joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011a4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x101b7d60
push 0xdf5
push str.D:_repo_relxigncode_neo_third_partymbedtlslibrary_ssl_tls.c
push 2
push esi
call fcn.1012b800
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov eax, dword [eax + 0xd0]
not eax
and eax, 1
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ecx + 0x458]
push esi
call eax
push 1
push esi
call fcn.10120480
mov edi, eax
add esp, 0x28
test edi, edi
je 0x1011a578
push edi
push str.mbedtls_ssl_read_record
push 0xdfb
push str.D:_repo_relxigncode_neo_third_partymbedtlslibrary_ssl_tls.c
push 1
push esi
call fcn.1012b8b0
add esp, 0x18
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x80], 0x16
je 0x1011a5ba
push str.bad_finished_message
push 0xe01
push str.D:_repo_relxigncode_neo_third_partymbedtlslibrary_ssl_tls.c
push 1
push esi
call fcn.1012b800
push 0xa
push 2
push esi
call fcn.10120a20
add esp, 0x20
mov eax, 0xffff8900
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x78]
cmp byte [edx], 0x14
jne 0x1011a6c7
mov eax, dword [esi]
mov ecx, dword [eax + 0xd0]
and ecx, 2
mov eax, ecx
or eax, 4
shl eax, 2
cmp dword [esi + 0xa8], eax
jne 0x1011a6c7
or ecx, 1
mov byte [ebp - 0x11], 0
push ebx
xor edi, edi
lea ebx, [edx + ecx*4]
mov cl, byte [ebx + edi]
mov al, byte [ebp + edi - 0x10]
inc edi
movzx edx, al
movzx eax, cl
xor edx, eax
mov al, byte [ebp - 0x11]
or edx, eax
mov byte [ebp - 0x11], dl
cmp edi, 0xc
jb 0x1011a5f2
cmp byte [ebp - 0x11], 0
pop ebx
je 0x1011a634
push str.bad_finished_message
push 0xe1b
push str.D:_repo_relxigncode_neo_third_partymbedtlslibrary_ssl_tls.c
push 1
push esi
call fcn.1012b800
push 0x33
jmp 0x1011a6e0
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [esi + 0x100], 0xc
movq qword [esi + 0x110], xmm0
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x44]
mov ecx, dword [esi]
cmp dword [eax + 0x8cc], 0
je 0x1011a686
mov eax, dword [ecx + 0xd0]
test al, 1
jne 0x1011a67d
mov dword [esi + 4], 0xa
mov eax, dword [ecx + 0xd0]
test al, 1
je 0x1011a689
mov dword [esi + 4], 0xf
jmp 0x1011a689
inc dword [esi + 4]
test byte [ecx + 0xd0], 2
je 0x1011a69b
push esi
call fcn.10120780
add esp, 4
push str.__parse_finished
push 0xe39
push str.D:_repo_relxigncode_neo_third_partymbedtlslibrary_ssl_tls.c
push 2
push esi
call fcn.1012b800
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
push str.bad_finished_message
push 0xe12
push str.D:_repo_relxigncode_neo_third_partymbedtlslibrary_ssl_tls.c
push 1
push esi
call fcn.1012b800
push 0x32
push 2
push esi
call fcn.10120a20
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
mov eax, 0xffff8180
pop edi
pop esi
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x101209d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x10]
mov byte [ebp - 1], 0
test edi, edi
je 0x10120a10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
nop word [eax + eax]
mov cl, byte [ebx + esi]
lea esi, [esi + 1]
mov al, byte [esi - 1]
movzx edx, al
movzx eax, cl
xor edx, eax
mov al, byte [ebp - 1]
or edx, eax
mov byte [ebp - 1], dl
sub edi, 1
jne 0x101209f0
pop esi
pop ebx
movzx eax, byte [ebp - 1]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10121d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0
push esi
call fcn.100e19a0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.100e1b00
sub esi, ebx
add esp, 0x18
add esi, edi
xor edx, edx
mov dword [ebp + 8], esi
test ebx, ebx
je 0x10121e21
mov ecx, dword [ebp + 0x18]
cmp ebx, 0x40
jb 0x10121e00
lea eax, [ebx - 1]
lea edi, [ebx - 1]
add eax, ecx
add edi, esi
cmp esi, eax
ja 0x10121d96
cmp edi, ecx
jae 0x10121e00
mov edi, ebx
mov eax, esi
mov ebx, ecx
and edi, 0xffffffc0
sub ebx, esi
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [esi + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx + edx + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx + edx + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ecx + edx + 0x30]
add edx, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, edi
jb 0x10121db0
mov esi, dword [ebp + 8]
cmp edx, ebx
jae 0x10121e21
sub ecx, esi
lea eax, [edx + esi]
mov dword [ebp + 0x18], ecx
sub ebx, edx
nop
mov cl, byte [eax + ecx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
mov ecx, dword [ebp + 0x18]
sub ebx, 1
jne 0x10121e10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1012c560
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x56c
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ebx
mov dword [ebp - 0x56c], eax
push edi
xor edi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x1012c590
sub esi, ecx
cmp esi, 0x101
ja 0x1012c70d
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.100e19a0
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.100e19a0
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100e1b00
mov byte [ebp + esi - 0x108], 0x5c
lea eax, [ebp - 0x108]
add esp, 0x24
inc esi
add eax, esi
inc esi
mov dword [ebp - 0x568], eax
push 0x101
mov byte [eax], 0x2a
lea eax, [ebp - 0x310]
push eax
push esi
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1012c70d
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x564], eax
cmp eax, 0xffffffff
jne 0x1012c652
pop edi
pop esi
mov eax, 0xffffd700
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov ebx, 0x104
sub ebx, esi
mov esi, dword [ebp - 0x568]
nop
push ebx
push 0
push esi
call fcn.100e19a0
add esp, 0xc
test byte [ebp - 0x560], 0x10
jne 0x1012c6bf
push 0
push 0
lea eax, [ebx - 1]
push eax
push esi
lea eax, [ebp - 0x534]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x534]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1012c706
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x56c]
call fcn.1012c3d0
add esp, 8
test eax, eax
jns 0x1012c6bd
inc edi
jmp 0x1012c6bf
add edi, eax
lea eax, [ebp - 0x560]
push eax
push dword [ebp - 0x564]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1012c660
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov ecx, 0xffffd700
cmovne edi, ecx
push dword [ebp - 0x564]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov edi, 0xffffd700
jmp 0x1012c6e7
mov ecx, dword [ebp - 4]
mov eax, 0xffffd800
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x1014a240
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x19c], 0
je 0x1014a25d
push eax
call fcn.1014f000
add esp, 4
test eax, eax
jne 0x1014a27c
xor al, al
ret
mov eax, dword [eax + 0x148]
cmp eax, 0xffffffff
je 0x1014a25a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1014a25a
mov al, 1
ret

Function at 0x1014a4c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.100e19a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1014a547
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1016d470
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x1014a587
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.1014a110
add esp, 0x10
test al, al
jne 0x1014a590
call fcn.100f1c88
mov esi, dword [eax]
call fcn.100f1c88
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.1016d470
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.1014d3d0
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e04a9
add esp, 0x188
ret
Function at 0x1014d340
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x722], 0
je 0x1014d3c6
cmp dword [edi + 0x1b0], 0
je 0x1014d38d
push esi
push 1
push edi
call fcn.10131a80
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.10131a80
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x1014d3c6
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x101cf7b0
push 2
push eax
call fcn.100ebefd
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.100ebefd
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x1014d770
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x108], eax
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x124]
push ebp
mov ebp, dword [esp + 0x118]
push esi
lea esi, [edx + 0x17]
mov dword [esp + 0x10], eax
shl esi, 4
mov ecx, dword [ebp + 0xc]
add esi, ecx
push edi
mov eax, dword [ecx + edx*4 + 0x148]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x2a0]
test byte [eax + 0x44], 3
je 0x1014d875
cmp dword [ecx + edx*4 + 0x160], 0x1014d620
jne 0x1014d875
cmp dword [esi], 0
je 0x1014d7f2
test edi, edi
je 0x1014d875
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.1014e070
add esp, 0x14
cmp eax, 0xffffffff
je 0x1014d875
test al, 1
je 0x1014d875
mov ecx, dword [esi]
test ecx, ecx
jne 0x1014d847
mov eax, dword [ebp + 0x4f0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x1026e9e8]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x1014d863
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x1014d86e
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1014d875
add dword [esi + 8], eax
jmp 0x1014d875
mov dword [ebx], 0x1b
or eax, 0xffffffff
jmp 0x1014d8e0
mov dword [esi + 4], 0
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov dword [ebx], 0
cmp esi, 0xffffffff
jne 0x1014d8de
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x1014d8b3
xor esi, esi
mov dword [ebx], 0x51
jmp 0x1014d8de
push 0x100
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.1016d470
push eax
push str.Send_failure:__s
push ebp
call fcn.1014d3d0
mov dword [ebp + 0x974], edi
add esp, 0x18
mov dword [ebx], 0x37
mov eax, esi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100e04a9
add esp, 0x10c
ret
Function at 0x101528b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x1015294f
push edi
call fcn.10143980
add esp, 4
test al, al
jne 0x1015294f
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x101528d8
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.1016f580
add esp, 0xc
test eax, eax
je 0x1015290c
sub eax, edi
push eax
push 0x2e
push edi
call fcn.1016f580
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1015290e
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x10152947
mov al, byte [edi]
push eax
call fcn.10139300
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x10152926
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x10155030
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x190], eax
test byte [esp + 0x198], 2
je 0x1015508f
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10155075
mov eax, dword [esp]
cmp al, 2
jne 0x1015506f
shr eax, 8
cmp al, 2
je 0x1015508f
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.100e04a9
add esp, 0x194
ret
push esi
push edi
push 0x101d0998
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x101550af
mov dword [0x102a7d28], esi
jmp 0x101551e8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1020b4d0
push edi
call ebp
push 0x101d09a4
push 0x101d0978
mov ebx, eax
call fcn.100ecd80
add esp, 8
test eax, eax
je 0x101550ff
test ebx, ebx
je 0x101550ed
push 8
push 0
push 0x101d0978
call ebx
mov esi, eax
jmp 0x101551c3
push 0x101d0978
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x101551c3
test ebx, ebx
je 0x10155124
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x10155124
push 0x800
push 0
push 0x101d0978
call ebx
mov esi, eax
jmp 0x101551c3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x101551bd
lea ecx, [ebp + 0xd]
push ecx
call dword [0x1026e9e8]
mov edi, eax
add esp, 4
test edi, edi
je 0x101551b3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x101551b3
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10155160
sub ecx, edx
mov eax, 0x5c
mov edx, edi
mov word [ecx + edi], ax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10155177
sub edx, ecx
mov ecx, 0x101d0978
sub edx, ecx
add edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10155190
test ebx, ebx
je 0x101551aa
push 8
push 0
push edi
call ebx
jmp 0x101551b1
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x1026e9ec]
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102a7d28], esi
test esi, esi
je 0x101551e6
push str.if_nametoindex
push esi
call ebp
mov ecx, dword [0x102a7d24]
test eax, eax
cmovne ecx, eax
mov dword [0x102a7d24], ecx
pop ebp
pop ebx
push 3
push 2
push 0
push 6
call fcn.1016dd60
add esp, 0x10
test al, al
setne byte [0x102a9468]
push 0x102a9470
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x198]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.100e04a9
add esp, 0x194
ret
Function at 0x1015c2b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
or esi, 0xffffffff
push eax
mov ebx, dword [edi + 0xc]
mov ebp, dword [ebx + 0x14c]
push ebp
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1015c30a
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push ebx
push edi
call fcn.1014a170
add esp, 0xc
cmp esi, 0xffffffff
jne 0x1015c340
push str.Error_accept__ing_server_connect
push edi
call fcn.1014d3d0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100e04a9
add esp, 0x18
ret
push str.Connection_accepted_from_server
push edi
call fcn.1014d4a0
push 1
push esi
mov byte [ebx + 0x266], 0
mov dword [ebx + 0x14c], esi
call fcn.1016dd30
add esp, 0x10
mov byte [ebx + 0x279], 1
cmp dword [edi + 0x1b8], 0
je 0x1015c3bf
push 1
push edi
call fcn.10131a80
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.10131a80
add esp, 0x1c
test esi, esi
je 0x1015c3bf
push ebx
push edi
call fcn.1015c850
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100e04a9
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100e04a9
add esp, 0x18
ret
Function at 0x1015e180
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x1015e1b0
push str.Couldnt_set_desired_mode
push esi
call fcn.1014d3d0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x1015e1c7
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.1014d4a0
add esp, 0xc
mov eax, dword [esp + 0x18]
push ebp
cmp eax, 0x13
jne 0x1015e1e2
push ebx
push esi
call fcn.1015e080
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x1015e2f3
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp dword [esi + 0x510], 2
mov dword [esp + 0x18], edi
jne 0x1015e261
mov eax, dword [esi + 0x134]
mov eax, dword [eax]
test eax, eax
je 0x1015e261
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
push esi
call fcn.10135890
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x1015e320
push 0x2f
push dword [esp + 0x18]
call fcn.100e2800
add esp, 8
test eax, eax
je 0x1015e250
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x1015e25d
push dword [esp + 0x14]
call dword [0x1026e9ec]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x554]
test ecx, ecx
jne 0x1015e27f
cmp byte [esi + 0xd35], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x10204e25
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x101ade8c
cmove eax, edx
push eax
push ecx
push 0x101cd860
call fcn.1013e3a0
push ebx
mov ebp, eax
call dword [0x1026e9ec]
add esp, 0x14
test ebp, ebp
jne 0x1015e2bc
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x10206738
lea eax, [edi + 0x318]
push eax
push esi
call fcn.1016fa90
push ebp
mov edi, eax
call dword [0x1026e9ec]
add esp, 0x14
test edi, edi
jne 0x1015e320
mov eax, dword [esi + 0xc]
pop ebp
mov dword [eax + 0x39c], 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x1015e30c
push 0xd
push 1
push esi
call fcn.1015dc20
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x1015e320
push 0xe
push 1
push esi
call fcn.1015dc20
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x101643a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0xc]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x101643ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.1014d3d0
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.10163fc0
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x10164540
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x134]
mov dword [esp + 8], eax
jne 0x10164690
push esi
push edi
lea eax, [ebp + 0x1cb4]
lea edi, [ebp + 0x1eb4]
mov dword [edi], eax
cmp eax, edi
jae 0x1016458e
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1016458e
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1016458e
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x101645f8
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x101645f8
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x101645f8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x101645f8
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x101645f8
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x101645f8
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1eb8], eax
lea esi, [ebp + 0x1cb4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.101640c0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x148]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x10164650
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1014d3d0
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb7]
push eax
push ebx
call fcn.10164410
add esp, 0xc
lea eax, [ebp + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x148]
call edi
test eax, eax
jns 0x1016468e
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1014d3d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret