joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a8c0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x1c]
add eax, 4
jne 0x1001a8e9
xor al, al
jmp 0x1001a9ca
mov word [ebp - 0x14], 2
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx + 4]
cmp edx, 0x30
jl 0x1001a907
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax + 4]
cmp ecx, 0x39
jle 0x1001a963
mov edx, dword [ebp - 0x1c]
add edx, 4
push edx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1001a954
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x20], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0x39
push str...CSocket.cpp
call fcn.1001a720
add esp, 8
push eax
push str._s:_gethostbyname_err:__d
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
xor al, al
jmp 0x1001a9ca
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
jmp 0x1001a972
mov edx, dword [ebp - 0x1c]
add edx, 4
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov cx, word [eax + 0x84]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x88]
push ecx
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1001a9c8
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x24], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.connect_err:__d_n
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor al, al
jmp 0x1001a9ca
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret

Function at 0x1001a9e0
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a0], ecx
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x1001aa4a
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1a4], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Init_err:__d_n
mov ecx, dword [ebp - 0x1a4]
push ecx
mov edx, dword [ebp - 0x1a4]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor al, al
jmp 0x1001aaa3
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x88], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [eax + 0x88], 0xffffffff
jne 0x1001aaa1
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1a8], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Error_at_socket__:__ld_n
mov ecx, dword [ebp - 0x1a8]
push ecx
mov edx, dword [ebp - 0x1a8]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor al, al
jmp 0x1001aaa3
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1001b2f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x1001b2d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001b550
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033d94
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
mov ecx, dword [ebp - 0x1ac]
call fcn.10008af0
mov eax, dword [ebp - 0x1ac]
mov dword [eax], vtable.SmtpSendEmail.0
mov ecx, dword [ebp - 0x1ac]
add ecx, 8
call fcn.10008b10
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1ac]
add ecx, 0xf4
call fcn.10008cb0
mov word [ebp - 0x1a4], 0
push 0x18e
push 0
lea ecx, [ebp - 0x1a2]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x1a8], 0x202
lea edx, [ebp - 0x1a4]
push edx
mov ax, word [ebp - 0x1a8]
push eax
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + 8], 0x19
mov edx, dword [ebp - 0x1ac]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x1ac]
mov byte [eax + 0xf0], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1001b650
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x428], ecx
mov byte [ebp - 0x420], 0
push 0x3ff
push 0
lea eax, [ebp - 0x41f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov word [ebp - 0xb], cx
mov byte [ebp - 9], cl
push 0xa
push 0x14
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll__itoa_s]
add esp, 0x10
push 0
push 0x400
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0x428]
mov eax, dword [edx + 4]
push eax
call sub.WS2_32.dll_recv
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0
setg cl
mov dword [ebp - 0x424], ecx
cmp dword [ebp - 0x424], 0
jne 0x1001b717
push 0x160
push 0x1003a974
call fcn.1001b330
add esp, 8
push eax
push str.__nRecvLen___0_
mov edx, dword [ebp - 0x424]
push edx
call fcn.10002580
add esp, 0xc
jmp 0x1001b746
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp - 4], eax
jl 0x1001b746
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.100025e0
add esp, 8
test eax, eax
je 0x1001b746
mov al, 1
jmp 0x1001b7f3
mov eax, dword [ebp - 0x428]
cmp dword [eax + 4], 0xffffffff
je 0x1001b7f1
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx + 4]
push edx
call sub.WS2_32.dll_closesocket
mov eax, dword [ebp - 0x428]
mov dword [eax + 4], 0xffffffff
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp + 8]
push ecx
push 0x16e
push 0x1003a9a0
call fcn.1001b330
add esp, 8
push eax
push str._s:_CheckResponse__d_failed.
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x42c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x420]
push eax
push 0x16f
push 0x1003a9d8
call fcn.1001b330
add esp, 8
push eax
push 0x1003a9f0
mov ecx, dword [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b810
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 9], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
xor eax, eax
mov dword [ebp - 4], eax
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x2c]
xor eax, eax
cmp dword [edx + 4], 0xffffffff
setne al
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1001b88e
push 0x13b
push 0x1003a8f4
call fcn.1001b330
add esp, 8
push eax
push str.__m_hSocket__INVALID_SOCKET_
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.10002580
add esp, 0xc
jmp 0x1001b991
mov dword [ebp - 8], 0x7530
push 8
lea edx, [ebp - 8]
push edx
push 0x1006
push 0xffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call dword [sym.imp.MSVCP80.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1001b8d5
xor al, al
jmp 0x1001b994
mov word [ebp - 0x20], 2
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x1001b8fe
push 0x19
call sub.WS2_32.dll_htons
mov word [ebp - 0x1e], ax
jmp 0x1001b90f
mov ecx, dword [ebp - 0x2c]
mov dx, word [ecx + 8]
push edx
call sub.WS2_32.dll_htons
mov word [ebp - 0x1e], ax
push 0x10
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1001b981
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll_closesocket
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], 0
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x30], eax
call sub.WS2_32.dll_WSAGetLastError
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
push 0x14f
push 0x1003a92c
call fcn.1001b330
add esp, 8
push eax
push str._s:_Failed_to_connect_Email_server:__s__err:__d
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x14
xor al, al
jmp 0x1001b994
push 0xdc
mov ecx, dword [ebp - 0x2c]
call fcn.1001b650
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1001bab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100346fe
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push 0x1003ad60
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
cmp dword [ebp - 0x30], eax
je 0x1001bb93
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30b
push str...SmtpSendEmail.cpp
call fcn.1001b330
add esp, 8
push eax
push str._s:__d__send__
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
mov eax, dword [ebp - 0x38]
cmp dword [eax + 4], 0xffffffff
je 0x1001bb7a
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
push edx
call sub.WS2_32.dll_closesocket
mov eax, dword [ebp - 0x38]
mov dword [eax + 4], 0xffffffff
mov byte [ebp - 0x31], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, byte [ebp - 0x31]
jmp 0x1001bbb6
push 0xdd
mov ecx, dword [ebp - 0x38]
call fcn.1001b650
mov byte [ebp - 0x32], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, byte [ebp - 0x32]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1001c630
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100347af
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [ebp - 4], 0
push 0x1003ac14
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const__]
push 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
cmp dword [ebp - 0x30], eax
je 0x1001c71c
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x254
push 0x1003ac1c
call fcn.1001b330
add esp, 8
push eax
push 0x1003ac34
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
mov eax, dword [ebp - 0x38]
cmp dword [eax + 4], 0xffffffff
je 0x1001c703
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
push edx
call sub.WS2_32.dll_closesocket
mov eax, dword [ebp - 0x38]
mov dword [eax + 4], 0xffffffff
mov byte [ebp - 0x31], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, byte [ebp - 0x31]
jmp 0x1001c73f
push 0x162
mov ecx, dword [ebp - 0x38]
call fcn.1001b650
mov byte [ebp - 0x32], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, byte [ebp - 0x32]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x100245f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033e29
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10048024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 1
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call sub.DNSAPI.dll_DnsQuery_A
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10024666
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x20]
jmp 0x100246d4
cmp dword [ebp - 0x14], 0
je 0x100246af
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.100068f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x10024666
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call sub.DNSAPI.dll_DnsFree
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x100251a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034609
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10048024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0xf
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call sub.DNSAPI.dll_DnsQuery_W
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10025270
cmp dword [ebp - 0x18], 0x232b
je 0x1002520c
cmp dword [ebp - 0x18], 0x251d
jne 0x1002522d
mov dword [ebp - 0x1c], 0x232b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x1c]
jmp 0x100252de
cmp dword [ebp - 0x18], 0x5b4
jne 0x10025255
mov dword [ebp - 0x20], 0x5b4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x20]
jmp 0x100252de
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x24]
jmp 0x100252de
cmp dword [ebp - 0x14], 0
je 0x100252b9
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 8]
cmp eax, 0xf
jne 0x100252af
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
push edx
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x24]
call fcn.10002db0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x10025270
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.DNSAPI.dll_DnsFree
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10026050
Capabilities:
Check if file exists
Get disk information
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
mov byte [ebp - 0x230], 0
push 0x103
push 0
lea eax, [ebp - 0x22f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea ecx, [ebp - 0x11f]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x124], 0
push 0x400
push 0
lea edx, [ebp - 0x638]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x10026137
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x230]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
push str.SYSTAG.BIN
lea eax, [ebp - 0x230]
push eax
call sub.ntdll.dll_strcat
add esp, 8
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1002611f
jmp 0x10026137
mov edx, dword [ebp - 4]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 1]
mov dword [ebp - 4], edx
jmp 0x100260da
push 0
push 2
push 3
push 0
push 3
push SysReAllocString
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x1002616d
mov eax, dword [ebp - 0x124]
jmp 0x1002622f
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 0x10], 0x400
jne 0x1002618d
cmp dword [ebp - 0xc], 0
je 0x100261a5
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x1002622f
mov dword [ebp - 0x234], 0
push 0
lea ecx, [ebp - 0x234]
push ecx
push 0x400
lea edx, [ebp - 0x638]
push edx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x124], 0
je 0x10026229
cmp dword [ebp + 8], 0
je 0x10026201
lea edx, [ebp - 0x438]
mov dword [ebp - 0x640], edx
jmp 0x1002620d
lea eax, [ebp - 0x638]
mov dword [ebp - 0x640], eax
mov ecx, dword [ebp - 0x640]
mov dword [ebp - 0x63c], ecx
mov esi, dword [ebp - 0x63c]
mov ecx, 0x80
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x124]
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret

Function at 0x10026240
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x1002627a
mov eax, 1
jmp 0x1002627c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret