joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cd90
Capabilities:
Get hostname

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
lea ecx, [esp + 0xc]
and eax, 0xffff
push ecx
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1000cdc0
mov edx, dword [esp + 0xc]
mov eax, ebx
mov byte [edx + ebx], 0
pop ebx
ret 8
push esi
push edi
mov edi, str.local
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000cdf0
Capabilities:
Get session user name

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x1000cdfe
mov dword [eax], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000ce0c
mov dword [eax], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000ce17
mov byte [eax], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000ce22
mov byte [eax], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000ce30
mov dword [eax], 0
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1000ce84
lea eax, [esp + 0xc]
mov byte [esi], 0
push eax
push esi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1000ce84
mov ecx, dword [esp + 0xc]
mov byte [ecx + esi], 0
mov edx, dword [esp + 0xc]
xor ecx, ecx
test edx, edx
jbe 0x1000ce84
mov al, byte [ecx + esi]
cmp al, 0x61
jl 0x1000ce79
cmp al, 0x7a
jg 0x1000ce79
movsx eax, al
sub eax, 0x20
jmp 0x1000ce7c
movsx eax, al
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jb 0x1000ce66
call fcn.1000cea0
and eax, 0xff
pop esi
ret 0x1c
Function at 0x1000cea0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
xor ebx, ebx
push eax
push ebx
push 8
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000cf1b
call ebp
cmp eax, 0x3f0
jne 0x1000cfab
lea ecx, [esp + 0x14]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000cf1b
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor esi, esi
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
push esi
push 2
push edx
call edi
test eax, eax
jne 0x1000cf77
cmp esi, ebx
je 0x1000cf49
push esi
call sym.fbclient.dll_gds__free
call ebp
cmp eax, 0x7a
jne 0x1000cf62
mov eax, dword [esp + 0x18]
push eax
call sym.fbclient.dll_gds__alloc
mov esi, eax
cmp esi, ebx
je 0x1000cfa0
jmp 0x1000cf27
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1000cfb5
push esi
call sym.fbclient.dll_gds__free
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
mov byte [esp + 0x13], bl
jbe 0x1000cfea
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebp, [esi + 4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp]
push eax
push ecx
call ebx
test eax, eax
jne 0x1000cfe5
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x1000cfca
jmp 0x1000cfea
mov byte [esp + 0x13], 1
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call sym.fbclient.dll_gds__free
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1000d2c0
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push 0x3a
push ebx
call dword [sym.imp.MSVCRT.dll_strchr]
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1000d2df
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, ebp
sub eax, ebx
cmp eax, 1
jne 0x1000d335
mov edx, dword [esp + 0x18]
mov cl, byte [ebx]
mov edi, 0x1004faf4
xor eax, eax
mov byte [edx], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 1]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x14], esi
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp ax, 1
jbe 0x1000d335
cmp ax, 4
je 0x1000d335
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebp]
mov byte [ebx], al
inc ebx
test al, al
je 0x1000d370
mov al, byte [ebp + 1]
inc ebp
mov byte [ebx], al
inc ebx
test al, al
jne 0x1000d365
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x1000db80
Capabilities:
Enumerate network shares
Get disk information

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
mov dword [esp + 0x14], ecx
mov ebp, dword [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x3a
mov eax, ecx
mov esi, edi
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], 0x4000
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x1000dd55
sub eax, ebx
cmp eax, 1
jne 0x1000dd55
movsx ecx, byte [ebx]
push ecx
call dword [sym.imp.MSVCRT.dll_toupper]
mov byte [esp + 0x24], al
mov edi, 0x1004fafc
or ecx, 0xffffffff
xor eax, eax
add esp, 4
lea edx, [esp + 0x21]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp ax, 4
jne 0x1000dd55
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x1000dd55
mov eax, dword [esp + 0x10]
push eax
call sym.fbclient.dll_gds__alloc
mov esi, eax
test esi, esi
je 0x1000dd55
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push esi
push edx
push eax
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x1000dc9e
push esi
call sym.fbclient.dll_gds__free
mov ecx, dword [esp + 0x10]
push ecx
call sym.fbclient.dll_gds__alloc
mov esi, eax
test esi, esi
je 0x1000dd55
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push esi
push eax
push ecx
call sub.MPR.dll_WNetEnumResourceA
mov ebp, dword [esp + 0x14]
xor eax, eax
test ebp, ebp
mov ecx, esi
jbe 0x1000dcc9
mov dl, byte [esp + 0x20]
mov edi, dword [ecx + 0x10]
test edi, edi
je 0x1000dcb9
cmp dl, byte [edi]
je 0x1000dcc9
inc eax
add ecx, 0x20
mov edi, eax
and edi, 0xffff
cmp edi, ebp
jb 0x1000dcae
mov edi, eax
and edi, 0xffff
cmp edi, ebp
je 0x1000dce6
mov ebp, dword [esp + 0x24]
push ecx
push ebx
push ebp
call fcn.1000dfe0
add esp, 0xc
jmp 0x1000dcea
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push edx
call sub.MPR.dll_WNetCloseEnum
cmp edi, dword [esp + 0x14]
jne 0x1000dd4f
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push esi
push 2
push ecx
mov byte [esp + 0x32], 0
call sub.MPR.dll_WNetGetUniversalNameA
cmp eax, 0xea
jne 0x1000dd40
push esi
call sym.fbclient.dll_gds__free
mov edx, dword [esp + 0x10]
push edx
call sym.fbclient.dll_gds__alloc
mov esi, eax
test esi, esi
je 0x1000dd55
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push esi
push 2
push ecx
call sub.MPR.dll_WNetGetUniversalNameA
test eax, eax
jne 0x1000dd4f
push esi
push ebx
push ebp
call fcn.1000e110
add esp, 0xc
push esi
call sym.fbclient.dll_gds__free
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x1000fd20
Capabilities:
Query environment variable

Disassembly:
cmp word [0x10055b1c], 0
je 0x1000fd56
mov eax, dword [0x10055b14]
test eax, eax
je 0x1000fd56
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [0x10055b14]
cmp dword [ecx + 0x1c], eax
je 0x1000fd53
push str.SCH_validate____wrong_thread
call sym.fbclient.dll_gds__log
add esp, 4
xor al, al
ret
mov al, 1
ret
push str.SCH_validate____not_entered
call sym.fbclient.dll_gds__log
push str.ISC_PUNT
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 8
test eax, eax
je 0x1000fd50
jmp dword [sym.imp.MSVCRT.dll_abort]

Function at 0x10011840
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x10011ae0
cmp word [0x10055b40], 0
jne 0x10011b17
push 0x10055b28
mov word [0x10055b40], 1
call fcn.10011870
add esp, 4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
push 0x10011810
mov dword [0x10055b20], eax
call sym.fbclient.dll_gds__register_cleanup
ret

Function at 0x10011b60
Capabilities:
Create thread
Resume thread

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push esi
push eax
push 4
push ecx
push edx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x10011b8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
ret
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 5
ja case.0x10011b97.5
jmp dword [eax*4 + 0x10011bf0]
mov eax, 0xf
jmp 0x10011bc1
mov eax, 2
jmp 0x10011bc1
mov eax, 1
jmp 0x10011bc1
xor eax, eax
jmp 0x10011bc1
or eax, 0xffffffff
jmp 0x10011bc1
mov eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test byte [esp + 0x14], 4
jne 0x10011bd7
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10011be5
mov dword [eax], esi
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret

Function at 0x10011ff0
Capabilities:
Execute command
Query environment variable

Disassembly:
sub esp, 0x148
push ebx
push esi
push edi
push str.EDITOR
call dword [sym.imp.MSVCRT.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10012012
mov edi, str.Notepad
mov esi, dword [esp + 0x158]
mov ebx, dword [sym.imp.MSVCRT.dll__stat]
lea eax, [esp + 0x30]
push eax
push esi
call ebx
add esp, 8
lea ecx, [esp + 0x54]
push esi
push edi
push 0x1005017c
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.MSVCRT.dll_system]
lea eax, [esp + 0x20]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x44]
add esp, 0x1c
cmp ecx, eax
pop edi
pop esi
pop ebx
jne 0x10012078
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
cmp edx, eax
jne 0x10012078
xor eax, eax
add esp, 0x148
ret 8
mov eax, 1
add esp, 0x148
ret 8
Function at 0x100123b0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push edi
push str.ISC_USER
mov byte [esp + 0x17], 0
mov byte [esp + 0x16], 0
call esi
push str.ISC_PASSWORD
mov edi, eax
call esi
add esp, 8
mov ebp, eax
test edi, edi
jne 0x100123e6
test ebp, ebp
je 0x100124a6
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebx]
test ecx, ecx
je 0x10012442
mov dx, word [eax]
test dx, dx
je 0x10012442
movsx esi, dx
add esi, ecx
cmp ecx, esi
jae 0x10012442
xor edx, edx
mov dl, byte [ecx]
inc ecx
cmp edx, 1
je 0x1001243e
add edx, 0xffffffed
cmp edx, 0xb
ja case.0x1001241f.21
xor ebx, ebx
mov bl, byte [edx + 0x100124bc]
jmp dword [ebx*4 + 0x100124b0]
mov byte [esp + 0x13], 1
jmp case.0x1001241f.21
mov byte [esp + 0x12], 1
mov ebx, dword [esp + 0x18]
xor edx, edx
mov dl, byte [ecx]
lea ecx, [ecx + edx + 1]
cmp ecx, esi
jb 0x10012405
test edi, edi
je 0x1001248b
mov cl, byte [esp + 0x13]
test cl, cl
jne 0x1001248b
test ebp, ebp
je 0x10012474
mov cl, byte [esp + 0x12]
test cl, cl
jne 0x10012474
push 0
push ebp
push 0x1d
push edi
push 0x1c
push eax
push ebx
call sym.fbclient.dll__isc_expand_dpb
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push 0
push edi
push 0x1c
push eax
push ebx
call sym.fbclient.dll__isc_expand_dpb
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test ebp, ebp
je 0x100124a6
mov cl, byte [esp + 0x12]
test cl, cl
jne 0x100124a6
push 0
push ebp
push 0x1d
push eax
push ebx
call sym.fbclient.dll__isc_expand_dpb
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x100124d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push str.ISC_PATH
call dword [sym.imp.MSVCRT.dll_getenv]
mov edx, eax
add esp, 4
test edx, edx
jne 0x100124ed
pop edi
xor al, al
pop ebx
ret 0xc
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
test cx, cx
jne 0x10012506
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
and ecx, 0xffff
mov byte [ecx + ebx], 0
mov al, byte [ebx]
test al, al
mov ecx, ebx
je 0x1001252c
cmp al, 0x3a
je 0x100124e6
cmp al, 0x2f
je 0x100124e6
cmp al, 0x5c
je 0x100124e6
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10012518
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx - 1]
mov al, byte [ecx + edx - 1]
cmp al, 0x3a
je 0x10012584
cmp al, 0x2f
je 0x10012584
cmp al, 0x5c
je 0x10012584
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov cx, word [0x100501d0]
mov word [edi - 1], cx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop ebx
ret 0xc

Function at 0x10018180
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
cmp esi, eax
je 0x10018192
mov eax, dword [esi + 4]
pop esi
ret
push esi
call sym.fbclient.dll_gds__print_status
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov cx, ax
add eax, 0xffff
test cx, cx
je 0x100181dc
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
and eax, 0xffff
push esi
inc eax
mov esi, eax
mov al, byte [edx]
mov byte [ecx], al
inc ecx
inc edx
dec esi
jne 0x100181d2
pop esi
push 0x10055c48
call fcn.1000e7f0
pop ecx
ret
Function at 0x100244c0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
mov eax, dword [0x10056650]
sub esp, 0x40
test eax, eax
push esi
jne 0x1002454a
push 0x10056278
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x10024534
mov esi, dword [esp + 0x48]
test esi, esi
je 0x10024505
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0x1400018f
push str.WSAStartup
push esi
call fcn.10025610
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x40
ret
call sub.WS2_32.dll_WSAGetLastError
push eax
lea eax, [esp + 8]
push str.INET_alloc_port:_WSAStartup_failed__error_code___d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 4]
push 0
push ecx
call sym.fbclient.dll_gds__log
add esp, 8
xor eax, eax
pop esi
add esp, 0x40
ret
push 0
push 0x10024d40
call sym.fbclient.dll_gds__register_cleanup
mov dword [0x10056650], 1
cmp byte [0x10050e00], 1
jne 0x10024583
call fcn.1003ae30
cmp eax, 0x5a8
mov dword [0x10056538], eax
jl 0x1002456b
cmp eax, 0x8000
jle 0x10024575
mov eax, 0x2000
mov dword [0x10056538], eax
mov dword [0x1005640c], eax
mov byte [0x10050e00], 0
jmp 0x10024588
mov eax, dword [0x10056538]
lea edx, [eax + eax]
push edx
push 8
call fcn.100239a0
mov esi, eax
push 0
push 0
push esi
mov dword [esi + 4], 2
mov dword [esi + 8], 1
call fcn.1002f7b0
add esp, 0x14
lea eax, [esp + 4]
push 0x40
push eax
call sub.WS2_32.dll_gethostname
lea ecx, [esp + 4]
push ecx
call fcn.1002f8f0
lea edx, [esp + 8]
mov dword [esi + 0xb0], eax
push edx
call fcn.1002f8f0
mov dword [esi + 0xb4], eax
mov eax, dword [esi + 0xb0]
add esp, 8
add eax, 6
lea ecx, [esp + 4]
push eax
push str.tcp___s_
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x10]
push edx
call fcn.1002f8f0
mov dword [esi + 0xac], eax
mov eax, dword [esp + 0x58]
add esp, 0x10
test eax, eax
je 0x1002463d
test byte [eax + 0x25], 8
jne 0x1002463d
mov dword [esi + 0x18], eax
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x14], ecx
mov edx, dword [eax + 0x3c]
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], esi
mov dword [esi + 0x3c], edx
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x20], ecx
mov dx, word [eax + 0x24]
mov word [esi + 0x24], dx
mov dword [esi + 0x50], 0x100246c0
mov dword [esi + 0x54], fcn.10024c40
mov dword [esi + 0x58], 0x10024fb0
mov dword [esi + 0x5c], fcn.10025390
mov dword [esi + 0x60], 0x100253c0
mov dword [esi + 0x64], 0x10024890
mov dword [esi + 0x68], 0x10024a20
mov ax, word [0x10056538]
mov word [esi + 0x28], ax
mov eax, dword [0x10056538]
mov cx, ax
push 0
lea edx, [eax + esi + 0xd4]
push ecx
push edx
lea eax, [esi + 0x8c]
push esi
push eax
call fcn.100253e0
push 1
lea ecx, [esi + 0xd4]
push 0
push ecx
lea edx, [esi + 0x74]
push esi
push edx
call fcn.100253e0
add esp, 0x28
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x10024c40
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp word [esi + 0x4c], 0
lea eax, [esi + 0x4c]
je 0x10024c65
push 4
push eax
mov eax, dword [esi + 0x3c]
push 0x80
push 0xffff
push eax
call sub.WS2_32.dll_setsockopt
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x10024c79
cmp eax, 0xffffffff
je 0x10024c79
push 2
push eax
call sub.WS2_32.dll_shutdown
mov eax, dword [esi + 0x1c]
push edi
mov edi, dword [esi + 0x18]
test edi, edi
je 0x10024ca4
test eax, eax
je 0x10024c98
push eax
call fcn.10024c40
add esp, 4
mov dword [esi + 0x1c], 0
push edi
push esi
call fcn.10025d40
add esp, 8
jmp 0x10024cac
test eax, eax
je 0x10024cac
or byte [eax + 0x2a], 0x40
mov eax, dword [esi + 0x3c]
pop edi
test eax, eax
je 0x10024cba
push eax
call sub.WS2_32.dll_closesocket
push esi
push 0x10024d40
call sym.fbclient.dll_gds__unregister_cleanup
push esi
call fcn.10024cd0
add esp, 4
pop esi
ret

Function at 0x10024d70
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov al, byte [0x10056410]
sub esp, 0x58
push ebx
xor ebx, ebx
cmp al, bl
push esi
jne 0x10024dc5
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x10056410
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10056410
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
add ecx, 0x10056410
mov dword [0x10056534], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
lea ecx, [esp + 0x10]
push ebx
push ecx
call esi
mov edx, dword [esp + 0x74]
push eax
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [esp + 8]
mov ecx, dword [0x10056534]
push eax
push str.__s__i__h__ld
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x74]
add esp, 0xc
and ecx, 0x100
lea edx, [esp + 0xc]
neg ecx
sbb ecx, ecx
lea eax, [esp + 0x1c]
push edx
and ecx, 0x60
push eax
push ebx
add ecx, 0x28
push ebx
push ecx
push 1
push ebx
push ebx
push 0x10056410
push ebx
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x48], ebx
mov dword [esp + 0x78], ebx
mov word [esp + 0x76], bx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x70], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ax, ax
je 0x10024e6f
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop esi
mov eax, 1
pop ebx
add esp, 0x58
ret
Function at 0x10024eb0
Capabilities:
Resolve dns

Disassembly:
push ecx
push esi
push edi
call sym.fbclient.dll_gds__thread_exit
mov esi, dword [esp + 0x10]
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x10024f15
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x10024f00
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2734
jne 0x10024f15
xor edi, edi
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x10024f00
inc edi
cmp edi, 5
jl 0x10024ee3
call sym.fbclient.dll_gds__thread_enter
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret
mov edx, dword [eax + 0xc]
lea ecx, [esp + 8]
push 4
push ecx
mov eax, dword [edx]
push eax
call fcn.10024f70
add esp, 0xc
call sym.fbclient.dll_gds__thread_enter
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret