joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007814
Capabilities:
Get file size

Disassembly:
push 0x30
mov eax, 0x10049061
call fcn.1001949d
mov eax, dword [ebp + 8]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push accept
mov dword [ebp - 0x38], eax
mov ebx, esi
mov eax, dword [ebp + 0xc]
push 0x1006ca08
mov dword [ebp - 0x2c], eax
call dword [0x100702fc]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x10007934
push esi
push esi
push esi
push 2
push esi
push eax
call dword [0x1007030c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10007926
push esi
push esi
push esi
push 4
push ebx
call dword [0x100702f4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10007926
mov edi, dword [eax + 0x3c]
add edi, eax
push 0
push dword [ebp - 0x30]
movzx ecx, word [edi + 6]
dec ecx
imul esi, ecx, 0x28
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, dword [esi + edi + 0x10c]
mov ecx, dword [ebp - 0x2c]
sub eax, dword [esi + edi + 0x108]
push eax
mov dword [ecx], eax
call fcn.100193db
mov ecx, dword [esi + edi + 0x10c]
mov edx, eax
mov eax, dword [ebp - 0x2c]
add ecx, dword [esi + edi + 0x108]
mov esi, dword [ebp - 0x34]
add ecx, esi
mov dword [ebp - 0x3c], edx
push dword [eax]
push ecx
push edx
call fcn.10019900
lea eax, [ebp - 0x28]
push str.YTNSYAssYnBVOkJs0ZjjXBRHlTeSOBVmT7sOADHmT7vYARurr
push eax
call fcn.1000e301
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x100078f8
mov eax, dword [eax]
mov edi, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x2c]
push dword [eax]
push edi
call fcn.10017155
add esp, 0xc
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10013419
mov eax, dword [ebp - 0x38]
push esi
mov dword [eax], edi
call dword [0x10070308]
push dword [ebp - 0x30]
call dword [0x10070304]
cmp ebx, 0xffffffff
je 0x1000793b
push ebx
call dword [0x10070304]
call fcn.1001945b
ret

Function at 0x10007a8c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10007af7
cmp dword [ebp + 0x14], 0
je 0x10007af7
cmp dword [ebp + 0x18], 0
je 0x10007af7
mov esi, dword [ebp + 8]
test esi, esi
je 0x10007af7
cmp dword [esi], 0xffffffff
je 0x10007af7
mov ebx, dword [ebp + 0x10]
lea eax, [esi + 4]
push 0x10
push eax
push 0
push ebx
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x10007adb
sub ebx, eax
add edi, eax
lea eax, [esi + 4]
test ebx, ebx
jg 0x10007ab7
xor eax, eax
inc eax
jmp 0x10007af9
cmp dword [0x1006d34c], 9
jl 0x10007af7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.error_sending_to_server._WSA_ERROR:__d
call fcn.100024d3
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10007b74
Capabilities:
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1006d34c], 9
jl 0x10007b8b
push str.ConnectToServer
call fcn.100024d3
pop ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [ebx + 0x14]
test esi, esi
je 0x10007c68
cmp dword [ebp + 0x10], 0
je 0x10007c68
cmp dword [ebp + 0x14], 0
je 0x10007c68
mov cl, byte [esi]
test cl, cl
je 0x10007c68
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x214], eax
movsx eax, cl
push eax
call fcn.1001b1bd
pop ecx
push 2
pop edx
push esi
test eax, eax
je 0x10007bed
xor eax, eax
lea edi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebx + 4], dx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebx + 8], eax
jmp 0x10007c2e
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x10007c04
push esi
push str.Error:_gethostbyname_failed:__s.
jmp 0x10007c58
xor eax, eax
lea edi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
lea eax, [ebx + 8]
push eax
call fcn.10019900
mov eax, dword [ebp + 8]
add esp, 0xc
mov ax, word [eax + 8]
mov word [ebx + 4], ax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 2
push 2
mov word [ebx + 6], ax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10007c6b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_failed_to_create_datagram_socket:__d_n
push 0xffffffffffffffff
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1001a28e
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10008335
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000843e
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x1000836b
push 0xffffffffffffffff
push str.localhost.unknown
push dword [ebp + 0xc]
push esi
call fcn.1001b6b8
add esp, 0x10
jmp 0x1000843e
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x1000843d
cmp dword [edi + 4], 0
je 0x100083eb
mov eax, dword [edi + 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x100083eb
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008394
sub ecx, edx
mov edx, esi
lea eax, [edx + 1]
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100083a5
sub edx, dword [ebp + 8]
cmp ecx, edx
jbe 0x100083e5
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100083b8
sub ecx, edx
push ecx
push dword [ebp - 4]
push esi
call fcn.1001b640
add esp, 0xc
test eax, eax
jne 0x100083e5
mov eax, dword [edi + 4]
push 0xffffffffffffffff
push dword [eax]
push dword [ebp + 0xc]
push esi
call fcn.1001b6b8
add esp, 0x10
add dword [edi + 4], 4
jne 0x10008383
mov ecx, dword [edi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100083f0
sub ecx, edx
mov edx, esi
lea eax, [edx + 1]
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10008401
sub edx, dword [ebp + 8]
cmp ecx, edx
jbe 0x1000843d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008414
sub ecx, edx
push ecx
push dword [edi]
push esi
call fcn.1001b640
add esp, 0xc
test eax, eax
jne 0x1000843d
push 0xffffffffffffffff
push dword [edi]
push dword [ebp + 0xc]
push esi
call fcn.1001b6b8
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10008f78
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1006a098]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1006d34c], 5
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
jl 0x10008fa2
push str.InitWebServer:_configuring_listening_port
call fcn.100024d3
pop ecx
xor ebx, ebx
mov edi, str.Remote
push ebx
push str.AccessKey
push edi
call fcn.10015721
add esp, 0xc
test eax, eax
je 0x1000902a
push 1
push str.AllowBasicAuth
push edi
call fcn.10015721
mov edi, pe_nt_image_headers32
mov dword [0x1006a080], eax
push edi
push 0x100701f0
push str.AccessKeySet
push str.Remote
call fcn.100127f1
push edi
push 0x1006fe10
push str.AccessKeySetSnare1
push str.Remote
call fcn.100127f1
push edi
push 0x1006ff10
push str.AccessKeySetSnare2
push str.Remote
call fcn.100127f1
push edi
push 0x10070010
push str.AccessKeySetSnare3
push str.Remote
call fcn.100127f1
add esp, 0x4c
mov dword [0x10070124], ebx
test esi, esi
je 0x1000907f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009039
sub ecx, edx
je 0x1000907f
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0xffffffffffffffff
test eax, eax
je 0x10009061
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
jmp 0x10009062
push esi
imul eax, dword [0x10070124], 0x11
push 0x11
add eax, 0x10070110
push eax
call fcn.1001b6b8
add esp, 0x10
inc dword [0x10070124]
push 2
pop esi
push dword [ebp + 8]
mov word [ebp - 0x14], si
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WS2_32.dll_htons]
push ebx
push 1
push esi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1006a078], eax
cmp eax, 0xffffffff
jne 0x100090c6
cmp dword [0x1006d34c], 5
jl 0x100090be
push str.bind___failed:_INVALID_SOCKET
call fcn.100024d3
pop ecx
or eax, 0xffffffff
jmp 0x10009191
push 1
lea ecx, [ebp - 0x15]
mov byte [ebp - 0x15], bl
push ecx
push 0xffffff7f
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x100090f8
cmp dword [0x1006d34c], 5
jl 0x100090f8
push str.setsockopt_DONTLINGER__failed:_SOCKET_ERROR
call fcn.100024d3
pop ecx
mov esi, dword [sym.imp.WS2_32.dll_bind]
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x1006a078]
call esi
cmp eax, 0xffffffff
jne 0x1000914d
cmp dword [0x1006d34c], 5
jl 0x10009125
push str.bind___failed:_SOCKET_ERROR
call fcn.100024d3
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009133
cmp ebx, 4
je 0x10009177
inc ebx
push 0x3e8
call edi
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [0x1006a078]
call esi
cmp eax, 0xffffffff
je 0x1000912d
push 5
push dword [0x1006a078]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x1000918e
cmp dword [0x1006d34c], 5
jl 0x100090be
push str.listen___failed:_SOCKET_ERROR
jmp 0x100090b8
cmp dword [0x1006d34c], 5
jl 0x100090be
push str.bind___failed__unable_to_initialise_web_server
jmp 0x100090b8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001890f
mov esp, ebp
pop ebp
ret
Function at 0x100092c3
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [0x1006d34c], 5
push esi
mov eax, ebx
mov dword [ebp - 8], ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
jl 0x100092ef
push str.GetUserSid
call fcn.100024d3
pop ecx
mov eax, ebx
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 8], ebx
je 0x1000941c
test esi, esi
je 0x1000941c
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], ebx
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x1000933a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000941c
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000941c
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10009419
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x1000940f
cmp dword [ebp + 0x14], 0
je 0x100093dc
cmp dword [ebp + 0x18], 0
je 0x100093dc
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100093b8
test dl, dl
je 0x100093b4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100093b8
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009398
xor eax, eax
jmp 0x100093bd
sbb eax, eax
or eax, 1
test eax, eax
je 0x100093dc
cmp dword [ebp - 0xc], 0
jne 0x100093dc
push ebx
call edi
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0xc], eax
jmp 0x10009309
push dword [ebp + 0x10]
push esi
push ebx
call fcn.1000646d
add esp, 0xc
test eax, eax
jne 0x10009402
mov eax, dword [ebp + 0x10]
push 0xffffffffffffffff
push str.Unknown
push dword [eax]
push esi
call fcn.1001b6b8
add esp, 0x10
push ebx
call edi
push dword [ebp - 0x10]
call edi
xor eax, eax
inc eax
jmp 0x10009433
push ebx
call edi
push dword [ebp - 0x10]
call edi
jmp 0x10009431
push ebx
call edi
mov eax, dword [ebp + 0x10]
push 0xffffffffffffffff
push str.Unknown
push dword [eax]
push esi
call fcn.1001b6b8
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009917
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
call fcn.10010a4c
pop ecx
mov ecx, dword [ebp + 0x10]
mov edi, eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1000992f
sub ecx, edx
sar ecx, 1
test edi, edi
jne 0x10009947
xor eax, eax
inc eax
jmp 0x1000996f
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
pop ebp
ret

Function at 0x1000d649
Capabilities:
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push 0x244
push 0x10065490
call fcn.1001daa0
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x234], ebx
mov esi, edi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], 0x6a4abc5b
jne 0x1000d689
mov eax, dword [0x10070300]
jmp 0x1000d69f
cmp dword [ebp + 8], 0x3cfa685d
jne 0x1000d699
call fcn.10005cfe
jmp 0x1000d69f
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x230], eax
test eax, eax
je 0x1000d7f6
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push eax
call dword [0x10070310]
push edi
push 0x80
push 3
push edi
push 1
push accept
lea eax, [ebp - 0x224]
push eax
call dword [0x100702fc]
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
je 0x1000d7f6
push edi
push edi
push edi
push 2
push edi
push eax
call dword [0x1007030c]
mov esi, eax
mov dword [ebp - 0x228], esi
cmp esi, 0xffffffff
je 0x1000d7f0
push edi
push edi
push edi
push 4
push esi
call dword [0x100702f4]
mov ebx, eax
mov dword [ebp - 0x234], ebx
test ebx, ebx
je 0x1000d7f0
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov dword [ebp - 0x22c], eax
push edi
push dword [eax + 0x78]
push ebx
push eax
call fcn.10015f4f
mov esi, eax
push edi
push dword [esi + 0x24]
push ebx
push dword [ebp - 0x22c]
call fcn.10015f4f
mov dword [ebp - 0x24c], eax
push edi
push dword [esi + 0x1c]
push ebx
push dword [ebp - 0x22c]
call fcn.10015f4f
mov dword [ebp - 0x254], eax
push edi
push dword [esi + 0x20]
push ebx
push dword [ebp - 0x22c]
call fcn.10015f4f
add esp, 0x40
mov ecx, eax
mov dword [ebp - 0x240], ecx
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x248], eax
mov esi, edi
mov dword [ebp - 0x250], esi
cmp esi, eax
jae 0x1000d7f0
push edi
push dword [ecx + esi*4]
push ebx
push dword [ebp - 0x22c]
call fcn.10015f4f
add esp, 0x10
mov dword [ebp - 0x244], eax
mov edx, edi
mov cl, byte [eax]
ror edx, 0xd
movsx ecx, cl
add edx, ecx
inc eax
mov dword [ebp - 0x244], eax
mov cl, byte [eax]
test cl, cl
jne 0x1000d7b7
cmp edx, dword [ebp + 0xc]
jne 0x1000d80a
mov eax, dword [ebp - 0x24c]
movzx eax, word [eax + esi*2]
mov edi, dword [ebp - 0x254]
mov edi, dword [edi + eax*4]
add edi, dword [ebp - 0x230]
mov dword [ebp - 0x238], edi
mov esi, dword [ebp - 0x228]
mov dword [ebp - 4], 0xfffffffe
call fcn.1000d834
mov eax, edi
call fcn.1001dae8
ret
inc esi
mov dword [ebp - 0x250], esi
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x240]
jmp 0x1000d796
Function at 0x1000e3a1
Capabilities:
List user accounts for group
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1006a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0xfe
push eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x214], eax
mov byte [ebp - 0x204], al
lea eax, [ebp - 0x203]
push eax
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], esi
call fcn.10019f50
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.10019f50
xor edi, edi
add esp, 0x18
inc edi
cmp dword [0x1006d34c], 5
jl 0x1000e423
push str.ShowThisDomainGroupMembersNT
call fcn.100024d3
pop ecx
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x208]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
push esi
call sub.NETAPI32.dll_NetGroupGetUsers
cmp dword [ebp - 0x208], 0
mov ebx, eax
mov ecx, dword [ebp - 0x20c]
mov esi, ecx
je 0x1000e4e7
xor edx, edx
lea eax, [ebp - 0x204]
push edx
push edx
push 0xfe
push eax
push 0xffffffffffffffff
push dword [ecx]
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
test edi, edi
jne 0x1000e490
push 0x10057c34
jmp 0x1000e497
xor edi, edi
push 0x1004c754
push 0xffffffffffffffff
push pe_nt_image_headers32
push eax
call fcn.1001a28e
lea ecx, [ebp - 0x104]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000e4b0
push 0
sub ecx, edx
lea eax, [ebp - 0x104]
push ecx
push eax
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 0x20c]
add ecx, 4
dec dword [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
jne 0x1000e45c
test esi, esi
je 0x1000e4f1
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov esi, dword [ebp - 0x218]
cmp ebx, 0xea
mov ebx, dword [ebp - 0x210]
je 0x1000e423
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001890f
mov esp, ebp
pop ebp
ret
Function at 0x10010ddf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push 0x1001119c
push eax
push eax
call fcn.1001bf8e
mov ecx, dword [0x1006d34c]
add esp, 0x18
mov dword [0x1006ccb8], eax
cmp ecx, 5
jl 0x10010e20
push eax
push str.DEBUG:_Starting_web_thread...
call fcn.100024d3
mov eax, dword [0x1006ccb8]
pop ecx
pop ecx
mov ecx, dword [0x1006d34c]
test eax, eax
jne 0x10010e39
cmp ecx, 5
jl 0x10010e34
push str.Error_in_web_thread_creation
call fcn.100024d3
pop ecx
or eax, 0xffffffff
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x10011077
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 0
push 0x10016283
call fcn.1001be2c
mov ecx, dword [0x1006d34c]
add esp, 0xc
mov esi, eax
cmp ecx, 5
jl 0x100110b1
push dword [ebp + 8]
push esi
push str.DEBUG:_Starting_thread__d.._event_is__d
call fcn.100024d3
mov ecx, dword [0x1006d34c]
add esp, 0xc
cmp esi, 0xffffffff
pop esi
jne 0x100110cc
cmp ecx, 5
jl 0x100110c7
push str.Error_in_HTTPD_thread_creation
call fcn.100024d3
pop ecx
or eax, 0xffffffff
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x10011be2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 8]
call fcn.10010a4c
mov esi, eax
pop ecx
test esi, esi
je 0x10011c49
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push ebx
push edi
mov edi, dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
push eax
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 1
je 0x10011c40
push 0xffffffffffffffff
push 0x1004e190
push edi
push dword [ebp + 0x10]
call fcn.1001ba13
add esp, 0x10
xor eax, eax
jmp 0x10011c47
xor eax, eax
test ebx, ebx
sete al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012489
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x1006a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
xor ebx, ebx
lea eax, [ebp - 0x802]
push ebx
push eax
call fcn.10019f50
add esp, 0xc
mov dword [ebp - 0x808], ebx
test esi, esi
jne 0x100124d2
xor eax, eax
jmp 0x10012647
push edi
push esi
push str.SYSTEMCurrentControlSetServicesEventLog_s
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.1001abed
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x808]
add esp, 0x14
push eax
push 0x2001b
push ebx
lea eax, [ebp - 0x804]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x10012582
cmp dword [0x1006d34c], 1
jl 0x1001252a
push esi
push str.Cannot_determine_if_log__S_exists___checking_Microsoft_Windows_subscriptions
call fcn.100024d3
pop ecx
pop ecx
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannels_s
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.1001abed
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
push 0x2001b
push ebx
lea eax, [ebp - 0x804]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x10012582
cmp dword [0x1006d34c], 1
jl 0x1001257b
push esi
push str.Cannot_determine_if_log__S_exists___openkey_failed
call fcn.100024d3
pop ecx
pop ecx
xor eax, eax
jmp 0x10012646
push 4
pop edi
lea eax, [ebp - 0x810]
mov dword [ebp - 0x80c], ebx
push eax
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x810], edi
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push str.Retention
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100125d2
cmp dword [0x1006d34c], 1
jl 0x100125ef
push esi
push str.Cannot_check_log_retention_settings___queryvalueex_failed_for_log__S
call fcn.100024d3
pop ecx
pop ecx
cmp dword [0x1006d34c], 1
jl 0x100125ef
push esi
push dword [ebp - 0x80c]
push str.Log_retention_settings_are_set_to__d_for_log__S
call fcn.100024d3
add esp, 0xc
cmp dword [ebp + 0xc], ebx
jne 0x10012637
cmp dword [ebp - 0x80c], ebx
je 0x10012637
push edi
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x80c], ebx
push eax
push edi
push ebx
push str.Retention
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10012637
cmp dword [0x1006d34c], 1
jl 0x10012637
push esi
push str.Cannot_set_log_retention_settings___regsetvalueex_failed_for_log__S
call fcn.100024d3
pop ecx
pop ecx
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001890f
mov esp, ebp
pop ebp
ret
Function at 0x10014204
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x10070314]
push edi
push 2
pop ebx
cmp dword [0x1006d34c], ebx
jl 0x10014225
push str.Entering_CNTService::ServiceMain__
push esi
call fcn.100039d7
pop ecx
pop ecx
push 0x100122a1
lea eax, [esi + 4]
mov dword [esi + 0x54], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [esi + 0x4c], eax
mov ecx, esi
test eax, eax
jne 0x10014250
xor edi, edi
push edi
push edi
push edi
push 0x67
push 1
call fcn.1000f9e3
jmp 0x1001429e
call fcn.10012b23
xor edi, edi
test eax, eax
je 0x10014272
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0x6c], 1
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
call dword [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
mov ecx, esi
call fcn.10016cd3
cmp dword [0x1006d34c], ebx
jl 0x1001429e
push str.Leaving_CNTService::ServiceMain__
push esi
call fcn.100039d7
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret 8