joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e77a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0xc]
xor edx, edx
push edi
test esi, esi
jle 0x102e77cc
mov edi, dword [esp + 0xc]
movzx eax, byte [edx + edi]
add ecx, eax
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
inc edx
xor ecx, eax
cmp edx, esi
jl 0x102e77b4
mov esi, dword [esp + 0x18]
add ecx, 0x3a
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
xor ecx, eax
xor edx, edx
test esi, esi
jle 0x102e7808
mov edi, dword [esp + 0x14]
lea ebx, [ebx]
movzx eax, byte [edx + edi]
add ecx, eax
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
inc edx
xor ecx, eax
cmp edx, esi
jl 0x102e77f0
lea ecx, [ecx + ecx*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
pop edi
imul eax, eax, 0x8001
pop esi
ret
Function at 0x102f1720
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x1065f580], 0
mov dword [esp], 0x10533620
mov dword [esp + 4], 0x102f11f0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x102f14b0
mov dword [esp + 0x10], 0x10533638
mov dword [esp + 0x14], fcn.102f11a0
jne 0x102f187b
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x102f1871
push ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCR110.dll_strcpy_s]
push edi
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call esi
push str.ws2_32
lea eax, [esp + 0x38]
push 0x10c
push eax
call dword [sym.imp.MSVCR110.dll_strcat_s]
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x102f17ed
push 0x10533620
push edi
call ebx
test eax, eax
jne 0x102f1836
push edi
call ebp
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call esi
push str.wship6
lea eax, [esp + 0x38]
push 0x10c
push eax
call dword [sym.imp.MSVCR110.dll_strcat_s]
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102f186d
push 0x10533620
push edi
call ebx
test eax, eax
je 0x102f186a
xor esi, esi
push dword [esp + esi*8 + 0x10]
push edi
call ebx
mov dword [esp + esi*8 + 0x14], eax
test eax, eax
je 0x102f186a
inc esi
cmp esi, 3
jl 0x102f1838
mov eax, dword [esp + 0x14]
mov dword [0x106491e0], eax
mov eax, dword [esp + 0x1c]
mov dword [0x106491e8], eax
mov eax, dword [esp + 0x24]
mov dword [fcn.102f11a0], eax
jmp 0x102f186d
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x1065f580], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [eax*8 + 0x106491e0]
xor ecx, esp
call fcn.10311bec
add esp, 0x230
ret 4
Function at 0x102f1b00
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
push edi
mov edi, dword [esp + 0x20]
push dword [esp + 0xc]
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x102f1b90
cmp word [ebx + 8], 2
push ebp
push esi
jne 0x102f1b62
cmp word [ebx + 0xa], 4
jne 0x102f1b62
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x102f1b62
mov ebp, dword [esp + 0x1c]
push dword [eax]
push dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
call fcn.102f1a30
mov dword [edi], eax
test eax, eax
je 0x102f1b84
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x102f1b40
push 0x400
push dword [ebx]
push 0x401
push dword [esp + 0x30]
call dword [sym.imp.MSVCR110.dll_strncpy_s]
add esp, 0x10
xor eax, eax
pop esi
pop ebp
pop edi
pop ebx
ret 0x18
pop esi
pop ebp
pop edi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x102f1ba0.11001
jmp dword [eax*4 + 0x102f1bc8]
pop edi
mov eax, 0x2af9
pop ebx
ret 0x18
pop edi
mov eax, 0x2afa
pop ebx
ret 0x18
pop edi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x102f1ca0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x21c
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
push edi
mov edi, dword [esp + 0x228]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x102f1ce6
push str.socket_failed_n
push 0
push 0xa
call fcn.10269820
add esp, 0xc
jmp 0x102f1e52
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
inc eax
neg eax
sbb eax, eax
push 0x10
neg eax
push edi
dec eax
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x102f1d36
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
je 0x102f1d36
cmp eax, 0x2733
je 0x102f1d36
push str.error_connecting_to_HTTP_server
jmp 0x102f1e3f
mov eax, dword [0x106491d8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esi + 1]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x134], esi
mov dword [esp + 0x130], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x102f1e3a
test eax, eax
je 0x102f1e33
lea eax, [esp + 0x18]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x102f1dbf
lea eax, [esp + 0x11c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x102f1dbf
push str.select_failed_n
jmp 0x102f1e3f
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x1007
push 0xffff
push esi
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jns 0x102f1ded
push str.getsockopt_failed_n
jmp 0x102f1e3f
cmp dword [esp + 8], 0
je 0x102f1e1a
push str.Error_connecting_to_remote_host
push 0
push 0xa
call fcn.10269820
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.MSVCR110.dll__errno]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x102f1e52
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.10311bec
add esp, 0x21c
ret
push str.Connect_attempt_timed_out
jmp 0x102f1e3f
push str.Connect_failed
push 0
push 0xa
call fcn.10269820
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x220]
pop edi
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10311bec
add esp, 0x21c
ret
Function at 0x102f24e0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
sub esp, 0x194
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x1065f574], 0
jne 0x102f2572
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x102f2572
cmp dword [0x1065f578], eax
jne 0x102f2568
push esi
mov esi, dword [sym.imp.MSVCR110.dll_getenv]
push str.no_proxy
mov dword [0x1065f57c], 0x50
call esi
add esp, 4
test eax, eax
je 0x102f2542
cmp byte [eax], 0x2a
jne 0x102f2542
cmp byte [eax + 1], 0
je 0x102f2567
push str.http_proxy
call esi
add esp, 4
test eax, eax
jne 0x102f255e
push str.HTTP_PROXY
call esi
add esp, 4
test eax, eax
je 0x102f2567
push eax
call sym.php5.dll_xmlNanoHTTPScanProxy
add esp, 4
pop esi
mov dword [0x1065f574], 1
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
Function at 0x102f30f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x114
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
test byte [esi + 0x18], 2
je 0x102f326c
lea esp, [esp]
cmp dword [esi + 0x24], 0
jne 0x102f314f
push 0xfde8
call dword [sym.php5.dll_xmlMallocAtomic]
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
je 0x102f3287
mov dword [esi + 0x34], 0xfde8
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x30]
lea eax, [edx + 0x1000]
cmp ecx, eax
jbe 0x102f317d
mov eax, dword [esi + 0x2c]
sub eax, ecx
push eax
push ecx
mov edi, ecx
push edx
sub edi, edx
call dword [sym.imp.MSVCR110.dll_memmove]
sub dword [esi + 0x30], edi
sub dword [esi + 0x28], edi
add esp, 0xc
sub dword [esi + 0x2c], edi
mov edx, dword [esi + 0x34]
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x2c]
lea ecx, [edx + edi]
lea eax, [ebx + 0x1000]
cmp ecx, eax
jae 0x102f31d2
mov eax, dword [esi + 0x30]
mov ebp, dword [esi + 0x28]
sub eax, edi
mov dword [esp + 0x10], eax
lea eax, [edx + edx]
push eax
push edi
sub ebx, edi
sub ebp, edi
mov dword [esi + 0x34], eax
call dword [sym.php5.dll_xmlRealloc]
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x102f32a8
lea ecx, [eax + ebx]
mov dword [esi + 0x2c], ecx
lea ecx, [eax + ebp]
add eax, dword [esp + 0x10]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], eax
push 0
push 0x1000
push dword [esi + 0x2c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [esi + 0x38], eax
test eax, eax
jg 0x102f32eb
je 0x102f326c
cmp eax, 0xffffffff
jne 0x102f321c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
jg 0x102f3211
je 0x102f321c
cmp eax, 0xb
je 0x102f321c
cmp eax, 0x6c
jmp 0x102f32d3
sub eax, 0x2733
jne 0x102f32d0
mov eax, dword [0x106491d8]
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x14]
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], eax
push ecx
inc eax
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jge 0x102f3262
call dword [sym.imp.MSVCR110.dll__errno]
cmp dword [eax], 4
jne 0x102f326c
test byte [esi + 0x18], 2
jne 0x102f3120
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
push str.allocating_input
push 0
push 0
push 2
push 0xa
call fcn.10261340
add esp, 0x14
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x102f326e
push str.allocating_input_buffer
push 0
push 0
push 2
push 0xa
call fcn.10261340
push edi
call dword [sym.php5.dll_xmlFree]
add esp, 0x18
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x102f326e
sub eax, 0x17
je 0x102f326c
push str.recv_failed_n
push 0
push 0xa
call fcn.10269820
add esp, 0xc
or eax, 0xffffffff
jmp 0x102f326e
add dword [esi + 0x2c], eax
jmp 0x102f326e
Function at 0x102f3a10
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x114
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x110], eax
mov ecx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
test byte [ebp + 0x18], 1
mov dword [esp + 8], ecx
je 0x102f3b22
test ecx, ecx
je 0x102f3b22
push edi
mov edi, dword [esp + 0x12c]
test edi, edi
jle 0x102f3b08
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [ecx + esi]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x102f3a7f
add esi, eax
jmp 0x102f3aca
cmp eax, 0xffffffff
jne 0x102f3a94
call ebx
cmp eax, 0xb
je 0x102f3a94
call ebx
cmp eax, 0x2733
jne 0x102f3ad4
mov eax, dword [0x106491d8]
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], eax
push 0
inc eax
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
cmp esi, edi
jge 0x102f3aed
mov ecx, dword [esp + 0x10]
jmp 0x102f3a63
push str.send_failed_n
push 0
push 0xa
call fcn.10269820
or eax, 0xffffffff
add esp, 0xc
test esi, esi
cmove esi, eax
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
Function at 0x102f3b40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x114
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x110], eax
push edi
mov edi, dword [esp + 0x11c]
test edi, edi
je 0x102f3d35
mov eax, dword [edi + 0x2c]
cmp eax, 0xffffffff
je 0x102f3d35
lea ecx, [esp + 8]
push ecx
push 0
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
push ecx
inc eax
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x102f3d24
test eax, eax
je 0x102f3d0c
cmp dword [edi + 0x2c], 0xffffffff
push ebx
push ebp
push esi
mov dword [esp + 0x10], 0xffffffff
je 0x102f3cf0
push edi
call fcn.102f4c90
add esp, 4
test eax, eax
js 0x102f3cf0
mov ebp, dword [edi + 0x444]
test ebp, ebp
jne 0x102f3beb
test eax, eax
je 0x102f3cf0
mov eax, dword [edi + 0x440]
add eax, 0x3c
lea esi, [edi + 0x3c]
add eax, edi
add esi, ebp
cmp eax, esi
jae 0x102f3c7f
mov ecx, esi
sub ecx, eax
cmp ecx, 3
jl 0x102f3c60
mov cl, byte [eax]
cmp cl, 0x30
jl 0x102f3c60
cmp cl, 0x39
jg 0x102f3c60
mov bl, byte [eax + 1]
movsx ecx, cl
sub ecx, 0x30
cmp bl, 0x30
jl 0x102f3c60
cmp bl, 0x39
jg 0x102f3c60
lea edx, [ecx + ecx*4]
movsx ecx, bl
lea edx, [edx - 0x18]
lea edx, [ecx + edx*2]
mov cl, byte [eax + 2]
cmp cl, 0x30
jl 0x102f3c60
cmp cl, 0x39
jg 0x102f3c60
movsx ecx, cl
lea edx, [edx + edx*4]
lea ecx, [ecx + edx*2]
add ecx, 0xffffffd0
cmp byte [eax + 3], 0x2d
jne 0x102f3c58
neg ecx
test ecx, ecx
jg 0x102f3cc0
lea esp, [esp]
cmp byte [eax], 0xa
je 0x102f3c75
inc eax
cmp eax, esi
jb 0x102f3c60
mov dword [edi + 0x440], ebp
jmp 0x102f3bc8
cmp byte [eax], 0xd
je 0x102f3c7b
inc eax
cmp eax, esi
jb 0x102f3c03
mov ebp, dword [esp + 0x10]
test ebp, ebp
js 0x102f3bc8
sub eax, edi
sub eax, 0x3c
mov dword [edi + 0x440], eax
mov eax, 0x51eb851f
imul ebp
pop esi
sar edx, 5
pop ebp
mov eax, edx
shr eax, 0x1f
pop ebx
add eax, edx
pop edi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
mov dword [esp + 0x10], ecx
add eax, 3
mov ecx, eax
sub ecx, edi
sub ecx, 0x3c
mov dword [edi + 0x448], ecx
cmp eax, esi
jae 0x102f3ce2
cmp byte [eax], 0xa
je 0x102f3ce7
inc eax
cmp eax, esi
jb 0x102f3cd8
cmp byte [eax], 0xa
jne 0x102f3ce8
inc eax
cmp byte [eax], 0xd
jne 0x102f3c7f
inc eax
jmp 0x102f3c7f
pop esi
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
xor eax, eax
pop edi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10311bec
add esp, 0x114
ret
push str.select
push 0
push 9
call fcn.10269820
add esp, 0xc
mov ecx, dword [esp + 0x114]
pop edi
xor ecx, esp
or eax, 0xffffffff
call fcn.10311bec
add esp, 0x114
ret
Function at 0x102f3e20
Capabilities:
Get socket status

Disassembly:
sub esp, 0x214
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
test esi, esi
je 0x102f3f0d
cmp dword [esi + 0x2c], 0xffffffff
je 0x102f3f0d
push edi
push dword [esi + 0x30]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
call edi
mov eax, dword [esi + 0x2c]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0
lea ecx, [esp + 0x120]
mov dword [esp + 0x124], eax
mov dword [esp + 0x20], eax
push ecx
inc eax
push eax
mov dword [esi + 0x30], 0xffffffff
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x20], 0
mov dword [esp + 0x128], 1
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x102f3ee7
jne 0x102f3ed9
push dword [esi + 0x2c]
call edi
mov dword [esi + 0x2c], 0xffffffff
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10311bec
add esp, 0x214
ret
push esi
call fcn.102f59a0
add esp, 4
cmp eax, 2
je 0x102f3ec0
push dword [esi + 0x2c]
call edi
pop edi
mov dword [esi + 0x2c], 0xffffffff
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10311bec
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10311bec
add esp, 0x214
ret
Function at 0x102f44b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x194
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
push esi
mov esi, dword [esp + 0x19c]
test esi, esi
je 0x102f45d4
cmp dword [esi + 0x2c], 0xffffffff
je 0x102f45d4
test eax, eax
jne 0x102f44ff
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
push eax
push str.CWD__s_r_n
lea eax, [esp + 0xc]
push 0x190
push eax
call dword [sym.imp.MSVCR110.dll__snprintf]
lea ecx, [esp + 0x14]
add esp, 0x10
mov byte [esp + 0x193], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x102f4527
push edi
push 0
sub ecx, edx
push ecx
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x102f4572
push str.send_failed
push 0
push 9
call fcn.10269820
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
push esi
call fcn.102f59a0
add esp, 4
cmp eax, 4
jne 0x102f459a
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
cmp eax, 2
jne 0x102f45bb
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10311bec
add esp, 0x194
ret

Function at 0x102f45f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x194
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
push esi
mov esi, dword [esp + 0x19c]
test esi, esi
je 0x102f4702
cmp dword [esi + 0x2c], 0xffffffff
je 0x102f4702
test eax, eax
je 0x102f4702
push eax
push str.DELE__s_r_n
lea eax, [esp + 0xc]
push 0x190
push eax
call dword [sym.imp.MSVCR110.dll__snprintf]
lea ecx, [esp + 0x14]
add esp, 0x10
mov byte [esp + 0x193], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x102f4655
push edi
push 0
sub ecx, edx
push ecx
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x102f46a0
push str.send_failed
push 0
push 9
call fcn.10269820
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
push esi
call fcn.102f59a0
add esp, 4
cmp eax, 4
jne 0x102f46c8
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
cmp eax, 2
jne 0x102f46e9
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10311bec
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10311bec
add esp, 0x194
ret
Function at 0x102f47a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x1110
call fcn.10312230
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x110c], eax
mov eax, dword [esp + 0x1120]
push ebx
mov ebx, dword [esp + 0x111c]
push ebp
mov ebp, dword [esp + 0x1124]
push esi
mov esi, dword [esp + 0x1120]
push edi
xor edi, edi
test esi, esi
je 0x102f48fa
test eax, eax
jne 0x102f47ef
cmp dword [esi + 0xc], edi
je 0x102f48fa
test ebx, ebx
je 0x102f48fa
push eax
push esi
call sym.php5.dll_xmlNanoFTPGetSocket
add esp, 8
cmp eax, 0xffffffff
je 0x102f48fa
lea ebx, [ebx]
mov eax, dword [esi + 0x30]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], eax
push ecx
inc eax
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x102f48ea
jne 0x102f487c
push esi
call sym.php5.dll_xmlNanoFTPCheckResponse
add esp, 4
test eax, eax
js 0x102f48ea
cmp eax, 2
jne 0x102f48a9
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov dword [esi + 0x30], 0xffffffff
jmp 0x102f48fd
push 0
push 0x1000
lea eax, [esp + 0x124]
push eax
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
js 0x102f48bc
push edi
lea eax, [esp + 0x120]
push eax
push ebp
call ebx
add esp, 0xc
test edi, edi
jne 0x102f4810
push esi
call sym.php5.dll_xmlNanoFTPCloseConnection
add esp, 4
jmp 0x102f48fd
push str.recv_failed
push 0
push 9
call fcn.10269820
push edi
lea eax, [esp + 0x12c]
push eax
push ebp
call ebx
add esp, 0x18
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
jmp 0x102f48fd
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [esp + 0x111c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10311bec
add esp, 0x1110
ret
Function at 0x102f4c90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x102f4d5c
cmp dword [esi + 0x2c], 0xffffffff
je 0x102f4d5c
mov eax, dword [esi + 0x440]
test eax, eax
js 0x102f4d5c
cmp eax, 0x400
jg 0x102f4d5c
mov ecx, dword [esi + 0x444]
test ecx, ecx
js 0x102f4d5c
cmp ecx, 0x400
jg 0x102f4d5c
cmp eax, ecx
jg 0x102f4d5c
test eax, eax
jle 0x102f4d0e
sub ecx, eax
add eax, 0x3c
push ecx
add eax, esi
push eax
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
mov eax, dword [esi + 0x440]
add esp, 0xc
sub dword [esi + 0x444], eax
mov dword [esi + 0x440], 0
mov eax, 0x400
sub eax, dword [esi + 0x444]
jne 0x102f4d1d
pop esi
ret
push 0
push eax
mov eax, dword [esi + 0x440]
add eax, 0x3c
add eax, esi
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
test ecx, ecx
jns 0x102f4d61
push str.recv_failed
push 0
push 9
call fcn.10269820
add esp, 0xc
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x2c], 0xffffffff
or eax, 0xffffffff
pop esi
ret
add dword [esi + 0x444], ecx
mov eax, dword [esi + 0x444]
mov byte [eax + esi + 0x3c], 0
mov eax, ecx
pop esi
ret

Function at 0x102f4d90
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x130
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
mov esi, dword [esp + 0x138]
push edi
mov edi, dword [esp + 0x140]
test esi, esi
jne 0x102f4dd2
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.10311bec
add esp, 0x130
ret
test edi, edi
jne 0x102f4ddb
cmp dword [esi + 0xc], edi
je 0x102f4db8
push esi
call sym.php5.dll_xmlNanoFTPGetConnection
add esp, 4
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
je 0x102f4db8
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll__snprintf]
push str.TYPE_I_r_n
lea eax, [esp + 0x10]
push 0x12c
push eax
call ebx
lea ecx, [esp + 0x18]
add esp, 0xc
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x102f4e10
push 0
sub ecx, edx
push ecx
lea eax, [esp + 0x14]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x102f4e8e
push esi
call fcn.102f59a0
add esp, 4
cmp eax, 2
jne 0x102f4e9f
lea eax, [esp + 0xc]
test edi, edi
jne 0x102f4e49
push dword [esi + 0xc]
jmp 0x102f4e4a
push edi
push str.RETR__s_r_n
push 0x12c
push eax
call ebx
lea ecx, [esp + 0x1c]
add esp, 0x10
mov byte [esp + 0x137], 0
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x102f4e70
push 0
sub ecx, edx
push ecx
lea eax, [esp + 0x14]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x102f4eca
push str.send_failed
push 0
push 9
call fcn.10269820
add esp, 0xc
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
mov dword [esi + 0x30], 0xffffffff
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.10311bec
add esp, 0x130
ret
push esi
call fcn.102f59a0
add esp, 4
cmp eax, 1
jne 0x102f4e9f
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x138]
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.10311bec
add esp, 0x130
ret