joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004008
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov ebx, ecx
push esi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000402f
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
mov dword [ebx + 0xc], edx
jmp 0x10004031
xor edx, edx
push edi
push 0xb
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
push 0xd
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.GWIeAxMsgWin_C2F4ADCF_007C_4A70_A0C0_A490EFC108EB
lea edi, [ebp - 0x64]
lea eax, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1001e554]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x30
push eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0x10002e00
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x100040a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x582
je 0x100040a6
xor esi, esi
push esi
call fcn.1000702c
push eax
push str.Window_Registration_Failed:_error_s_
call fcn.100049d7
add esp, 0xc
jmp 0x100040a8
xor esi, esi
push esi
push edi
push esi
push esi
push 1
mov eax, connect
push 1
push eax
push eax
push esi
lea eax, [ebp - 0x64]
push 0x1001e59c
push eax
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebx + 0xc], eax
mov dword [0x1001e58c], eax
cmp dword [ebx + 0xc], esi
pop edi
jne 0x100040f2
push esi
call fcn.1000702c
push eax
push str.Window_Creation_Failed:_error_s_
call fcn.10004a19
add esp, 0xc
xor al, al
jmp 0x1000411d
cmp byte [ebp + 8], 0
je 0x10004108
push str.GWIEPlugin_start_Notify_USBkey_in_off_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.10002cf9
push esi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov al, 1
pop esi
pop ebx
leave
ret 4

Function at 0x10004a2f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [ebp - 4]
call fcn.10004ae7
lea edi, [esi + 4]
push 0x1000
push 0
push edi
call fcn.1000c340
lea ebx, [esi + 0x1004]
push 0x1400
push 0
push ebx
call fcn.1000c340
lea eax, [esi + 0x2404]
push 0x10
push 0
push eax
call fcn.1000c340
add esp, 0x24
lea eax, [esi + 0x2404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1000c9d5
mov eax, dword [ebp + 8]
push edi
lea eax, [eax + eax*2]
lea eax, [eax*2 + 0x100175b0]
push eax
movzx eax, word [esi + 0x2410]
push eax
movzx eax, word [esi + 0x240e]
push eax
movzx eax, word [esi + 0x240c]
push eax
push str.__02u:_02u:_02u___s___ieax___s_n
push 0x1388
push ebx
call fcn.1000b1c8
add esp, 0x2c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10004ae3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
leave
ret 0xc
Function at 0x10004bd5
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
and word [ebp - 0xa00], 0
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x9fe]
and word [ebp - 0x200], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x1fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x404
pop edi
je 0x10004c76
cmp eax, 0x804
je 0x10004c59
cmp eax, 0xc04
je 0x10004c76
cmp eax, 0x1004
je 0x10004c76
cmp eax, 0x1404
je 0x10004c76
push str.Because_Protect_Mode_enabled_in_IE_Automatically_Component_Updating_needed_You_should_download_this_component_to_local_OR_installation_will_abort._nAre_you_sure_to_download_and_execute_
lea eax, [ebp - 0xa00]
push 0x400
push eax
call fcn.1000ca26
push str.Client_Component_Maintain
jmp 0x10004c91
push 0x1001b8e0
lea eax, [ebp - 0xa00]
push 0x400
push eax
call fcn.1000ca26
push 0x1001b8cc
jmp 0x10004c91
push 0x1001b818
lea eax, [ebp - 0xa00]
push 0x400
push eax
call fcn.1000ca26
push 0x1001b808
lea eax, [ebp - 0x200]
push 0x100
push eax
call fcn.1000ca26
add esp, 0x18
lea eax, [ebp - 0x200]
push ebx
push 4
push eax
lea eax, [ebp - 0xa00]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
push 1
lea ecx, [ebp + 8]
sete bl
call fcn.1000457c
mov al, bl
pop ebx
leave
ret

Function at 0x10004ec7
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x10]
push 2
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10004f1c
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10004f22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], ebx
pop ebx
je 0x10004f31
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 8], 1
sete al
leave
ret
Function at 0x10004f81
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 0xc]
push str.get_file_version:__s
call fcn.100049c1
pop ecx
lea eax, [ebp - 4]
pop ecx
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
ja 0x10004fc9
push ebx
call fcn.1000702c
push eax
push str.get_file_version_GetFileVersionInfoSize___failed:__s
call fcn.10004a03
add esp, 0xc
xor al, al
jmp 0x1000506c
push edi
push esi
call fcn.1000bcce
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1000504e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1001b70c
push edi
mov dword [ebp + 0xc], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10005040
mov esi, dword [ebp + 8]
push 8
push ebx
push esi
call fcn.1000c340
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov bl, 1
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov word [esi], cx
mov cx, word [eax + 8]
mov word [esi + 2], cx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
mov word [esi + 4], cx
mov ax, word [eax + 0xc]
mov word [esi + 6], ax
jmp 0x10005062
push ebx
call fcn.1000702c
push eax
push str.get_file_version____VerQueryValuefailed:__s
jmp 0x1000505a
push ebx
call fcn.1000702c
push eax
push str.get_file_version_GetFileVersionInfo___failed:__s
call fcn.10004a03
add esp, 0xc
push edi
call fcn.10007f2f
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10005103
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
and byte [ebp - 0x400], 0
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
mov ebx, 0x100175a8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
jne 0x10005139
mov eax, ebx
mov esi, 0x400
lea ecx, [ebp - 0x400]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [0x100175ac]
mov ecx, edi
push 0
call fcn.100041e9
lea eax, [ebp - 0x400]
push eax
call fcn.1000c430
pop ecx
push eax
lea eax, [ebp - 0x400]
push eax
mov ecx, edi
call fcn.100043a2
push esi
lea eax, [ebp - 0x400]
push 0
push eax
call fcn.1000c340
mov eax, dword [edi + 4]
add esp, 0xc
test eax, eax
jne 0x10005193
mov eax, ebx
lea ecx, [ebp - 0x400]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x100051d1
push dword [0x100175ac]
mov ecx, edi
push 0
call fcn.100041e9
lea eax, [ebp - 0x400]
push eax
call fcn.1000c430
pop ecx
push eax
lea eax, [ebp - 0x400]
push eax
mov ecx, edi
call fcn.100043a2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100051d6
Capabilities:
Check if file exists
Create directory

Disassembly:
cmp dword [0x100231c0], 0
push esi
push edi
mov edi, 0x100231b8
jne 0x10005242
call fcn.10005070
test al, al
mov esi, str._USERPROFILE_AppDataLocalLow.sslvpn_
je 0x100051f9
mov esi, str._APPDATA_.sslvpn_
push esi
call fcn.1000c430
pop ecx
push eax
push esi
mov ecx, 0x100231b8
call fcn.100043a2
push edi
call fcn.10005103
mov eax, dword [0x100231bc]
pop ecx
test eax, eax
mov esi, 0x100175a8
jne 0x10005223
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10005242
mov eax, dword [0x100231bc]
test eax, eax
jne 0x10005239
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [esp + 0xc]
mov al, byte [0x100231b8]
push 0
mov ecx, esi
mov byte [esi], al
call fcn.1000457c
push dword [0x100175ac]
mov ecx, esi
push 0
push edi
call fcn.100043f9
mov eax, esi
pop edi
pop esi
ret

Function at 0x1000537a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov byte [ebp - 1], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1000539d
mov al, 1
jmp 0x100054c8
call fcn.10005070
test al, al
je 0x100053d2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100054c5
push ebx
call fcn.1000702c
push eax
push edi
push str.create_progfolder__s__failed:__s
call fcn.10004a03
add esp, 0x10
xor al, al
jmp 0x100054c8
push ebx
push ebx
push 0xa
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], ebx
call fcn.1000464c
push edi
call fcn.1000c430
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.10005e11
mov al, byte [ebp + 0xb]
mov esi, dword [ebp - 8]
add esp, 0x10
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
push ebx
call fcn.10005bdc
push esi
call fcn.1000c4ab
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.10005c19
push str.ieframe.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
jne 0x10005458
push ebx
call fcn.1000702c
push eax
push edi
push str.create_progfolder__s__LoadLibrary_ieframe.dll__failed:__s
call fcn.10004a03
add esp, 0x10
lea ecx, [ebp - 0x20]
push 1
call fcn.10005bdc
cmp dword [ebp - 8], ebx
je 0x100054c5
push dword [ebp - 8]
call fcn.10007f2f
pop ecx
jmp 0x100054c5
push str.IECreateDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x10005477
push ebx
call fcn.1000702c
push eax
push edi
push str.create_progfolder__s__GetProcAddress_IECreateDirectory__failed:__s
jmp 0x10005498
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
jne 0x10005483
mov ecx, 0x100175e0
push ebx
push ecx
call eax
test eax, eax
jne 0x100054a2
push ebx
call fcn.1000702c
push eax
push edi
push str.create_progfolder__s__IECreateDirectory_failed:__s
call fcn.10004a03
add esp, 0x10
jmp 0x100054a6
mov byte [ebp - 1], 1
push 1
lea ecx, [ebp - 0x20]
call fcn.10005bdc
cmp dword [ebp - 8], ebx
je 0x100054be
push dword [ebp - 8]
call fcn.10007f2f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006138
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
mov esi, ecx
push 0x21
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xa3]
mov byte [ebp - 0xa4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa4]
push ebx
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
je 0x10006201
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x100061fa
push ebx
push ebx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
call fcn.100045b8
lea eax, [ebp - 4]
push ebx
push eax
push dword [ebp - 4]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100061ec
push ebx
push ebx
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], ebx
call fcn.100045b8
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push eax
call fcn.10005e51
add esp, 0xc
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.10006208
cmp dword [ebp - 8], ebx
je 0x100061ec
push dword [ebp - 8]
call fcn.10007f2f
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x100061fa
push dword [ebp - 0x14]
call fcn.10007f2f
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10007fa8
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret
Function at 0x100080c3
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
xor ebx, ebx
push 7
mov dword [ebp - 0x14], ecx
mov dword [ecx + 0x7c], ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x63]
mov byte [ebp - 0x64], bl
or dword [ebp - 8], 0xffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], ebx
push 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1000c340
push 1
or dword [ebp - 0x44], 2
pop esi
lea eax, [ebp - 0x64]
push dword [ebp + 0xc]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
push 0x1001c518
push eax
call fcn.1000c640
mov eax, dword [0x10025a8c]
add esp, 0x18
cmp eax, ebx
jne 0x1000813c
push ebx
call fcn.10008270
mov dword [0x10025a8c], eax
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push dword [ebp + 8]
call eax
mov edi, eax
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp edi, ebx
jne 0x10008266
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0xe3]
mov byte [ebp - 0xe4], bl
mov dword [ebp + 0xc], 0x78
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xe4]
push eax
mov eax, dword [ebp - 4]
push ebx
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 8]
push str.Connect_To:__s__s_
push 4
call fcn.1000b006
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 8]
push str._vpnops__ssl_Ready_connect_to:__s__s_
push 4
call fcn.1000b006
mov eax, dword [ebp - 4]
add esp, 0x20
push esi
push ebx
push ebx
push ebx
push esi
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
je 0x1000824b
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
push dword [eax + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1000824b
lea eax, [ebp + 8]
push 4
push eax
push esi
push 6
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 8], ebx
mov ecx, esi
mov dword [esi + 0x10], edi
call fcn.10008034
xor eax, eax
lea edi, [ebp - 0x22]
mov word [ebp - 0x24], bx
mov dword [ebp - 0x10], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp word [ebp - 0x24], 2
jne 0x1000824b
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x7c], eax
mov eax, dword [0x10025a88]
mov esi, dword [ebp - 4]
cmp eax, ebx
jne 0x10008263
push 2
call fcn.10008270
mov dword [0x10025a88], eax
push esi
call eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10008270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x10025a90], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x1000841a
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x1000894b
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.100083e1
je 0x100082bc
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x1001c534]
jmp 0x100083dd
push ebx
push esi
push edi
lea eax, [ebp - 0x230]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100083c5
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.1000c4d0
lea eax, [ebp - 0x128]
push str.ws2_32
push eax
call fcn.1000c4e0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10008334
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x10008330
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x10008383
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.1000c4d0
lea eax, [ebp - 0x128]
push str.wship6
push eax
call fcn.1000c4e0
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call edi
mov esi, eax
test esi, esi
je 0x100083c5
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x1000837f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x100083c5
and dword [ebp - 4], 0
lea edi, [ebp - 0x18]
push dword [edi - 4]
push esi
call ebx
test eax, eax
mov dword [edi], eax
je 0x100083a4
inc dword [ebp - 4]
add edi, 8
cmp dword [ebp - 4], 3
jl 0x1000838a
jmp 0x100083ad
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x100083c5
xor eax, eax
mov ecx, dword [ebp + eax - 0x18]
mov dword [eax + 0x1001c534], ecx
add eax, 8
cmp eax, 0x18
jl 0x100083b3
movzx eax, word [ebp + 8]
pop edi
pop esi
mov eax, dword [eax*8 + 0x1001c534]
mov dword [0x10025a90], 1
pop ebx
leave
ret 4

Function at 0x10008865
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
and dword [edi], 0
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x100088de
cmp word [ebx + 8], 2
jne 0x100088c0
cmp word [ebx + 0xa], 4
jne 0x100088c0
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x100088c0
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10008702
test eax, eax
mov dword [edi], eax
je 0x100088bb
lea edi, [eax + 0x1c]
add esi, 4
jmp 0x10008897
push 8
pop eax
jmp 0x10008904
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call fcn.1000ccb0
and byte [esi + 0x400], 0
add esp, 0xc
xor eax, eax
jmp 0x10008904
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x10008904
dec ecx
je 0x100088ff
dec ecx
je 0x100088f8
dec ecx
jmp 0x10008904
mov eax, 0x2afb
jmp 0x10008904
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x10008ae4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
call dword [eax + 0x1c]
test eax, eax
jne 0x10008bad
cmp dword [esi + 0x10], 0xffffffff
je 0x10008bad
mov ecx, dword [esi + 8]
push edi
mov dword [esi + 0x54], ebx
call fcn.10007763
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.100075a6
mov ecx, dword [esi + 8]
add edi, eax
mov dword [ebp - 0xc], edi
call fcn.100075a6
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.1000753d
sub eax, edi
push ebx
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push 1
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_WSARecv]
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, ebx
mov dword [esi + 0x50], eax
je 0x10008b82
push dword [ebp - 4]
mov ecx, dword [esi + 8]
call fcn.1000760f
push dword [esi + 0x24]
call edi
cmp dword [esi + 0x50], ebx
jne 0x10008ba7
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x3e5
je 0x10008ba7
mov dword [esi + 0xc], 1
call ebx
push dword [esi + 0x24]
mov dword [esi + 0x54], eax
call edi
mov eax, dword [ebp - 4]
pop edi
jmp 0x10008bb0
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x10008cbc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1c]
test eax, eax
jne 0x10008d76
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x10008d76
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x14]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
push 0
lea ecx, [ebp - 8]
push edi
and dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
push 1
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x10008d68
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10008d29
mov dword [ebp - 4], 0xfffffffe
jmp 0x10008d68
push dword [ebp + 0x10]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10008d49
cmp eax, 0x102
jne 0x10008d68
mov dword [ebp - 4], 0xfffffffc
jmp 0x10008d68
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x10008d68
mov dword [ebp - 4], 0xfffffffd
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp - 4]
jmp 0x10008d79
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc