joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016450
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x10016458
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov dl, 1
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x61
jl 0x1001646e
cmp al, 0x7a
jle 0x10016555
cmp al, 0x41
jl 0x1001647a
cmp al, 0x5a
jle 0x10016555
cmp al, 0x30
jl 0x10016486
cmp al, 0x39
jle 0x10016555
cmp al, 0x2d
je 0x10016555
cmp al, 0x2e
je 0x10016555
cmp al, 0x5f
je 0x10016555
cmp al, 0x7e
je 0x10016555
cmp al, 0x25
jne 0x100164ec
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100164b7
cmp cl, 0x39
jle 0x100164cb
cmp cl, 0x61
jl 0x100164c1
cmp cl, 0x66
jle 0x100164cb
cmp cl, 0x41
jl 0x100164ec
cmp cl, 0x46
jg 0x100164ec
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100164d8
cmp cl, 0x39
jle 0x10016555
cmp cl, 0x61
jl 0x100164e2
cmp cl, 0x66
jle 0x10016555
cmp cl, 0x41
jl 0x100164ec
cmp cl, 0x46
jle 0x10016555
cmp al, 0x21
je 0x10016555
cmp al, 0x24
je 0x10016555
cmp al, 0x26
je 0x10016555
cmp al, 0x28
je 0x10016555
cmp al, 0x29
je 0x10016555
cmp al, 0x2a
je 0x10016555
cmp al, 0x2b
je 0x10016555
cmp al, 0x2c
je 0x10016555
cmp al, 0x3b
je 0x10016555
cmp al, 0x3d
je 0x10016555
cmp al, 0x27
je 0x10016555
cmp al, 0x3a
je 0x10016555
cmp al, 0x40
je 0x10016555
cmp al, 0x2f
je 0x10016555
cmp al, 0x3f
je 0x10016555
test edi, edi
je 0x100165c7
test byte [edi + 0x24], dl
je 0x10016567
cmp al, 0x7b
je 0x10016555
cmp al, 0x7d
je 0x10016555
cmp al, 0x7c
je 0x10016555
cmp al, 0x5c
je 0x10016555
cmp al, 0x5e
je 0x10016555
cmp al, 0x5b
je 0x10016555
cmp al, 0x5d
je 0x10016555
cmp al, 0x60
jne 0x10016567
cmp al, 0x25
jne 0x10016561
add esi, 3
jmp 0x10016460
inc esi
jmp 0x10016460
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10016578
push eax
call dword [0x102d00c0]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x10016590
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.1000ac60
add esp, 8
jmp 0x100165a0
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.10015fb0
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x100165b4
push eax
call dword [0x102d00c0]
add esp, 4
mov eax, dword [ebx]
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.1000ac60
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x100165d0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x100165e1
cmp al, 0x7a
jle 0x10016683
cmp al, 0x41
jl 0x100165ed
cmp al, 0x5a
jle 0x10016683
cmp al, 0x30
jl 0x100165f9
cmp al, 0x39
jle 0x10016683
cmp al, 0x2d
je 0x10016683
cmp al, 0x2e
je 0x10016683
cmp al, 0x5f
je 0x10016683
cmp al, 0x7e
je 0x10016683
cmp al, 0x25
jne 0x10016653
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x1001661e
cmp cl, 0x39
jle 0x10016632
cmp cl, 0x61
jl 0x10016628
cmp cl, 0x66
jle 0x10016632
cmp cl, 0x41
jl 0x10016653
cmp cl, 0x46
jg 0x10016653
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x1001663f
cmp cl, 0x39
jle 0x10016683
cmp cl, 0x61
jl 0x10016649
cmp cl, 0x66
jle 0x10016683
cmp cl, 0x41
jl 0x10016653
cmp cl, 0x46
jle 0x10016683
cmp al, 0x21
je 0x10016683
cmp al, 0x24
je 0x10016683
cmp al, 0x26
je 0x10016683
cmp al, 0x28
je 0x10016683
cmp al, 0x29
je 0x10016683
cmp al, 0x2a
je 0x10016683
cmp al, 0x2b
je 0x10016683
cmp al, 0x2c
je 0x10016683
cmp al, 0x3b
je 0x10016683
cmp al, 0x3d
je 0x10016683
cmp al, 0x27
je 0x10016683
cmp al, 0x3a
jne 0x10016695
cmp al, 0x25
jne 0x1001668f
add esi, 3
jmp 0x100165d3
inc esi
jmp 0x100165d3
cmp byte [esi], 0x40
jne 0x100166e7
test edi, edi
je 0x100166e1
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100166af
push eax
call dword [0x102d00c0]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x100166ce
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.1000ac60
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.10015fb0
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x100166f0
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov al, byte [edi]
cmp al, 0x5b
mov dword [esp + 0x10], edi
mov ebx, edi
jne 0x10016735
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
je 0x1001671f
test al, al
je 0x10016725
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
jne 0x10016713
inc edi
jmp 0x1001684e
cmp byte [edi], 0x5d
je 0x1001671f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp al, 0x30
jl 0x10016790
cmp al, 0x39
jg 0x10016790
lea esi, [esp + 0x10]
call fcn.10014e20
test eax, eax
jne 0x10016790
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x2e
jne 0x10016790
mov edx, ecx
inc edx
mov dword [esp + 0x10], edx
call fcn.10014e20
test eax, eax
jne 0x10016790
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x10016790
call fcn.10014e20
test eax, eax
jne 0x10016790
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x10016790
call fcn.10014e20
test eax, eax
je 0x1001684a
jmp 0x10016790
mov al, byte [edi]
cmp al, 0x61
jl 0x1001679e
cmp al, 0x7a
jle 0x10016838
cmp al, 0x41
jl 0x100167aa
cmp al, 0x5a
jle 0x10016838
cmp al, 0x30
jl 0x100167b6
cmp al, 0x39
jle 0x10016838
cmp al, 0x2d
je 0x10016838
cmp al, 0x2e
je 0x10016838
cmp al, 0x5f
je 0x10016838
cmp al, 0x7e
je 0x10016838
cmp al, 0x25
jne 0x1001680c
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x100167d7
cmp cl, 0x39
jle 0x100167eb
cmp cl, 0x61
jl 0x100167e1
cmp cl, 0x66
jle 0x100167eb
cmp cl, 0x41
jl 0x1001680c
cmp cl, 0x46
jg 0x1001680c
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x100167f8
cmp cl, 0x39
jle 0x10016838
cmp cl, 0x61
jl 0x10016802
cmp cl, 0x66
jle 0x10016838
cmp cl, 0x41
jl 0x1001680c
cmp cl, 0x46
jle 0x10016838
cmp al, 0x21
je 0x10016838
cmp al, 0x24
je 0x10016838
cmp al, 0x26
je 0x10016838
cmp al, 0x28
je 0x10016838
cmp al, 0x29
je 0x10016838
cmp al, 0x2a
je 0x10016838
cmp al, 0x2b
je 0x10016838
cmp al, 0x2c
je 0x10016838
cmp al, 0x3b
je 0x10016838
cmp al, 0x3d
je 0x10016838
cmp al, 0x27
jne 0x1001684e
cmp al, 0x25
jne 0x10016844
add edi, 3
jmp 0x10016790
inc edi
jmp 0x10016790
mov edi, dword [esp + 0x10]
xor esi, esi
cmp ebp, esi
je 0x100168c5
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x10016865
push eax
call dword [0x102d00c0]
add esp, 4
mov eax, dword [ebp + 0xc]
cmp eax, esi
mov dword [ebp + 8], esi
je 0x10016879
push eax
call dword [0x102d00c0]
add esp, 4
cmp edi, ebx
je 0x100168c2
test byte [ebp + 0x24], 2
je 0x100168a2
mov ecx, edi
sub ecx, ebx
push ecx
push ebx
call fcn.1000ac60
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, edi
push esi
sub edx, ebx
push edx
push ebx
call fcn.10015fb0
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10016c50
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [ebx]
push edi
mov edi, eax
mov al, byte [esi]
cmp al, 0x2f
mov dword [esp + 8], esi
jne 0x10016cb8
cmp byte [esi + 1], 0x2f
lea eax, [esp + 8]
push eax
jne 0x10016ca4
add esi, 2
mov eax, edi
mov dword [esp + 0xc], esi
call fcn.100168e0
add esp, 4
test eax, eax
jne 0x10016db3
lea ecx, [esp + 8]
push ecx
call fcn.10016960
add esp, 4
test eax, eax
jne 0x10016db3
mov edx, dword [esp + 8]
pop edi
mov dword [ebx], edx
pop esi
pop ecx
ret
call fcn.10016a00
add esp, 4
test eax, eax
je 0x10016dab
pop edi
pop esi
pop ecx
ret
cmp al, 0x61
jl 0x10016cc4
cmp al, 0x7a
jle 0x10016d9a
cmp al, 0x41
jl 0x10016cd0
cmp al, 0x5a
jle 0x10016d9a
cmp al, 0x30
jl 0x10016cdc
cmp al, 0x39
jle 0x10016d9a
cmp al, 0x2d
je 0x10016d9a
cmp al, 0x2e
je 0x10016d9a
cmp al, 0x5f
je 0x10016d9a
cmp al, 0x7e
je 0x10016d9a
cmp al, 0x25
jne 0x10016d42
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10016d0d
cmp cl, 0x39
jle 0x10016d21
cmp cl, 0x61
jl 0x10016d17
cmp cl, 0x66
jle 0x10016d21
cmp cl, 0x41
jl 0x10016d42
cmp cl, 0x46
jg 0x10016d42
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10016d2e
cmp cl, 0x39
jle 0x10016d9a
cmp cl, 0x61
jl 0x10016d38
cmp cl, 0x66
jle 0x10016d9a
cmp cl, 0x41
jl 0x10016d42
cmp cl, 0x46
jle 0x10016d9a
cmp al, 0x21
je 0x10016d9a
cmp al, 0x24
je 0x10016d9a
cmp al, 0x26
je 0x10016d9a
cmp al, 0x28
je 0x10016d9a
cmp al, 0x29
je 0x10016d9a
cmp al, 0x2a
je 0x10016d9a
cmp al, 0x2b
je 0x10016d9a
cmp al, 0x2c
je 0x10016d9a
cmp al, 0x3b
je 0x10016d9a
cmp al, 0x3d
je 0x10016d9a
cmp al, 0x27
je 0x10016d9a
cmp al, 0x3a
je 0x10016d9a
cmp al, 0x40
je 0x10016d9a
test edi, edi
je 0x10016daf
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10016d8b
push eax
call dword [0x102d00c0]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.10016ad0
add esp, 4
test eax, eax
jne 0x10016db3
mov esi, dword [esp + 8]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x10016dc0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, eax
mov al, byte [ebx]
cmp al, 0x2f
jne 0x10016e22
cmp byte [ebx + 1], 0x2f
jne 0x10016e0a
lea eax, [esp + 0xc]
push eax
add ebx, 2
mov eax, edi
mov dword [esp + 0x10], ebx
call fcn.100168e0
add esp, 4
test eax, eax
jne 0x10016f61
lea ecx, [esp + 0xc]
push ecx
call fcn.10016960
add esp, 4
test eax, eax
je 0x10016f0f
pop edi
pop ebx
ret
lea edx, [esp + 0xc]
push edx
call fcn.10016a00
add esp, 4
test eax, eax
je 0x10016f0f
pop edi
pop ebx
ret
cmp al, 0x61
jl 0x10016e2e
cmp al, 0x7a
jle 0x10016efe
cmp al, 0x41
jl 0x10016e3a
cmp al, 0x5a
jle 0x10016efe
cmp al, 0x30
jl 0x10016e46
cmp al, 0x39
jle 0x10016efe
cmp al, 0x2d
je 0x10016efe
cmp al, 0x2e
je 0x10016efe
cmp al, 0x5f
je 0x10016efe
cmp al, 0x7e
je 0x10016efe
cmp al, 0x25
jne 0x10016eac
mov cl, byte [ebx + 1]
cmp cl, 0x30
jl 0x10016e77
cmp cl, 0x39
jle 0x10016e8b
cmp cl, 0x61
jl 0x10016e81
cmp cl, 0x66
jle 0x10016e8b
cmp cl, 0x41
jl 0x10016eac
cmp cl, 0x46
jg 0x10016eac
mov cl, byte [ebx + 2]
cmp cl, 0x30
jl 0x10016e98
cmp cl, 0x39
jle 0x10016efe
cmp cl, 0x61
jl 0x10016ea2
cmp cl, 0x66
jle 0x10016efe
cmp cl, 0x41
jl 0x10016eac
cmp cl, 0x46
jle 0x10016efe
cmp al, 0x21
je 0x10016efe
cmp al, 0x24
je 0x10016efe
cmp al, 0x26
je 0x10016efe
cmp al, 0x28
je 0x10016efe
cmp al, 0x29
je 0x10016efe
cmp al, 0x2a
je 0x10016efe
cmp al, 0x2b
je 0x10016efe
cmp al, 0x2c
je 0x10016efe
cmp al, 0x3b
je 0x10016efe
cmp al, 0x3d
je 0x10016efe
cmp al, 0x27
je 0x10016efe
cmp al, 0x3a
je 0x10016efe
cmp al, 0x40
je 0x10016efe
test edi, edi
je 0x10016f13
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10016ef5
push eax
call dword [0x102d00c0]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x10016f13
lea eax, [esp + 0xc]
push eax
call fcn.10016b90
add esp, 4
test eax, eax
jne 0x10016f61
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x3f
jne 0x10016f2e
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.10016450
test eax, eax
jne 0x10016f61
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x23
jne 0x10016f49
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.100162f0
test eax, eax
jne 0x10016f61
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0
je 0x10016f5f
push esi
mov esi, edi
call fcn.10015cb0
pop esi
pop edi
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop ebx
ret
Function at 0x10022010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [edx], ch
lea eax, [ebp - 0x58]
push eax
call fcn.10021d7b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10021d30
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10022059
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10021d6b
sar byte [eax + ecx*2 + 0x40], 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x100220c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10021d6b
or dl, byte [edx + 0x458ddb8c]
call 0x60ea7e61
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10021d7b
push eax
push esi
push dword [ebp + 8]
call fcn.10021d30
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
sahf
sub eax, 0x119f45c6

Function at 0x10031640
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x102d8230]
test eax, eax
jne 0x1003169e
push 0x102d8234
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x1003167a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x102d0540], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x102d822c], eax
mov dword [0x102d8230], 1
ret
mov eax, dword [0x102d8230]
test eax, eax
jne 0x1003169e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0
call esi
mov eax, dword [0x102d8230]
test eax, eax
je 0x10031690
pop esi
ret
Function at 0x100316a0
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
call fcn.10031640
mov eax, dword [0x102d0540]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10031751
push esi
call fcn.100315a0
mov esi, eax
test esi, esi
jne 0x100316c7
pop esi
ret
push edi
push 8
call dword [sym.imp.MSVCR120.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1003170a
call fcn.1000aa40
mov edi, eax
call fcn.1000aa80
mov ecx, dword [eax]
push str.xmlGetGlobalState:_out_of_memory_n
push ecx
call dword [edi]
lea edx, [esi + 0x1c4]
push edx
call fcn.10008f10
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 0x10
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0
push edi
mov dword [edi + 4], esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x102d0540]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push 0
push 0x100315f0
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x10037de0
Capabilities:
Get socket status

Disassembly:
mov al, byte [edi + 0x18]
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x118]
push esi
xor esi, esi
test al, 1
je 0x10037ec6
mov eax, dword [esp + 0x118]
test eax, eax
je 0x10037ec6
test ebp, ebp
jle 0x10037ec6
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_send]
lea ebx, [ebx]
mov ecx, dword [esp + 0x11c]
push 0
mov eax, ebp
sub eax, esi
push eax
mov eax, dword [edi + 0x14]
lea edx, [esi + ecx]
push edx
push eax
call ebx
test eax, eax
jle 0x10037e40
add esi, eax
jmp 0x10037e94
cmp eax, 0xffffffff
jne 0x10037e5d
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0xb
je 0x10037e5d
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10037ea4
mov ecx, dword [0x102d0690]
mov eax, dword [edi + 0x14]
lea edx, [esp + 0xc]
push edx
push 0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], eax
push 0
inc eax
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp esi, ebp
jl 0x10037e20
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0x10c
ret
push str.send_failed_n
push 0
push 0xa
call fcn.10017850
add esp, 0xc
test esi, esi
jne 0x10037e98
pop ebx
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x10c
ret
mov eax, esi
pop esi
pop ebp
add esp, 0x10c
ret
Function at 0x10037ee0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov al, byte [esi + 0x18]
sub esp, 0x110
test al, 2
push ebx
push ebp
push edi
je 0x10038062
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x10037f24
push 0xfde8
call dword [0x102d00c8]
add esp, 4
test eax, eax
mov dword [esi + 0x24], eax
je 0x1003806e
mov dword [esi + 0x34], 0xfde8
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x30]
lea edx, [ecx + 0x1000]
cmp eax, edx
jbe 0x10037f61
mov edx, dword [esi + 0x2c]
sub edx, eax
push edx
push eax
mov edi, eax
push ecx
sub edi, ecx
call dword [sym.imp.MSVCR120.dll_memmove]
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
sub edx, edi
sub ecx, edi
add esp, 0xc
sub eax, edi
mov dword [esi + 0x30], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x34]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
lea edx, [ecx + edi]
lea ebx, [eax + 0x1000]
cmp edx, ebx
jae 0x10037fb8
mov ebp, dword [esi + 0x28]
mov ebx, dword [esi + 0x30]
sub eax, edi
mov dword [esp + 0xc], eax
lea eax, [ecx + ecx]
push eax
push edi
sub ebp, edi
sub ebx, edi
mov dword [esi + 0x34], eax
call dword [0x102d00cc]
add esp, 8
test eax, eax
mov dword [esi + 0x24], eax
je 0x10038093
mov ecx, dword [esp + 0xc]
lea edx, [eax + ecx]
lea ecx, [eax + ebp]
add eax, ebx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], eax
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x14]
push 0
push 0x1000
push edx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
mov dword [esi + 0x38], eax
jg 0x100380bf
je 0x10038062
cmp eax, 0xffffffff
jne 0x10038011
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2746
jg 0x100380d1
je 0x10038062
cmp eax, 0xb
je 0x10038011
cmp eax, 0x2732
jle 0x100380d8
cmp eax, 0x2734
jg 0x100380d8
mov ecx, dword [0x102d0690]
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x10]
push edx
push 0
mov dword [esp + 0x18], ecx
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], eax
push ecx
inc eax
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 1
jge 0x10038058
call dword [sym.imp.MSVCR120.dll__errno]
cmp dword [eax], 4
jne 0x10038062
test byte [esi + 0x18], 2
jne 0x10037ef4
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
push str.allocating_input
push 0
push 0
push 2
push 0xa
call fcn.10009550
add esp, 0x14
pop edi
or eax, 0xffffffff
pop ebp
mov dword [esi + 0x38], eax
pop ebx
add esp, 0x110
ret
push str.allocating_input_buffer
push 0
push 0
push 2
push 0xa
call fcn.10009550
push edi
call dword [0x102d00c0]
add esp, 0x18
pop edi
or eax, 0xffffffff
pop ebp
mov dword [esi + 0x38], eax
pop ebx
add esp, 0x110
ret
mov ecx, dword [esi + 0x2c]
pop edi
add ecx, eax
pop ebp
mov dword [esi + 0x2c], ecx
pop ebx
add esp, 0x110
ret
cmp eax, 0x274a
je 0x10038062
push str.recv_failed_n
push 0
push 0xa
call fcn.10017850
add esp, 0xc
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x110
ret
Function at 0x10038650
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status

Disassembly:
sub esp, 0x218
push esi
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10038685
push str.socket_failed_n
push 0
push 0xa
call fcn.10017850
add esp, 0xc
or eax, esi
pop esi
add esp, 0x218
ret
lea eax, [esp + 8]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
mov edx, dword [esp + 0x220]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push 0x10
push edx
push esi
dec ecx
mov dword [esp + 0x10], ecx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x100386df
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jl 0x100386d5
cmp eax, 0x2734
jle 0x100386df
push str.error_connecting_to_HTTP_server
jmp 0x100387f8
mov eax, dword [0x102d0690]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
je 0x100387f3
test eax, eax
je 0x100387ec
lea edx, [esp + 0x14]
push edx
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x10038768
lea eax, [esp + 0x118]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x10038768
push str.select_failed_n
jmp 0x100387f8
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0x1007
push 0xffff
push esi
mov dword [esp + 0x1c], 4
call dword [sym.imp.WSOCK32.dll_getsockopt]
test eax, eax
jge 0x100387ab
push str.getsockopt_failed_n
push 0
push 0xa
call fcn.10017850
add esp, 0xc
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x100387e2
push str.Error_connecting_to_remote_host
push 0
push 0xa
call fcn.10017850
add esp, 0xc
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
call dword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
mov eax, esi
pop esi
add esp, 0x218
ret
push str.Connect_attempt_timed_out
jmp 0x100387f8
push str.Connect_failed
push 0
push 0xa
call fcn.10017850
add esp, 0xc
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x218
ret