joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004064
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov ebx, ecx
push esi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000408b
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
mov dword [ebx + 0xc], edx
jmp 0x1000408d
xor edx, edx
push edi
push 0xb
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
push 0xd
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.GWIeAxMsgWin_C2F4ADCF_007C_4A70_A0C0_A490EFC108EB
lea edi, [ebp - 0x64]
lea eax, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1001e454]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x30
push eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0x10002e00
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x10004102
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x582
je 0x10004102
xor esi, esi
push esi
call fcn.10007073
push eax
push str.Window_Registration_Failed:_error_s_
call fcn.10004a1a
add esp, 0xc
jmp 0x10004104
xor esi, esi
push esi
push edi
push esi
push esi
push 1
mov eax, connect
push 1
push eax
push eax
push esi
lea eax, [ebp - 0x64]
push 0x1001e49c
push eax
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebx + 0xc], eax
mov dword [0x1001e48c], eax
cmp dword [ebx + 0xc], esi
pop edi
jne 0x1000414e
push esi
call fcn.10007073
push eax
push str.Window_Creation_Failed:_error_s_
call fcn.10004a5c
add esp, 0xc
xor al, al
jmp 0x10004179
cmp byte [ebp + 8], 0
je 0x10004164
push str.GWIEPlugin_start_Notify_USBkey_in_off_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.10002cf9
push esi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov al, 1
pop esi
pop ebx
leave
ret 4

Function at 0x10004a72
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [ebp - 4]
call fcn.10004b2a
lea edi, [esi + 4]
push 0x1000
push 0
push edi
call fcn.1000c170
lea ebx, [esi + 0x1004]
push 0x1400
push 0
push ebx
call fcn.1000c170
lea eax, [esi + 0x2404]
push 0x10
push 0
push eax
call fcn.1000c170
add esp, 0x24
lea eax, [esi + 0x2404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1000c805
mov eax, dword [ebp + 8]
push edi
lea eax, [eax + eax*2]
lea eax, [eax*2 + 0x100175b8]
push eax
movzx eax, word [esi + 0x2410]
push eax
movzx eax, word [esi + 0x240e]
push eax
movzx eax, word [esi + 0x240c]
push eax
push str.__02u:_02u:_02u___s___ieax___s_n
push 0x1388
push ebx
call fcn.1000b186
add esp, 0x2c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10004b26
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
leave
ret 0xc
Function at 0x10004c18
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
and word [ebp - 0xa00], 0
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x9fe]
and word [ebp - 0x200], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x1fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x404
pop edi
je 0x10004cb9
cmp eax, 0x804
je 0x10004c9c
cmp eax, 0xc04
je 0x10004cb9
cmp eax, 0x1004
je 0x10004cb9
cmp eax, 0x1404
je 0x10004cb9
push str.Because_Protect_Mode_enabled_in_IE_Automatically_Component_Updating_needed_You_should_download_this_component_to_local_OR_installation_will_abort._nAre_you_sure_to_download_and_execute_
lea eax, [ebp - 0xa00]
push 0x400
push eax
call fcn.1000c856
push str.Client_Component_Maintain
jmp 0x10004cd4
push 0x1001b8f4
lea eax, [ebp - 0xa00]
push 0x400
push eax
call fcn.1000c856
push 0x1001b8dc
jmp 0x10004cd4
push 0x1001b828
lea eax, [ebp - 0xa00]
push 0x400
push eax
call fcn.1000c856
push 0x1001b818
lea eax, [ebp - 0x200]
push pe_nt_image_headers32
push eax
call fcn.1000c856
add esp, 0x18
lea eax, [ebp - 0x200]
push ebx
push 4
push eax
lea eax, [ebp - 0xa00]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
push 1
lea ecx, [ebp + 8]
sete bl
call fcn.100045bf
mov al, bl
pop ebx
leave
ret

Function at 0x10004f0a
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x10]
push 2
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10004f5f
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10004f65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], ebx
pop ebx
je 0x10004f74
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 8], 1
sete al
leave
ret
Function at 0x10004fc4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 0xc]
push str.get_file_version:__s
call fcn.10004a04
pop ecx
lea eax, [ebp - 4]
pop ecx
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
ja 0x1000500c
push ebx
call fcn.10007073
push eax
push str.get_file_version_GetFileVersionInfoSize___failed:__s
call fcn.10004a46
add esp, 0xc
xor al, al
jmp 0x100050af
push edi
push esi
call fcn.1000bafe
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10005091
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1001b71c
push edi
mov dword [ebp + 0xc], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10005083
mov esi, dword [ebp + 8]
push 8
push ebx
push esi
call fcn.1000c170
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov bl, 1
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov word [esi], cx
mov cx, word [eax + 8]
mov word [esi + 2], cx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
mov word [esi + 4], cx
mov ax, word [eax + 0xc]
mov word [esi + 6], ax
jmp 0x100050a5
push ebx
call fcn.10007073
push eax
push str.get_file_version____VerQueryValuefailed:__s
jmp 0x1000509d
push ebx
call fcn.10007073
push eax
push str.get_file_version_GetFileVersionInfo___failed:__s
call fcn.10004a46
add esp, 0xc
push edi
call fcn.1000b6e9
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10005146
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
and byte [ebp - 0x400], 0
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
mov ebx, 0x100175b0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
jne 0x1000517c
mov eax, ebx
mov esi, 0x400
lea ecx, [ebp - 0x400]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [0x100175b4]
mov ecx, edi
push 0
call fcn.10004245
lea eax, [ebp - 0x400]
push eax
call fcn.1000c260
pop ecx
push eax
lea eax, [ebp - 0x400]
push eax
mov ecx, edi
call fcn.100043e5
push esi
lea eax, [ebp - 0x400]
push 0
push eax
call fcn.1000c170
mov eax, dword [edi + 4]
add esp, 0xc
test eax, eax
jne 0x100051d6
mov eax, ebx
lea ecx, [ebp - 0x400]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x10005214
push dword [0x100175b4]
mov ecx, edi
push 0
call fcn.10004245
lea eax, [ebp - 0x400]
push eax
call fcn.1000c260
pop ecx
push eax
lea eax, [ebp - 0x400]
push eax
mov ecx, edi
call fcn.100043e5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005219
Capabilities:
Check if file exists
Create directory

Disassembly:
cmp dword [0x100230c0], 0
push esi
push edi
mov edi, 0x100230b8
jne 0x10005285
call fcn.100050b3
test al, al
mov esi, str._USERPROFILE_AppDataLocalLow.sslvpn_
je 0x1000523c
mov esi, str._APPDATA_.sslvpn_
push esi
call fcn.1000c260
pop ecx
push eax
push esi
mov ecx, 0x100230b8
call fcn.100043e5
push edi
call fcn.10005146
mov eax, dword [0x100230bc]
pop ecx
test eax, eax
mov esi, 0x100175b0
jne 0x10005266
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10005285
mov eax, dword [0x100230bc]
test eax, eax
jne 0x1000527c
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [esp + 0xc]
mov al, byte [0x100230b8]
push 0
mov ecx, esi
mov byte [esi], al
call fcn.100045bf
push dword [0x100175b4]
mov ecx, esi
push 0
push edi
call fcn.1000443c
mov eax, esi
pop edi
pop esi
ret

Function at 0x100053bd
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov byte [ebp - 1], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100053e0
mov al, 1
jmp 0x1000550b
call fcn.100050b3
test al, al
je 0x10005415
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10005508
push ebx
call fcn.10007073
push eax
push edi
push str.create_progfolder__s__failed:__s
call fcn.10004a46
add esp, 0x10
xor al, al
jmp 0x1000550b
push ebx
push ebx
push 0xa
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], ebx
call fcn.1000468f
push edi
call fcn.1000c260
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.10005e58
mov al, byte [ebp + 0xb]
mov esi, dword [ebp - 8]
add esp, 0x10
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
push ebx
call fcn.10005c23
push esi
call fcn.1000c2db
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.10005c60
push str.ieframe.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
jne 0x1000549b
push ebx
call fcn.10007073
push eax
push edi
push str.create_progfolder__s__LoadLibrary_ieframe.dll__failed:__s
call fcn.10004a46
add esp, 0x10
lea ecx, [ebp - 0x20]
push 1
call fcn.10005c23
cmp dword [ebp - 8], ebx
je 0x10005508
push dword [ebp - 8]
call fcn.1000b6e9
pop ecx
jmp 0x10005508
push str.IECreateDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x100054ba
push ebx
call fcn.10007073
push eax
push edi
push str.create_progfolder__s__GetProcAddress_IECreateDirectory__failed:__s
jmp 0x100054db
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
jne 0x100054c6
mov ecx, 0x100175e8
push ebx
push ecx
call eax
test eax, eax
jne 0x100054e5
push ebx
call fcn.10007073
push eax
push edi
push str.create_progfolder__s__IECreateDirectory_failed:__s
call fcn.10004a46
add esp, 0x10
jmp 0x100054e9
mov byte [ebp - 1], 1
push 1
lea ecx, [ebp - 0x20]
call fcn.10005c23
cmp dword [ebp - 8], ebx
je 0x10005501
push dword [ebp - 8]
call fcn.1000b6e9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000617f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
mov esi, ecx
push 0x21
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xa3]
mov byte [ebp - 0xa4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa4]
push ebx
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
je 0x10006248
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x10006241
push ebx
push ebx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
call fcn.100045fb
lea eax, [ebp - 4]
push ebx
push eax
push dword [ebp - 4]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10006233
push ebx
push ebx
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], ebx
call fcn.100045fb
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push eax
call fcn.10005e98
add esp, 0xc
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.1000624f
cmp dword [ebp - 8], ebx
je 0x10006233
push dword [ebp - 8]
call fcn.1000b6e9
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x10006241
push dword [ebp - 0x14]
call fcn.1000b6e9
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10007f1b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret
Function at 0x10008036
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
xor ebx, ebx
push 7
mov dword [ebp - 0x14], ecx
mov dword [ecx + 0x7c], ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x63]
mov byte [ebp - 0x64], bl
or dword [ebp - 8], 0xffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], ebx
push 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1000c170
push 1
or dword [ebp - 0x44], 2
pop esi
lea eax, [ebp - 0x64]
push dword [ebp + 0xc]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
push 0x1001c504
push eax
call fcn.1000c470
mov eax, dword [0x10025988]
add esp, 0x18
cmp eax, ebx
jne 0x100080af
push ebx
call fcn.100081cd
mov dword [0x10025988], eax
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push dword [ebp + 8]
call eax
mov edi, eax
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp edi, ebx
jne 0x100081c3
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0xe3]
mov byte [ebp - 0xe4], bl
mov dword [ebp + 0xc], 0x78
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xe4]
push eax
mov eax, dword [ebp - 4]
push ebx
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 8]
push str.Connect_To:__s__s_
push 4
call fcn.1000afc4
mov eax, dword [ebp - 4]
add esp, 0x10
push esi
push ebx
push ebx
push ebx
push esi
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
je 0x100081a8
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
push dword [eax + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100081a8
lea eax, [ebp + 8]
push 4
push eax
push esi
push 6
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 8], ebx
mov ecx, esi
mov dword [esi + 0x10], edi
call fcn.10007fa7
xor eax, eax
lea edi, [ebp - 0x22]
mov word [ebp - 0x24], bx
mov dword [ebp - 0x10], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp word [ebp - 0x24], 2
jne 0x100081a8
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x7c], eax
mov eax, dword [0x10025984]
mov esi, dword [ebp - 4]
cmp eax, ebx
jne 0x100081c0
push 2
call fcn.100081cd
mov dword [0x10025984], eax
push esi
call eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100081cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x1002598c], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x10008377
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x100088a8
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.1000833e
je 0x10008219
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x1001c51c]
jmp 0x1000833a
push ebx
push esi
push edi
lea eax, [ebp - 0x230]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10008322
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.1000c300
lea eax, [ebp - 0x128]
push str.ws2_32
push eax
call fcn.1000c310
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10008291
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x1000828d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x100082e0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.1000c300
lea eax, [ebp - 0x128]
push str.wship6
push eax
call fcn.1000c310
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call edi
mov esi, eax
test esi, esi
je 0x10008322
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x100082dc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10008322
and dword [ebp - 4], 0
lea edi, [ebp - 0x18]
push dword [edi - 4]
push esi
call ebx
test eax, eax
mov dword [edi], eax
je 0x10008301
inc dword [ebp - 4]
add edi, 8
cmp dword [ebp - 4], 3
jl 0x100082e7
jmp 0x1000830a
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10008322
xor eax, eax
mov ecx, dword [ebp + eax - 0x18]
mov dword [eax + 0x1001c51c], ecx
add eax, 8
cmp eax, 0x18
jl 0x10008310
movzx eax, word [ebp + 8]
pop edi
pop esi
mov eax, dword [eax*8 + 0x1001c51c]
mov dword [0x1002598c], 1
pop ebx
leave
ret 4

Function at 0x100087c2
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
and dword [edi], 0
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x1000883b
cmp word [ebx + 8], 2
jne 0x1000881d
cmp word [ebx + 0xa], 4
jne 0x1000881d
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x1000881d
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1000865f
test eax, eax
mov dword [edi], eax
je 0x10008818
lea edi, [eax + 0x1c]
add esi, 4
jmp 0x100087f4
push 8
pop eax
jmp 0x10008861
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call fcn.1000cae0
and byte [esi + 0x400], 0
add esp, 0xc
xor eax, eax
jmp 0x10008861
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x10008861
dec ecx
je 0x1000885c
dec ecx
je 0x10008855
dec ecx
jmp 0x10008861
mov eax, 0x2afb
jmp 0x10008861
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x10008a41
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
call dword [eax + 0x1c]
test eax, eax
jne 0x10008b0a
cmp dword [esi + 0x10], 0xffffffff
je 0x10008b0a
mov ecx, dword [esi + 8]
push edi
mov dword [esi + 0x54], ebx
call fcn.10007756
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.10007599
mov ecx, dword [esi + 8]
add edi, eax
mov dword [ebp - 0xc], edi
call fcn.10007599
mov ecx, dword [esi + 8]
mov edi, eax
call fcn.10007530
sub eax, edi
push ebx
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push 1
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_WSARecv]
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, ebx
mov dword [esi + 0x50], eax
je 0x10008adf
push dword [ebp - 4]
mov ecx, dword [esi + 8]
call fcn.10007602
push dword [esi + 0x24]
call edi
cmp dword [esi + 0x50], ebx
jne 0x10008b04
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x3e5
je 0x10008b04
mov dword [esi + 0xc], 1
call ebx
push dword [esi + 0x24]
mov dword [esi + 0x54], eax
call edi
mov eax, dword [ebp - 4]
pop edi
jmp 0x10008b0d
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x10008c19
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1c]
test eax, eax
jne 0x10008cd3
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x10008cd3
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x14]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
push 0
lea ecx, [ebp - 8]
push edi
and dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
push 1
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x10008cc5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10008c86
mov dword [ebp - 4], 0xfffffffe
jmp 0x10008cc5
push dword [ebp + 0x10]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10008ca6
cmp eax, 0x102
jne 0x10008cc5
mov dword [ebp - 4], 0xfffffffc
jmp 0x10008cc5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x10008cc5
mov dword [ebp - 4], 0xfffffffd
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp - 4]
jmp 0x10008cd6
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc
Function at 0x10008cdc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
je 0x10008dc0
cmp ecx, ebx
jbe 0x10008dc0
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x10008dc0
cmp eax, ebx
je 0x10008dc0
cmp dword [esi + 8], ebx
jne 0x10008d2c
push 0xfffffffffffffffe
pop eax
jmp 0x10008dc3
lea edi, [esi + 0x28]
push ebx
push edi
lea ecx, [ebp - 4]
push ebx
push ecx
lea ecx, [ebp - 0x10]
push 1
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x10008da3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10008d65
mov dword [esi + 0xc], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x10008da3
push dword [ebp + 0x10]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x10008d85
cmp eax, 0x102
jne 0x10008da3
mov dword [ebp - 4], 0xfffffffc
jmp 0x10008da3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x10008da3
mov dword [ebp - 4], 0xfffffffd
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [ebp - 4], ebx
jle 0x10008dbb
mov eax, dword [ebp - 4]
cdq
add dword [esi + 0x48], eax
adc dword [esi + 0x4c], edx
mov eax, dword [ebp - 4]
jmp 0x10008dc3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100091ac
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
lea eax, [ebp - 0xc0]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0xac], 1
je 0x10009236
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x26
xor eax, eax
pop ecx
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x9c
push eax
call esi
test eax, eax
pop edi
jne 0x1000920d
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
push eax
call esi
jmp 0x10009231
cmp dword [ebp - 0x8c], 2
jne 0x10009236
cmp dword [ebp - 0x98], 5
jb 0x10009236
jne 0x10009236
cmp dword [ebp - 0x94], 0
jne 0x10009236
cmp word [ebp - 8], 2
jae 0x10009236
push 1
pop eax
jmp 0x10009238
xor eax, eax
pop esi
leave
ret