dword [0x100a5350], 2
je 0x10055b1d
cmp dword [0x100a5350], 9
je 0x10055b1d
cmp dword [0x100a5350], 0xa
jne 0x10055b2e
mov edx, dword [ebp - 0x13c]
push edx
call fcn.1002d520
add esp, 4
jmp 0x10055b49
push 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x13c]
add ecx, 0x3814
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x13c]
mov byte [edx + 0x407c], 1
push 0x1008b758
call fcn.100533b0
add esp, 4
mov dword [0x100a5340], eax
mov eax, dword [ebp - 0x13c]
push eax
call fcn.10033290
add esp, 4
cmp dword [0x100a5350], 8
jge 0x10055bef
mov ecx, dword [ebp - 0x13c]
add ecx, 0x407e
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call fcn.100306c0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x13c]
mov cl, byte [ebp - 4]
mov byte [eax + 0x407d], cl
mov edx, dword [ebp - 4]
add edx, 2
push edx
mov eax, dword [ebp - 0x13c]
add eax, 0x407c
push eax
lea ecx, [ebp - 0x138]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, 2
push edx
lea eax, [ebp - 0x138]
push eax
push 0xff0101d0
push 1
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
jmp 0x10055c5e
push 1
mov ecx, dword [ebp - 0x13c]
add ecx, 0x407e
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call fcn.10030190
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x13c]
mov cl, byte [ebp - 4]
mov byte [eax + 0x407d], cl
mov edx, dword [ebp - 4]
add edx, 2
push edx
mov eax, dword [ebp - 0x13c]
add eax, 0x407c
push eax
lea ecx, [ebp - 0x138]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, 2
push edx
lea eax, [ebp - 0x138]
push eax
push 0xff0101d0
push 1
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov ecx, dword [ebp - 0x13c]
mov edx, dword [0x1008b324]
mov dword [ecx + 0x4078], edx
mov eax, dword [ebp - 0x13c]
mov byte [eax + 0x417e], 0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x100a5350], 8
je 0x10055c97
cmp dword [0x100a5350], 9
jne 0x10055cbe
lea ecx, [ebp - 0x144]
push ecx
push 0
mov edx, dword [ebp - 0x13c]
push edx
push 0x10031930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x140], eax
jmp 0x10055ce3
lea eax, [ebp - 0x144]
push eax
push 0
mov ecx, dword [ebp - 0x13c]
push ecx
push 0x10031ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x140], eax
cmp dword [0x100a5350], 2
je 0x10055d07
cmp dword [0x100a5350], 8
je 0x10055d07
cmp dword [0x100a5350], 9
je 0x10055d07
cmp dword [0x100a5350], 0xa
jne 0x10055d1c
push 0
push 0
push 0
push 0x1002b500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x1005bf50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], ecx
lea eax, [ebp - 0x2ac]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jne 0x1005c14b
push 0x1006faef
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1006faf9
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Device_
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.DeviceSjyPkt_
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x2a4], 0
jne 0x1005c13e
mov dword [ebp - 0x118], 0x80
lea edx, [ebp - 0x114]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x1005c035
xor eax, eax
jmp 0x1005c150
cmp dword [ebp - 0x2a4], 0
jne 0x1005c13e
lea ecx, [ebp - 0x2a8]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jne 0x1005c13e
mov dword [ebp - 0x21c], 0xff
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push str.ServiceName
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jne 0x1005c131
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x2a0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x2b0], 0
jmp 0x1005c0f9
mov eax, dword [ebp - 0x2b0]
add eax, 1
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp - 0x2b0]
cmp ecx, dword [ebp - 0x21c]
jae 0x1005c120
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2b0]
mov cl, byte [ebp + eax - 0x218]
mov byte [ebp + edx - 0x79], cl
jmp 0x1005c0ea
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2ac]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005c490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp + 0x1fc]
push ecx
push 0x1007b174
push 0x1007b194
lea edx, [ebp - 0x210]
push edx
call fcn.10016875
add esp, 0x10
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0xf003f
push 0
push 0x1006fb29
push 0
lea ecx, [ebp - 0x210]
push ecx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x214], eax
push 0x100
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.100139b0
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.100139b0
add esp, 0xc
push str.ShellRealtek_File_EzSharingCommand
lea ecx, [ebp + 0x1fc]
push ecx
push 0x1007b1c4
push 0x1007b1e4
lea edx, [ebp - 0x210]
push edx
call fcn.10016875
add esp, 0x14
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0x1006fb2a
push 0
lea ecx, [ebp - 0x210]
push ecx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x214], eax
lea edx, [ebp + 0xd0]
push edx
push str.explorer__
push 0x1007b1f8
lea eax, [ebp - 0x108]
push eax
call fcn.10016875
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x108]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x100
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x100
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.100139b0
add esp, 0xc
push str.ShellRealtek_Media_EzSharingCommand
lea eax, [ebp + 0x1fc]
push eax
push str.DeviceDisplayObjectHardwareId_
push str._s_s_s
lea ecx, [ebp - 0x210]
push ecx
call fcn.10016875
add esp, 0x14
push 0
lea edx, [ebp - 0x110]
push edx
push 0
push 0xf003f
push 0
push 0x1006fb2b
push 0
lea eax, [ebp - 0x210]
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x214], eax
push str.wmplayer.exe
push 0x1007b260
lea ecx, [ebp - 0x108]
push ecx
call fcn.10016875
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x214], 0
je 0x1005c6a0
jmp 0x1005c6c4
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x1005c8c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
je 0x1005c90d
mov ecx, dword [ebp - 0x1a4]
push ecx
push str.WSAStartup_failed:__d_n
call fcn.1001513b
add esp, 8
jmp 0x1005c9ea
lea edx, [ebp - 0x1a0]
push edx
push str.http:__
mov eax, dword [ebp + 0xc]
push eax
call fcn.10016c38
add esp, 0xc
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1ac]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffff
jne 0x1005c956
push str.The_IPv4_address_entered_must_be_a_legal_address_n
call fcn.1001513b
add esp, 4
jmp 0x1005c96d
push 2
push 4
lea edx, [ebp - 0x1b0]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x1005c9d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
je 0x1005c9d5
cmp dword [ebp - 0x1a8], 0x2af9
jne 0x1005c9a6
push str.Host_not_found_n
call fcn.1001513b
add esp, 4
jmp 0x1005c9d5
cmp dword [ebp - 0x1a8], 0x2afc
jne 0x1005c9c1
push str.No_data_record_found_n
call fcn.1001513b
add esp, 4
jmp 0x1005c9d5
mov eax, dword [ebp - 0x1a8]
push eax
push str.Function_failed_with_error:__ld_n
call fcn.1001513b
add esp, 8
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10016b40
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x1005d2a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xdc], ecx
mov eax, dword [ebp - 0xdc]
cmp dword [eax], 3
jne 0x1005d318
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xdc]
add edx, 4
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp + 8]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
mov edx, dword [ebp - 0xdc]
add edx, 0x198
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1005d40a
lea edx, [ebp - 4]
push edx
push str.SYSTEMCurrentControlSetControlClass_
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1005d40a
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xdc]
add edx, 4
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 8], 0xffffffff
je 0x1005d38f
mov ecx, dword [ebp + 8]
push ecx
call fcn.10013a30
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
push 1
push 0
mov eax, dword [ebp - 0xdc]
add eax, 0x198
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xdc]
add eax, 0x198
push eax
mov ecx, dword [ebp - 0xdc]
add ecx, 4
push ecx
push str._sNdiParams_s
lea edx, [ebp - 0xd8]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 8], 0xffffffff
je 0x1005d400
mov eax, dword [ebp + 8]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret 4