joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417be1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x417c23
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str._writing_BODY_file__s_...
call fcn.004247e5
mov dword [esp + 4], 0x6edbe4
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0046596e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x417d3e
mov eax, 0xffffffff
jmp 0x417dc0
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
mov dword [esp], 0x7af180
call sub.msvcrt.dll_fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x417d6c
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp - 0x18]
mov edx, eax
sar edx, 0x1f
cmp ebx, edx
jl 0x417ca5
cmp ebx, edx
jg 0x417ca1
cmp ecx, eax
jbe 0x417ca5
mov ecx, eax
mov ebx, edx
mov dword [ebp - 0x1c], ecx
fld1
fchs
fstp qword [esp + 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x7af180
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402b95
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jns 0x417ce8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0xffffffff
jmp 0x417dc0
cmp dword [ebp + 0x18], 0
je 0x417d30
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x7af180
call fcn.0047f1b1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
je 0x417d30
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffe
jmp 0x417dc0
mov eax, dword [ebp - 0x1c]
mov edx, eax
sar edx, 0x1f
add dword [ebp - 0x10], eax
adc dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x417d6d
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x2c]
jl 0x417c4d
cmp edx, dword [ebp - 0x2c]
jg 0x417d6d
cmp eax, dword [ebp - 0x30]
jb 0x417c4d
jmp 0x417d6d
nop
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x2c]
jg 0x417da1
cmp edx, dword [ebp - 0x2c]
jl 0x417d8d
cmp eax, dword [ebp - 0x30]
jae 0x417da1
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x417dc0
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x417dbb
mov dword [esp], str.done__n
call fcn.004247e5
mov eax, 0
add esp, 0x54
pop ebx
pop ebp
ret
Function at 0x42199a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 0x240
mov dword [esp + 4], 0
mov dword [esp], 0x7bdd00
call sub.msvcrt.dll_memset
mov dword [0x7bdd40], 0xffffffff
mov byte [0x7bdee5], 1
mov dword [0x7bdd00], 0xffffffff
mov dword [0x7bdd08], 0x14
mov dword [0x7bdd20], 5
mov byte [0x7bdd2c], 1
mov byte [0x7bddf0], 1
mov byte [0x7bddf1], 1
mov byte [0x7bde8f], 1
mov byte [0x7bde00], 1
mov byte [0x7bde01], 1
mov byte [0x7bde8d], 0
mov dword [esp], str.no_proxy
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x421a41
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00434fe7
mov dword [0x7bde10], eax
mov dword [0x7bdf18], 2
mov byte [0x7bde02], 1
mov byte [0x7bde7d], 1
fld qword [0x6f0ad8]
fstp qword [0x7bde30]
mov byte [0x7bde60], 1
mov byte [0x7bde8e], 1
mov dword [0x7bde98], 0x400
mov dword [0x7bde9c], 0
mov dword [0x7bdea4], 0xa
mov dword [0x7bdea0], 0x32
mov byte [0x7bdd94], 1
mov byte [0x7bddf2], 1
mov byte [0x7bdda1], 1
mov dword [0x7bdeb4], 1
mov byte [0x7bdee1], 1
mov byte [0x7bdee2], 0
mov byte [0x7bdee3], 0
mov byte [0x7bdee4], 0
mov dword [0x7bdf2c], 2
mov dword [0x7bdf08], 2
mov byte [0x7bdf0c], 1
mov byte [0x7bdf0d], 0
mov dword [0x7bdf10], 0
mov dword [0x7bdd80], 0
mov dword [0x7bdd18], 0x14
fld qword [0x6f0ae0]
fstp qword [0x7bde58]
mov byte [0x7bdf1e], 1
mov dword [0x7bdf24], 0
mov dword [0x7bdf20], 0
mov byte [0x7bdf29], 1
mov byte [0x7bdf2a], 0
mov dword [0x7bddb8], 0
mov dword [0x7bddbc], 0
mov byte [0x7bddc0], 1
mov byte [0x7bddc1], 1
mov byte [0x7bddc2], 0
mov dword [0x7bddb0], 0
mov dword [0x7bddac], 0
mov byte [0x7bddc3], 1
mov dword [0x7bdde0], 0xffffffff
mov dword [0x7bdde4], 0xffffffff
mov dword [0x7bde1c], 0xffffffff
mov byte [0x7bde20], 0
mov byte [0x7bdf34], 1
mov byte [0x7bddc8], 0
nop
leave
ret

Function at 0x421c38
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.WGETRC
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x421cc8
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
test al, al
je 0x421cc8
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0043539c
xor eax, 1
test al, al
je 0x421cbb
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0047f310
mov edx, eax
mov eax, dword [0x7bdf48]
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_WGETRC_points_to__s__which_couldnt_be_accessed_because_of_error:__s._n
mov dword [esp], ecx
call fcn.0047ee24
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00461e26
jmp 0x421ccd
mov eax, 0
leave
ret
Function at 0x422021
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 9], 1
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp], str.SYSTEM_WGETRC
call sub.msvcrt.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4220d0
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0043539c
test al, al
je 0x4220d0
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00421dee
mov dl, byte [ebp - 9]
and edx, 0xff
and eax, 0xff
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
xor eax, 1
test al, al
je 0x422112
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edx, [eax + 0x40]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Parsing_system_wgetrc_file__env_SYSTEM_WGETRC__failed.__Please_check_n_s__nor_specify_a_different_file_using___config._n
mov dword [esp], edx
call fcn.0047ee24
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x6f0614
call fcn.0043539c
test al, al
je 0x422112
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x6f0614
call fcn.00421dee
mov dl, byte [ebp - 9]
and edx, 0xff
and eax, 0xff
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
xor eax, 1
test al, al
je 0x422148
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 8], 0x6f0614
mov dword [esp + 4], str.Parsing_system_wgetrc_file_failed.__Please_check_n_s__nor_specify_a_different_file_using___config._n
mov dword [esp], eax
call fcn.0047ee24
mov dword [esp], 2
call sub.msvcrt.dll_exit
call fcn.00421d57
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x422211
mov dword [esp + 4], 0x6f0614
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4221a6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00461905
mov edx, eax
mov eax, dword [0x7bdf48]
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Warning:_Both_system_and_user_wgetrc_point_to__s._n
mov dword [esp], ecx
call fcn.0047ee24
jmp 0x4221e6
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0043539c
test al, al
je 0x4221e6
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00421dee
mov dl, byte [ebp - 9]
and edx, 0xff
and eax, 0xff
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
xor eax, 1
test al, al
je 0x4221fc
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x14], 0
nop
jmp 0x422212
nop
leave
ret
Function at 0x4247e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov al, byte [0x7bde7b]
test al, al
je 0x42484c
call fcn.00424fa6
mov al, byte [0x7b11d8]
test al, al
jne 0x42484b
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.004244b2
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
xor eax, 1
test al, al
jne 0x42481d
jmp 0x42484c
nop
leave
ret
Function at 0x432cdc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.006b8e90
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.006b93c0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
lea eax, [ebp - 0x21]
mov dword [esp], eax
call fcn.004368c9
lea eax, [ebp - 0x21]
mov dword [esp + 4], eax
mov dword [esp], str.Content_Length
call fcn.00432c5a
mov dword [esp], 0x6f6f3b
call fcn.00432ad2
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.006b8e90
test eax, eax
je 0x432d96
mov byte [0x7b41e0], 0
jmp 0x432d96
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x221]
mov dword [esp], eax
call fcn.00432a5a
cmp dword [ebp - 0xc], eax
jbe 0x432d96
mov byte [0x7b41e0], 0
mov al, byte [0x7b41e0]
test al, al
je 0x432dcd
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
lea eax, [ebp - 0x221]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x432d75
mov al, byte [0x7b41e0]
leave
ret
Function at 0x43600e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2d
jne 0x436041
mov eax, dword [ebp + 8]
inc eax
mov al, byte [eax]
test al, al
jne 0x436041
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x11], 1
jmp 0x436057
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00469bc9
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x436067
mov eax, 0
jmp 0x4361d7
mov dword [esp], 0xc
call fcn.00461cdf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
mov dword [ebp - 0x10], 0x200
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00461cdf
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
cmp edx, eax
jle 0x4360cd
shl dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00461d09
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, edx
mov edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
add eax, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
js 0x436133
cmp dword [ebp - 0x1c], 0
jg 0x436119
cmp dword [ebp - 0x20], 0
jbe 0x436133
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
jmp 0x436099
cmp dword [ebp - 0x1c], 0
jns 0x43613b
jmp 0x436195
nop
mov al, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x436151
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0046272a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
cmp dword [ebp - 0x10], eax
jle 0x436186
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
test eax, eax
je 0x436186
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00461d09
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x18]
jmp 0x4361d7
mov al, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x4361aa
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0046272a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x18], 0
mov eax, 0
leave
ret
Function at 0x43ab8c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax - 2]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jmp 0x43ac60
mov eax, dword [ebp - 4]
mov al, byte [eax]
shr al, 2
xor edx, edx
mov dl, al
mov eax, dword [ebp - 8]
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov dl, byte [edx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
shl eax, 4
and eax, 0x30
mov edx, eax
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
shr al, 4
and eax, 0xff
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
and eax, 0xff
shl eax, 2
and eax, 0x3c
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 2
mov al, byte [eax]
shr al, 6
and eax, 0xff
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
add eax, 2
mov al, byte [eax]
and eax, 0xff
and eax, 0x3f
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
add dword [ebp - 4], 3
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x43abb1
mov eax, dword [ebp + 0xc]
mov ecx, 3
mov edx, 0
div ecx
mov eax, edx
cmp eax, 1
je 0x43ac8c
cmp eax, 2
je 0x43ace9
jmp 0x43ad6b
mov eax, dword [ebp - 4]
mov al, byte [eax]
shr al, 2
xor edx, edx
mov dl, al
mov eax, dword [ebp - 8]
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov dl, byte [edx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
shl eax, 4
and eax, 0x30
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0x3d
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0x3d
jmp 0x43ad6b
mov eax, dword [ebp - 4]
mov al, byte [eax]
shr al, 2
xor edx, edx
mov dl, al
mov eax, dword [ebp - 8]
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov dl, byte [edx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
shl eax, 4
and eax, 0x30
mov edx, eax
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
shr al, 4
and eax, 0xff
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 4]
inc eax
mov al, byte [eax]
and eax, 0xff
shl eax, 2
and eax, 0x3c
mov ecx, eax
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov dl, byte [ecx + 0x6f78c0]
mov byte [eax], dl
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0x3d
nop
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
sub edx, eax
mov eax, edx
leave
ret
Function at 0x44042d
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x7b43b0]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x7b43b0], 0
mov eax, dword [0x7b43b4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x7b43b4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 0x14
mov dword [esp], eax
call fcn.00461cdf
mov dword [0x7b43b0], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00461e26
mov dword [0x7b43b4], eax
mov dword [0x6cd720], 0xffffffff
mov edx, dword [0x7b43b4]
mov eax, dword [0x7b43b0]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Wget__s
mov dword [esp], eax
call fcn.0043fcbc
mov eax, dword [0x7b43b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call eax
sub esp, 4
nop
leave
ret

Function at 0x4404ca
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x7b43b0]
test eax, eax
je 0x4405a1
mov eax, dword [0x7b43b4]
test eax, eax
je 0x4405a1
fld qword [ebp - 0x20]
fnstcw word [ebp - 0x22]
mov ax, word [ebp - 0x22]
mov ah, 0xc
mov word [ebp - 0x24], ax
fldcw word [ebp - 0x24]
fistp dword [ebp - 0xc]
fldcw word [ebp - 0x22]
cmp dword [ebp - 0xc], 0
jns 0x44051c
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0x64
jle 0x440529
mov dword [ebp - 0xc], 0x64
mov eax, dword [0x6cd720]
cmp dword [ebp - 0xc], eax
je 0x4405a4
mov eax, dword [ebp - 0xc]
mov dword [0x6cd720], eax
mov edx, dword [0x7b43b4]
mov eax, dword [0x7b43b0]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Wget___d_____s
mov dword [esp], eax
call fcn.0043fcbc
mov eax, dword [0x7b43b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call eax
sub esp, 4
fld qword [ebp - 0x20]
fld qword [0x6f8b30]
fmulp st(1)
fnstcw word [ebp - 0x22]
mov ax, word [ebp - 0x22]
mov ah, 0xc
mov word [ebp - 0x24], ax
fldcw word [ebp - 0x24]
fistp dword [ebp - 0x28]
fldcw word [ebp - 0x22]
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.0043bc7c
jmp 0x4405a5
nop
jmp 0x4405a5
nop
leave
ret
Function at 0x440693
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov word [ebp - 0xa], 0x101
mov ax, word [ebp - 0xa]
and eax, 0xffff
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4406f9
mov eax, dword [0x7bdf48]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Couldnt_find_usable_socket_driver._n
mov dword [esp], edx
call fcn.0047ee24
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x1a0]
cmp word [ebp - 0xa], ax
jbe 0x44073a
mov eax, dword [0x7bdf48]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Couldnt_find_usable_socket_driver._n
mov dword [esp], edx
call fcn.0047ee24
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], 0x43fdcc
call fcn.00401500
call fcn.0044064c
mov dword [esp + 4], 1
mov dword [esp], 0x440421
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call eax
sub esp, 8
nop
leave
ret
Function at 0x4407ae
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x4407e1
fld qword [ebp - 0x30]
fstp qword [esp + 4]
mov dword [esp], str.seconds__.2f_
call fcn.004247e5
fldz
fld qword [ebp - 0x30]
fucompp
fnstsw ax
and ah, 0x45
xor ah, 0x40
jne 0x440808
nop
jmp 0x4407f6
nop
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
call eax
mov al, 0
jmp 0x440938
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x440767
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x440888
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x4407f5
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.CreateThread___failed____lx__n
call fcn.004247e5
jmp 0x4407f5
fld qword [ebp - 0x30]
fld qword [0x6f8b38]
fmulp st(1)
fnstcw word [ebp - 0x32]
mov ax, word [ebp - 0x32]
mov ah, 0xc
mov word [ebp - 0x34], ax
fldcw word [ebp - 0x34]
fistp qword [ebp - 0x40]
fldcw word [ebp - 0x32]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
test eax, eax
jne 0x440902
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSASetLastError]
call eax
sub esp, 4
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x4408fc
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Winsock_error:__d_n
call fcn.004247e5
mov byte [ebp - 9], 0
jmp 0x44091e
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 9]
leave
ret