joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012590
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, eax
mov esi, ecx
je 0x100126da
mov cl, byte [edx]
movzx eax, cl
imul eax, eax, 0x1e
test cl, cl
je 0x100125d6
mov ebx, eax
mov ebp, eax
shl ebx, 5
shr ebp, 3
movsx ecx, cl
add ebx, ebp
inc edx
add ebx, ecx
mov cl, byte [edx]
xor eax, ebx
test cl, cl
jne 0x100125b4
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x1001260e
mov cl, byte [esi]
test cl, cl
je 0x1001260e
mov edx, eax
mov ebp, eax
shl edx, 5
shr ebp, 3
movsx ecx, cl
add edx, ebp
inc esi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x100125f0
mov ebp, dword [esp + 0x1c]
test edi, edi
je 0x10012642
mov cl, byte [edi]
test cl, cl
je 0x10012632
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc edi
add edx, ecx
mov cl, byte [edi]
xor eax, edx
test cl, cl
jne 0x10012618
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test ebx, ebx
je 0x1001266a
mov cl, byte [ebx]
test cl, cl
je 0x1001266a
lea esp, [esp]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x10012650
test ebp, ebp
je 0x100126a0
mov cl, byte [ebp]
test cl, cl
je 0x10012690
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebp
add edx, ecx
mov cl, byte [ebp]
xor eax, edx
test cl, cl
jne 0x10012675
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x20]
test edx, edx
je 0x100126ca
mov cl, byte [edx]
test cl, cl
je 0x100126ca
mov edi, edi
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x100126b0
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret
movzx eax, byte [esi]
imul eax, eax, 0x1e
jmp 0x100125e6
Function at 0x1001e5d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
test esi, esi
je 0x1001e6ae
mov ecx, dword [esi + 0x440]
test ecx, ecx
jl 0x1001e6ae
cmp ecx, 0x400
jg 0x1001e6ae
mov eax, dword [esi + 0x444]
test eax, eax
jl 0x1001e6ae
cmp eax, 0x400
jg 0x1001e6ae
cmp ecx, eax
jg 0x1001e6ae
test ecx, ecx
jle 0x1001e64a
sub eax, ecx
push eax
lea eax, [ecx + esi + 0x3c]
push eax
lea ecx, [esi + 0x3c]
push ecx
call dword [sym.imp.msvcrt.dll_memmove]
mov edx, dword [esi + 0x440]
mov eax, dword [esi + 0x444]
add esp, 0xc
sub eax, edx
mov dword [esi + 0x444], eax
mov dword [esi + 0x440], 0
mov ecx, dword [esi + 0x444]
mov eax, 0x400
sub eax, ecx
jne 0x1001e65c
xor eax, eax
ret
mov edx, dword [esi + 0x2c]
push 0
push eax
mov eax, dword [esi + 0x440]
lea ecx, [eax + esi + 0x3c]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jge 0x1001e69a
push str.recv_failed
push 0
push 9
call fcn.100651c0
mov eax, dword [esi + 0x2c]
add esp, 0xc
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x2c], eax
ret
mov ecx, dword [esi + 0x444]
add ecx, eax
mov dword [esi + 0x444], ecx
mov byte [ecx + esi + 0x3c], 0
ret
or eax, 0xffffffff
ret

Function at 0x1001e810
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push esi
mov esi, dword [esp + 0x114]
test esi, esi
je 0x1001e88a
mov eax, dword [esi + 0x2c]
lea ecx, [esp + 4]
push ecx
push 0
push 0
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
push edx
inc eax
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
je 0x1001e879
test eax, eax
je 0x1001e86f
mov eax, esi
call fcn.1001e6c0
pop esi
add esp, 0x10c
ret
xor eax, eax
pop esi
add esp, 0x10c
ret
push str.select
push 0
push 9
call fcn.100651c0
add esp, 0xc
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret

Function at 0x1001e8a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc8
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1001e8ca
push str.USER_anonymous_r_n
lea eax, [esp + 8]
push 0xc8
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
jmp 0x1001e8e3
push eax
push str.USER__s_r_n
lea ecx, [esp + 0xc]
push 0xc8
push ecx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x10
lea eax, [esp + 4]
mov byte [esp + 0xcb], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e8f2
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jge 0x1001e92e
push str.send_failed
push 0
push 9
call fcn.100651c0
add esp, 0xc
mov eax, esi
pop esi
add esp, 0xc8
ret
xor eax, eax
pop esi
add esp, 0xc8
ret
Function at 0x1001e940
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc8
push esi
mov esi, eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x1001e96a
push str.PASS_anonymous__r_n
lea eax, [esp + 8]
push 0xc8
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
jmp 0x1001e983
push eax
push str.PASS__s_r_n
lea ecx, [esp + 0xc]
push 0xc8
push ecx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x10
lea eax, [esp + 4]
mov byte [esp + 0xcb], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e992
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jge 0x1001e9ce
push str.send_failed
push 0
push 9
call fcn.100651c0
add esp, 0xc
mov eax, esi
pop esi
add esp, 0xc8
ret
xor eax, eax
pop esi
add esp, 0xc8
ret

Function at 0x1001e9e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc8
push esi
mov esi, dword [esp + 0xd0]
test esi, esi
je 0x1001ea57
push str.QUIT_r_n
lea eax, [esp + 8]
push 0xc8
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [esp + 0x10]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001ea11
push 0
sub eax, edx
mov edx, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jge 0x1001ea4d
push str.send_failed
push 0
push 9
call fcn.100651c0
add esp, 0xc
mov eax, esi
pop esi
add esp, 0xc8
ret
xor eax, eax
pop esi
add esp, 0xc8
ret
or eax, 0xffffffff
pop esi
add esp, 0xc8
ret
Function at 0x1001ef70
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x190
push edi
mov edi, dword [esp + 0x198]
test edi, edi
je 0x1001f035
mov eax, dword [esp + 0x19c]
test eax, eax
jne 0x1001ef99
pop edi
add esp, 0x190
ret
push eax
push str.CWD__s_r_n
lea eax, [esp + 0xc]
push 0x190
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [esp + 0x14]
add esp, 0x10
mov byte [esp + 0x193], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001efc1
push esi
push 0
sub eax, edx
mov edx, dword [edi + 0x2c]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jge 0x1001efff
push str.send_failed
push 0
push 9
call fcn.100651c0
add esp, 0xc
mov eax, esi
pop esi
pop edi
add esp, 0x190
ret
mov eax, edi
call fcn.1001e6c0
cmp eax, 4
jne 0x1001f017
pop esi
or eax, 0xffffffff
pop edi
add esp, 0x190
ret
cmp eax, 2
jne 0x1001f02a
pop esi
mov eax, 1
pop edi
add esp, 0x190
ret
pop esi
xor eax, eax
pop edi
add esp, 0x190
ret
or eax, 0xffffffff
pop edi
add esp, 0x190
ret

Function at 0x1001f040
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x190
push edi
mov edi, dword [esp + 0x198]
test edi, edi
je 0x1001f104
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x1001f104
push eax
push str.DELE__s_r_n
lea eax, [esp + 0xc]
push 0x190
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [esp + 0x14]
add esp, 0x10
mov byte [esp + 0x193], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f090
push esi
push 0
sub eax, edx
mov edx, dword [edi + 0x2c]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jge 0x1001f0ce
push str.send_failed
push 0
push 9
call fcn.100651c0
add esp, 0xc
mov eax, esi
pop esi
pop edi
add esp, 0x190
ret
mov eax, edi
call fcn.1001e6c0
cmp eax, 4
jne 0x1001f0e6
pop esi
or eax, 0xffffffff
pop edi
add esp, 0x190
ret
cmp eax, 2
jne 0x1001f0f9
pop esi
mov eax, 1
pop edi
add esp, 0x190
ret
pop esi
xor eax, eax
pop edi
add esp, 0x190
ret
or eax, 0xffffffff
pop edi
add esp, 0x190
ret
Function at 0x1001f480
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
push esi
mov esi, dword [esp + 0x218]
test esi, esi
je 0x1001f545
mov eax, dword [esi + 0x30]
push ebx
push edi
mov edi, dword [sym.imp.WSOCK32.dll_closesocket]
push eax
call edi
mov eax, dword [esi + 0x2c]
mov ecx, 1
mov dword [esp + 0x118], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
lea ecx, [esp + 0x124]
or ebx, 0xffffffff
mov dword [esp + 0x128], eax
mov dword [esp + 0x24], eax
push ecx
inc eax
push eax
mov dword [esi + 0x30], ebx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x24], 0
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jge 0x1001f50d
mov edx, dword [esi + 0x2c]
push edx
call edi
pop edi
mov dword [esi + 0x2c], ebx
mov eax, ebx
pop ebx
pop esi
add esp, 0x210
ret
jne 0x1001f524
mov eax, dword [esi + 0x2c]
push eax
call edi
mov dword [esi + 0x2c], ebx
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x210
ret
mov eax, esi
call fcn.1001e6c0
cmp eax, 2
je 0x1001f518
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
mov dword [esi + 0x2c], ebx
mov eax, ebx
pop ebx
pop esi
add esp, 0x210
ret
or eax, 0xffffffff
pop esi
add esp, 0x210
ret
Function at 0x1001fbf0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x12c
push esi
mov esi, dword [esp + 0x134]
test esi, esi
je 0x1001fc25
mov eax, dword [esp + 0x138]
test eax, eax
jne 0x1001fc14
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1001fc25
push esi
call sym.libxml2.dll_xmlNanoFTPGetConnection
add esp, 4
cmp eax, 0xffffffff
mov dword [esi + 0x30], eax
jne 0x1001fc30
or eax, 0xffffffff
pop esi
add esp, 0x12c
ret
push ebp
mov ebp, dword [sym.imp.msvcrt.dll__snprintf]
push str.TYPE_I_r_n
lea eax, [esp + 0xc]
push 0x12c
push eax
call ebp
lea eax, [esp + 0x14]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001fc52
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_send]
push edi
push 0
sub eax, edx
mov edx, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call ebx
mov edi, eax
test edi, edi
jge 0x1001fca6
push str.send_failed
push 0
push 9
call fcn.100651c0
mov eax, dword [esi + 0x30]
add esp, 0xc
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, edi
pop edi
pop ebx
pop ebp
mov dword [esi + 0x30], 0xffffffff
pop esi
add esp, 0x12c
ret
mov eax, esi
call fcn.1001e6c0
mov edi, eax
cmp edi, 2
je 0x1001fcbd
mov ecx, dword [esi + 0x30]
push ecx
jmp 0x1001fd5f
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x1001fcdd
mov edx, dword [esi + 0xc]
push edx
push str.RETR__s_r_n
push 0x12c
lea eax, [esp + 0x1c]
push eax
jmp 0x1001fced
push eax
push str.RETR__s_r_n
push 0x12c
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea eax, [esp + 0x20]
add esp, 0x10
mov byte [esp + 0x13b], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001fd01
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x18]
push edx
push eax
call ebx
mov edi, eax
test edi, edi
jge 0x1001fd4d
push str.send_failed
push 0
push 9
call fcn.100651c0
mov ecx, dword [esi + 0x30]
add esp, 0xc
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, edi
pop edi
pop ebx
pop ebp
mov dword [esi + 0x30], 0xffffffff
pop esi
add esp, 0x12c
ret
mov eax, esi
call fcn.1001e6c0
mov edi, eax
cmp edi, 1
je 0x1001fd7b
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, edi
pop edi
pop ebx
pop ebp
mov dword [esi + 0x30], 0xffffffff
neg eax
pop esi
add esp, 0x12c
ret
mov eax, dword [esi + 0x30]
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x12c
ret
Function at 0x1001fd90
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x110c
call fcn.100b8de0
push esi
mov esi, dword [esp + 0x1114]
push edi
xor edi, edi
test esi, esi
je 0x1001fdd4
mov eax, dword [esp + 0x1124]
test eax, eax
jne 0x1001fdbb
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1001fdd4
mov ecx, dword [esp + 0x111c]
test ecx, ecx
je 0x1001fdd4
push eax
push esi
call sym.libxml2.dll_xmlNanoFTPGetSocket
add esp, 8
test eax, eax
jge 0x1001fde0
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x110c
ret
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_select]
jmp 0x1001fdf0
mov eax, dword [esi + 0x30]
mov ecx, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
push edx
inc eax
push eax
mov dword [esp + 0x24], 0
call ebp
test eax, eax
jl 0x1001feb0
jne 0x1001fe5b
push esi
call sym.libxml2.dll_xmlNanoFTPCheckResponse
add esp, 4
test eax, eax
jl 0x1001feca
cmp eax, 2
jne 0x1001fe95
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
pop ebp
pop edi
mov dword [esi + 0x30], 0xffffffff
xor eax, eax
pop esi
add esp, 0x110c
ret
mov ecx, dword [esi + 0x30]
push 0
push 0x1000
lea eax, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
test edi, edi
jl 0x1001fee4
mov eax, dword [esp + 0x1124]
push edi
lea edx, [esp + 0x11c]
push edx
push eax
call dword [esp + 0x112c]
add esp, 0xc
test edi, edi
jne 0x1001fdf0
push esi
call sym.libxml2.dll_xmlNanoFTPCloseConnection
add esp, 4
pop ebp
pop edi
pop esi
add esp, 0x110c
ret
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
pop ebp
or eax, 0xffffffff
pop edi
mov dword [esi + 0x30], eax
pop esi
add esp, 0x110c
ret
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
pop ebp
or eax, 0xffffffff
pop edi
mov dword [esi + 0x30], eax
pop esi
add esp, 0x110c
ret
push str.recv_failed
push 0
push 9
call fcn.100651c0
mov edx, dword [esp + 0x1130]
push edi
lea ecx, [esp + 0x128]
push ecx
push edx
call dword [esp + 0x1138]
mov eax, dword [esi + 0x30]
add esp, 0x18
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
pop ebp
or eax, 0xffffffff
pop edi
mov dword [esi + 0x30], eax
pop esi
add esp, 0x110c
ret

Function at 0x1001ff30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x1001ff41
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x1001ff46
or eax, 0xffffffff
pop edi
ret
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x1001ff52
xor eax, eax
pop edi
ret
push esi
push 0
push eax
mov eax, dword [edi + 0x30]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
mov esi, eax
test esi, esi
jg 0x1001ff83
jge 0x1001ff7a
push str.recv_failed
push 0
push 9
call fcn.100651c0
add esp, 0xc
push edi
call sym.libxml2.dll_xmlNanoFTPCloseConnection
add esp, 4
mov eax, esi
pop esi
pop edi
ret
Function at 0x1001ffe0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
mov eax, dword [0x100eaaa8]
sub esp, 0x190
test eax, eax
jne 0x1002009f
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x1002009f
push esi
mov esi, dword [sym.imp.msvcrt.dll_getenv]
push str.no_proxy
mov dword [0x100eaab0], 0x15
call esi
add esp, 4
test eax, eax
je 0x10020035
cmp byte [eax], 0x2a
jne 0x10020035
mov cl, byte [eax + 1]
test cl, cl
je 0x1002009e
push str.ftp_proxy
call esi
add esp, 4
test eax, eax
jne 0x10020051
push str.FTP_PROXY
call esi
add esp, 4
test eax, eax
je 0x1002005a
push eax
call sym.libxml2.dll_xmlNanoFTPScanProxy
add esp, 4
push str.ftp_proxy_user
call esi
add esp, 4
test eax, eax
je 0x10020077
push eax
call dword [sym.libxml2.dll_xmlMemStrdup]
add esp, 4
mov dword [0x100eaab4], eax
push str.ftp_proxy_password
call esi
add esp, 4
test eax, eax
je 0x10020094
push eax
call dword [sym.libxml2.dll_xmlMemStrdup]
add esp, 4
mov dword [0x100eaab8], eax
mov dword [0x100eaaa8], 1
pop esi
add esp, 0x190
ret

Function at 0x10020460
Capabilities:
Get socket status

Disassembly:
mov al, byte [edi + 0x18]
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x118]
push esi
xor esi, esi
test al, 1
je 0x10020546
mov eax, dword [esp + 0x118]
test eax, eax
je 0x10020546
test ebp, ebp
jle 0x10020546
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_send]
lea ebx, [ebx]
mov ecx, dword [esp + 0x11c]
push 0
mov eax, ebp
sub eax, esi
push eax
mov eax, dword [edi + 0x14]
lea edx, [esi + ecx]
push edx
push eax
call ebx
test eax, eax
jle 0x100204c0
add esi, eax
jmp 0x10020514
cmp eax, 0xffffffff
jne 0x100204dd
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0xb
je 0x100204dd
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10020524
mov ecx, dword [0x100e9614]
mov eax, dword [edi + 0x14]
lea edx, [esp + 0xc]
push edx
push 0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], eax
push 0
inc eax
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp esi, ebp
jl 0x100204a0
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0x10c
ret
push str.send_failed_n
push 0
push 0xa
call fcn.100651c0
add esp, 0xc
test esi, esi
jne 0x10020518
pop ebx
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x10c
ret
mov eax, esi
pop esi
pop ebp
add esp, 0x10c
ret
Function at 0x10020cd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status

Disassembly:
sub esp, 0x218
push esi
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10020d05
push str.socket_failed_n
push 0
push 0xa
call fcn.100651c0
add esp, 0xc
or eax, esi
pop esi
add esp, 0x218
ret
lea eax, [esp + 8]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
mov edx, dword [esp + 0x220]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push 0x10
push edx
push esi
dec ecx
mov dword [esp + 0x10], ecx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x10020d5f
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jl 0x10020d55
cmp eax, 0x2734
jle 0x10020d5f
push str.error_connecting_to_HTTP_server
jmp 0x10020e78
mov eax, dword [0x100e9614]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
je 0x10020e73
test eax, eax
je 0x10020e6c
lea edx, [esp + 0x14]
push edx
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x10020de8
lea eax, [esp + 0x118]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x10020de8
push str.select_failed_n
jmp 0x10020e78
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0x1007
push 0xffff
push esi
mov dword [esp + 0x1c], 4
call dword [sym.imp.WSOCK32.dll_getsockopt]
test eax, eax
jge 0x10020e2b
push str.getsockopt_failed_n
push 0
push 0xa
call fcn.100651c0
add esp, 0xc
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x10020e62
push str.Error_connecting_to_remote_host
push 0
push 0xa
call fcn.100651c0
add esp, 0xc
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
call dword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
mov eax, esi
pop esi
add esp, 0x218
ret
push str.Connect_attempt_timed_out
jmp 0x10020e78
push str.Connect_failed
push 0
push 0xa
call fcn.100651c0
add esp, 0xc
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
Function at 0x10020ea0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
jne 0x10020edb
push str.Failed_to_resolve_host
push eax
push 0xa
call fcn.100651c0
add esp, 0xc
or eax, 0xffffffff
pop ebp
add esp, 0x14
ret
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
push ebx
push esi
push edi
je 0x10020f76
xor ebx, ebx
lea esp, [esp]
mov edx, 2
cmp word [ebp + 8], dx
jne 0x10020f76
mov cx, word [ebp + 0xa]
cmp cx, 4
ja 0x10020f65
mov esi, dword [ebx + eax]
movsx ecx, cx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov word [esp + 0x14], dx
mov edx, dword [esp + 0x28]
push edx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push eax
call fcn.10020cd0
add esp, 4
cmp eax, 0xffffffff
jne 0x10020f79
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + eax + 4]
add ebx, 4
test ecx, ecx
jne 0x10020ef0
pop edi
pop esi
pop ebx
or eax, 0xffffffff
pop ebp
add esp, 0x14
ret
push str.address_size_mismatch_n
push 0
push 0xa
call fcn.100651c0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x14
ret

Function at 0x100211c0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
mov eax, dword [0x100eaac4]
sub esp, 0x190
test eax, eax
jne 0x10021246
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x10021246
mov eax, dword [0x100eaac8]
test eax, eax
jne 0x1002123c
push esi
mov esi, dword [sym.imp.msvcrt.dll_getenv]
push str.no_proxy
mov dword [0x100eaac0], 0x50
call esi
add esp, 4
test eax, eax
je 0x10021216
cmp byte [eax], 0x2a
jne 0x10021216
mov cl, byte [eax + 1]
test cl, cl
je 0x1002123b
push str.http_proxy
call esi
add esp, 4
test eax, eax
jne 0x10021232
push str.HTTP_PROXY
call esi
add esp, 4
test eax, eax
je 0x1002123b
push eax
call sym.libxml2.dll_xmlNanoHTTPScanProxy
add esp, 4
pop esi
mov dword [0x100eaac4], 1
add esp, 0x190
ret