joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a5e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003506b
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x104], ecx
mov ecx, dword [ebp - 0x104]
call fcn.1000a850
cmp dword [ebp + 8], 0
jne 0x1000a629
xor al, al
jmp 0x1000a7b9
lea ecx, [ebp - 0xfc]
call fcn.1000d7a0
mov dword [ebp - 4], 0
push 0x80
lea ecx, [ebp - 0xfc]
call fcn.1000d6c0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xfc]
call fcn.1000dc10
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x6c], 0x80
mov ecx, dword [ebp - 0x104]
add ecx, 0x4c
push ecx
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x1000a70a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000a70a
cmp dword [ebp - 0x70], 0x44
jbe 0x1000a6b9
push 0x80004005
call fcn.10009f20
cmp dword [ebp - 0x6c], 0x80
jbe 0x1000a6df
mov edx, dword [ebp - 0x6c]
push edx
lea ecx, [ebp - 0xfc]
call fcn.1000d6f0
lea ecx, [ebp - 0xfc]
call fcn.1000dc10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x104]
add eax, 0x4c
push eax
lea ecx, [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x60]
push edx
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x1000a78f
mov ecx, dword [ebp - 0x104]
mov byte [ecx + 0x48], 1
mov edx, dword [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x104]
call fcn.1000a950
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1000a78f
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x104]
add ecx, 0x54
call fcn.1000d5d0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x104]
add ecx, 0x50
call fcn.1000d5d0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x104]
add ecx, 0x5c
call fcn.1000d5d0
mov byte [ebp - 0xfd], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.1000d6a0
mov al, byte [ebp - 0xfd]
jmp 0x1000a7b9
mov ecx, dword [ebp - 0x104]
call fcn.1000a850
mov byte [ebp - 0xfe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.1000d6a0
mov al, byte [ebp - 0xfe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cee0
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0
call sub.NETAPI32.dll_NetLocalGroupGetMembers
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000cf36
jmp 0x1000cfb2
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], 0
jmp 0x1000cf4e
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jae 0x1000cf9c
push 1
mov edx, dword [ebp - 0x20]
imul edx, edx, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1000cf72
jmp 0x1000cf45
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x20]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax + 8]
push edx
call dword [sym.imp.ntdll.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x1000cf9a
mov dword [ebp - 4], 1
jmp 0x1000cf9c
jmp 0x1000cf45
mov eax, dword [ebp - 0x1c]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 8], 0xea
je 0x1000cef7
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x1000d325
cmp dword [ebp + 0xc], 0
jne 0x1000d32c
xor eax, eax
jmp 0x1000d476
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x1000d372
mov ecx, dword [ebp - 0x18]
add ecx, 0x108
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x1000d352
xor eax, eax
jmp 0x1000d476
mov edx, dword [ebp - 0x18]
add edx, 0x108
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x1000d476
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.SYSTEMSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d39a
xor eax, eax
jmp 0x1000d476
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x104
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
add eax, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push str.SystemPartition
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d3e2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000d476
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
and edx, 0x3e8
push edx
push str.._systmp_d
mov eax, dword [ebp - 0x18]
add eax, 0x108
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x10c
push edx
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x1000d437
xor eax, eax
jmp 0x1000d476
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x108
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x1000d45b
xor eax, eax
jmp 0x1000d476
mov edx, dword [ebp - 0x18]
add edx, 0x108
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x1000f672
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10048024]
jne 0x1000f67c
repz ret
jmp fcn.1000fafd
Function at 0x10010f70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10010fc5
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x18], eax
push 0x631
push 0x10038624
call fcn.10010eb0
add esp, 8
push eax
push str._s:_OpenProcessToken_Failed.
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x10011129
lea edx, [ebp - 0x10]
push edx
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001103c
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1c], eax
push 0x63d
push 0x10038678
call fcn.10010eb0
add esp, 8
push eax
push 0x10038688
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor eax, eax
jmp 0x10011129
lea eax, [ebp - 0x10]
push eax
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100110b0
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x20], eax
push 0x64a
push 0x100386d4
call fcn.10010eb0
add esp, 8
push eax
push 0x100386e4
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
jmp 0x10011129
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10011124
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x24], eax
push 0x657
push 0x1003872c
call fcn.10010eb0
add esp, 8
push eax
push str._s:_AdjustTokenPrivileges_Failed.
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x10011129
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10011130
Capabilities:
Check if file exists
Get common file path
Get file attributes
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x10011194
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x21c], eax
push 0x17
push 0x100371c4
call fcn.10010eb0
add esp, 8
push eax
push str._s:_GetSystemDirectory_Failed.
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x100111fb
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea edx, [ebp - 0x217]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push str._s_bcdedit.exe
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100111e3
xor eax, eax
jmp 0x100111fb
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x100176c0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1444
call fcn.10010620
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x1440], 0
push 0x103
push 0
lea eax, [ebp - 0x143f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x11c]
push ecx
push 1
push 0
push 0x10038aa8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0
je 0x10017725
xor al, al
jmp 0x10017919
mov dword [ebp - 0x1334], 1
mov dword [ebp - 0x1128], 0x104
lea edx, [ebp - 0x1128]
push edx
lea eax, [ebp - 0x1440]
push eax
lea ecx, [ebp - 0x1334]
push ecx
push 0
push 0x10038ab8
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0
je 0x10017785
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10017919
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x118]
and eax, 0x3e8
push eax
push 0x10038ac8
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1440]
push edx
lea eax, [ebp - 0x10c]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x100177fd
xor al, al
jmp 0x10017919
push 0x10038ad8
lea ecx, [ebp - 0x110]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
mov byte [ebp - 0x1330], 0
push 0x1ff
push 0
lea edx, [ebp - 0x132f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x1330]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
jne 0x1001785d
xor al, al
jmp 0x10017919
mov byte [ebp - 0x1120], 0
push 0xfff
push 0
lea edx, [ebp - 0x111f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
push 0x1000
lea ecx, [ebp - 0x1120]
push ecx
lea edx, [ebp - 0x1330]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
jne 0x100178b7
xor al, al
jmp 0x10017919
mov dword [ebp - 0x1444], 0
jmp 0x100178d2
mov eax, dword [ebp - 0x1444]
add eax, 1
mov dword [ebp - 0x1444], eax
mov ecx, dword [ebp - 0x1444]
cmp ecx, dword [ebp - 0x114]
jae 0x10017917
mov edx, dword [ebp - 0x1444]
movsx eax, byte [ebp + edx - 0x111f]
cmp eax, 0x3a
jne 0x10017915
mov ecx, dword [ebp - 0x1444]
movsx edx, byte [ebp + ecx - 0x111e]
cmp edx, 0x5c
jne 0x10017915
mov eax, dword [ebp - 0x1444]
mov al, byte [ebp + eax - 0x1120]
jmp 0x10017919
jmp 0x100178c3
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x10017990
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x10038e34
lea eax, [ebp - 0x110]
push eax
call fcn.100025e0
add esp, 8
test eax, eax
je 0x100179e4
mov eax, 1
jmp 0x100179e6
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x10018900
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.100188b0
add esp, 8
test eax, eax
jne 0x1001894f
xor eax, eax
jmp 0x10018a7a
call fcn.10017ac0
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 5
ja 0x10018995
push str._boot.ini
lea edx, [ebp - 0x110]
push edx
call sub.ntdll.dll_strcat
add esp, 8
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10018990
xor eax, eax
jmp 0x10018a7a
jmp 0x10018a44
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea ecx, [ebp - 0x21f]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x220]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
push str.BCD
lea ecx, [ebp - 0x220]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10018a44
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x220]
push ecx
call sub.ntdll.dll_strcpy
add esp, 8
push str.BootBCD
lea edx, [ebp - 0x220]
push edx
call sub.ntdll.dll_strcat
add esp, 8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10018a2e
xor eax, eax
jmp 0x10018a7a
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x110]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
cmp dword [ebp + 8], 0
je 0x10018a5e
lea eax, [ebp - 0x110]
push eax
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
ja 0x10018a62
xor eax, eax
jmp 0x10018a7a
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x10019de0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 6
push 1
push 2
call sub.WS2_32.dll_socket
pop ebp
ret

Function at 0x10019df0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x198], 0
push 0x18e
push 0
lea eax, [ebp - 0x196]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x198]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10019e3b
xor eax, eax
jmp 0x10019e40
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret

Function at 0x10019f10
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
xor ecx, ecx
cmp dword [ebp + 8], 0xffffffff
setne cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x10019f7c
push 0x65
push 0x10039978
call fcn.10019e50
add esp, 8
push eax
push 0x10039990
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10002580
add esp, 0xc
jmp 0x1001a015
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jne 0x10019fb6
push 0x66
push 0x100399a8
call fcn.10019e50
add esp, 8
push eax
push str.paddr_NULL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10002580
add esp, 0xc
jmp 0x1001a015
mov word [ebp - 0x14], 2
mov ax, word [ebp + 0x10]
push eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x18], eax
jne 0x1001a015
push 0x6c
push str.j:BR5.0incmytcp.h
call fcn.10019e50
add esp, 8
push eax
push str.connect_sock___struct_sockaddr__sa__sizeof_sa__0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10002580
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret

Function at 0x1001a290
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], 2
mov eax, dword [ebp - 0x18]
mov cx, word [eax + 0x84]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x88]
push ecx
call sub.WS2_32.dll_sendto
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a390
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a0], ecx
mov word [ebp - 0x19c], 0x202
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x19c]
push ecx
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1001a3ce
xor al, al
jmp 0x1001a3fa
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x88], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [eax + 0x88], 0xffffffff
jne 0x1001a3f8
xor al, al
jmp 0x1001a3fa
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret

Function at 0x1001a4a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
cmp dword [eax + 0x88], 0xffffffff
jne 0x1001a4c5
xor al, al
jmp 0x1001a619
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0
jmp 0x1001a4f6
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x108]
jae 0x1001a571
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp + ecx*4 - 0x104]
cmp eax, dword [edx + 0x88]
jne 0x1001a56c
mov ecx, dword [ebp - 0x108]
sub ecx, 1
cmp dword [ebp - 0x118], ecx
jae 0x1001a55b
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + eax*4 - 0x100]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
jmp 0x1001a51f
mov eax, dword [ebp - 0x108]
sub eax, 1
mov dword [ebp - 0x108], eax
jmp 0x1001a571
jmp 0x1001a4e7
xor ecx, ecx
jne 0x1001a4db
cmp dword [ebp - 0x108], 0x40
jae 0x1001a5aa
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + 0x88]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
xor eax, eax
jne 0x1001a579
push 8
push 0
lea ecx, [ebp - 0x114]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
je 0x1001a5f2
cmp dword [ebp - 0x10c], 0
jne 0x1001a5f6
xor al, al
jmp 0x1001a619
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1001a617
xor al, al
jmp 0x1001a619
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001a7e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll_recv
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001a83a
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0xc], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.recv_err:__d_n
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1001a83d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a850
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001a8aa
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0xc], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.send_err:__d_n
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1001a8ad
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8