I try to analyze malware since a few months and by examining the assembly code of a trojan for example, I see sometimes windows functions like
ws2_32.send which is the
send()-function, etc. That is not a problem to understand, I can go to:
and read that, everything is okay.
But I ask myself, how the people who writes that code put that function in their code. I mean, can you for example write in a C code the function
int send( __in SOCKET s, __in const char *buf, __in int len, __in int flags);
and is it then so that the C compiler understands it ?
There are some other functions like
CopyFileA for example which looks like:
BOOL WINAPI CopyFile( _In_ LPCTSTR lpExistingFileName, _In_ LPCTSTR lpNewFileName, _In_ BOOL bFailIfExists );
Here I ask myself how the compiler understand the word
"WINAPI" for example and so on.
In general, if the people try to write such code to create a trojan, how they make clear that it should be a windows function?