joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018950
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.10018900
add esp, 8
test eax, eax
jne 0x1001899f
xor eax, eax
jmp 0x10018aca
call fcn.10017b10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 5
ja 0x100189e5
push str._boot.ini
lea edx, [ebp - 0x110]
push edx
call sub.ntdll.dll_strcat
add esp, 8
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100189e0
xor eax, eax
jmp 0x10018aca
jmp 0x10018a94
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea ecx, [ebp - 0x21f]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x220]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
push str.BCD
lea ecx, [ebp - 0x220]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10018a94
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x220]
push ecx
call sub.ntdll.dll_strcpy
add esp, 8
push str.BootBCD
lea edx, [ebp - 0x220]
push edx
call sub.ntdll.dll_strcat
add esp, 8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10018a7e
xor eax, eax
jmp 0x10018aca
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x110]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
cmp dword [ebp + 8], 0
je 0x10018aae
lea eax, [ebp - 0x110]
push eax
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
ja 0x10018ab2
xor eax, eax
jmp 0x10018aca
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x10019e30
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 6
push 1
push 2
call sub.WS2_32.dll_socket
pop ebp
ret

Function at 0x10019e40
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x198], 0
push 0x18e
push 0
lea eax, [ebp - 0x196]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10019e8b
xor eax, eax
jmp 0x10019e90
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret

Function at 0x10019f60
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
xor ecx, ecx
cmp dword [ebp + 8], 0xffffffff
setne cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x10019fcc
push 0x65
push 0x1003bba0
call fcn.10019ea0
add esp, 8
push eax
push 0x1003bbc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
jmp 0x1001a065
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jne 0x1001a006
push 0x66
push 0x1003bbd8
call fcn.10019ea0
add esp, 8
push eax
push str.paddr_NULL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
jmp 0x1001a065
mov word [ebp - 0x14], 2
mov ax, word [ebp + 0x10]
push eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x18], eax
jne 0x1001a065
push 0x6c
push str.e:AMWork_trunkBRincmytcp.h
call fcn.10019ea0
add esp, 8
push eax
push str.connect_sock___struct_sockaddr__sa__sizeof_sa__0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100026a0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret

Function at 0x1001a2e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], 2
mov eax, dword [ebp - 0x18]
mov cx, word [eax + 0x84]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x88]
push ecx
call sub.WS2_32.dll_sendto
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a3e0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a0], ecx
mov word [ebp - 0x19c], 0x202
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x19c]
push ecx
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1001a41e
xor al, al
jmp 0x1001a44a
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x88], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [eax + 0x88], 0xffffffff
jne 0x1001a448
xor al, al
jmp 0x1001a44a
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret

Function at 0x1001a4f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
cmp dword [eax + 0x88], 0xffffffff
jne 0x1001a515
xor al, al
jmp 0x1001a669
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0
jmp 0x1001a546
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x108]
jae 0x1001a5c1
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp + ecx*4 - 0x104]
cmp eax, dword [edx + 0x88]
jne 0x1001a5bc
mov ecx, dword [ebp - 0x108]
sub ecx, 1
cmp dword [ebp - 0x118], ecx
jae 0x1001a5ab
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + eax*4 - 0x100]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
jmp 0x1001a56f
mov eax, dword [ebp - 0x108]
sub eax, 1
mov dword [ebp - 0x108], eax
jmp 0x1001a5c1
jmp 0x1001a537
xor ecx, ecx
jne 0x1001a52b
cmp dword [ebp - 0x108], 0x40
jae 0x1001a5fa
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + 0x88]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
xor eax, eax
jne 0x1001a5c9
push 8
push 0
lea ecx, [ebp - 0x114]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
je 0x1001a642
cmp dword [ebp - 0x10c], 0
jne 0x1001a646
xor al, al
jmp 0x1001a669
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1001a667
xor al, al
jmp 0x1001a669
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001a830
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll_recv
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001a88a
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0xc], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.recv_err:__d_n
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1001a88d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a8a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001a8fa
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0xc], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.send_err:__d_n
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1001a8fd
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a910
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x1c]
add eax, 4
jne 0x1001a939
xor al, al
jmp 0x1001aa1a
mov word [ebp - 0x14], 2
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx + 4]
cmp edx, 0x30
jl 0x1001a957
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax + 4]
cmp ecx, 0x39
jle 0x1001a9b3
mov edx, dword [ebp - 0x1c]
add edx, 4
push edx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1001a9a4
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x20], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0x39
push str...CSocket.cpp
call fcn.1001a770
add esp, 8
push eax
push str._s:_gethostbyname_err:__d
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
xor al, al
jmp 0x1001aa1a
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
jmp 0x1001a9c2
mov edx, dword [ebp - 0x1c]
add edx, 4
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov cx, word [eax + 0x84]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x88]
push ecx
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1001aa18
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x24], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.connect_err:__d_n
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor al, al
jmp 0x1001aa1a
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret

Function at 0x1001aa30
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a0], ecx
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x1001aa9a
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1a4], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Init_err:__d_n
mov ecx, dword [ebp - 0x1a4]
push ecx
mov edx, dword [ebp - 0x1a4]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor al, al
jmp 0x1001aaf3
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x88], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [eax + 0x88], 0xffffffff
jne 0x1001aaf1
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1a8], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Error_at_socket__:__ld_n
mov ecx, dword [ebp - 0x1a8]
push ecx
mov edx, dword [ebp - 0x1a8]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor al, al
jmp 0x1001aaf3
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x1001b340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x1001b320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001b5a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035c88
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
mov ecx, dword [ebp - 0x1ac]
call fcn.10008a60
mov eax, dword [ebp - 0x1ac]
mov dword [eax], vtable.SmtpSendEmail.0
mov ecx, dword [ebp - 0x1ac]
add ecx, 8
call fcn.10008a80
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1ac]
add ecx, 0xf4
call fcn.10008ce0
mov word [ebp - 0x1a4], 0
push 0x18e
push 0
lea ecx, [ebp - 0x1a2]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x1a8], 0x202
lea edx, [ebp - 0x1a4]
push edx
mov ax, word [ebp - 0x1a8]
push eax
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + 8], 0x19
mov edx, dword [ebp - 0x1ac]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x1ac]
mov byte [eax + 0xf0], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret
Function at 0x1001b6a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x428], ecx
mov byte [ebp - 0x420], 0
push 0x3ff
push 0
lea eax, [ebp - 0x41f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov word [ebp - 0xb], cx
mov byte [ebp - 9], cl
push 0xa
push 0x14
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll__itoa_s]
add esp, 0x10
push 0
push 0x400
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0x428]
mov eax, dword [edx + 4]
push eax
call sub.WS2_32.dll_recv
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0
setg cl
mov dword [ebp - 0x424], ecx
cmp dword [ebp - 0x424], 0
jne 0x1001b767
push 0x160
push 0x1003cd94
call fcn.1001b380
add esp, 8
push eax
push str.__nRecvLen___0_
mov edx, dword [ebp - 0x424]
push edx
call fcn.100026a0
add esp, 0xc
jmp 0x1001b796
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp - 4], eax
jl 0x1001b796
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.10002700
add esp, 8
test eax, eax
je 0x1001b796
mov al, 1
jmp 0x1001b843
mov eax, dword [ebp - 0x428]
cmp dword [eax + 4], 0xffffffff
je 0x1001b841
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx + 4]
push edx
call sub.WS2_32.dll_closesocket
mov eax, dword [ebp - 0x428]
mov dword [eax + 4], 0xffffffff
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp + 8]
push ecx
push 0x16e
push 0x1003cdc0
call fcn.1001b380
add esp, 8
push eax
push str._s:_CheckResponse__d_failed.
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x42c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x420]
push eax
push 0x16f
push 0x1003cdf8
call fcn.1001b380
add esp, 8
push eax
push 0x1003ce10
mov ecx, dword [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 4
Function at 0x10024640
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035d1d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1004c024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 1
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call sub.DNSAPI.dll_DnsQuery_A
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100246b6
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x20]
jmp 0x10024724
cmp dword [ebp - 0x14], 0
je 0x100246ff
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.10006910
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x100246b6
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call sub.DNSAPI.dll_DnsFree
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x100251f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100364fd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1004c024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0xf
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call sub.DNSAPI.dll_DnsQuery_W
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100252c0
cmp dword [ebp - 0x18], 0x232b
je 0x1002525c
cmp dword [ebp - 0x18], 0x251d
jne 0x1002527d
mov dword [ebp - 0x1c], 0x232b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x1c]
jmp 0x1002532e
cmp dword [ebp - 0x18], 0x5b4
jne 0x100252a5
mov dword [ebp - 0x20], 0x5b4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x20]
jmp 0x1002532e
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x24]
jmp 0x1002532e
cmp dword [ebp - 0x14], 0
je 0x10025309
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 8]
cmp eax, 0xf
jne 0x100252ff
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
push edx
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x24]
call fcn.10002ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x100252c0
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.DNSAPI.dll_DnsFree
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10025e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10025e30
xor eax, eax
jmp 0x10025e43
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x10025e3e
xor eax, eax
jmp 0x10025e43
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x100261d0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x88], ecx
mov ecx, 0x15
mov esi, str.SYSTEMCurrentControlSetServices_volsnap
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x70]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1002621f
xor eax, eax
jmp 0x100262fb
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str.volsnap]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x1003f4b0]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x1003f4b4]
mov dword [ebp - 0xc], edx
mov eax, dword [0x1003f4b8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x1002627a
jmp 0x100262d8
push 0xf01ff
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x10026298
jmp 0x100262d8
push 0
push 0
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x100262b1
jmp 0x100262d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x420
je 0x100262cb
jmp 0x100262d8
mov dword [ebp - 0x7c], 1
jmp 0x100262d8
cmp dword [ebp - 0x74], 0
je 0x100262e8
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x78], 0
je 0x100262f8
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret