joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422aff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jmp 0x422b1c
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422b39
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x422b18
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422b67
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x422b55
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2b
jne 0x422b67
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2d
sete al
mov byte [ebp - 0xd], al
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x422b79
mov eax, 0
jmp 0x422c59
movzx eax, byte [ebp - 0xd]
xor eax, 1
test al, al
je 0x422be0
jmp 0x422bc1
mov edx, dword [ebp - 0xc]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jge 0x422bb7
mov eax, 0
jmp 0x422c59
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422c3d
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f8ec
test al, al
jne 0x422b86
jmp 0x422c3d
jmp 0x422c20
mov edx, dword [ebp - 0xc]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov ecx, 0x30
sub ecx, eax
mov eax, ecx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jle 0x422c16
mov eax, 0
jmp 0x422c59
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422c3d
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f8ec
test al, al
jne 0x422be2
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
je 0x422c4c
mov eax, 0
jmp 0x422c59
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 1
leave
ret

Function at 0x422da6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x422db8
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x422de4
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3a
je 0x422de4
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
xor eax, 1
test al, al
jne 0x422db4
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x422df6
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x422dfd
mov eax, 0
jmp 0x422e20
mov dword [esp + 4], 0xa
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x422e1b
mov eax, 0
jmp 0x422e20
mov eax, 1
leave
ret
Function at 0x42371d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [0x6ea46b]
test al, al
je 0x423786
call fcn.00423e1f
movzx eax, byte [0x6e2248]
test al, al
jne 0x423786
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.004233ce
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
jne 0x423759
leave
ret

Function at 0x42d510
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ebx, eax
mov eax, dword [0x6ea470]
cdq
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00434827
add eax, ebx
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00620f20
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00620f20
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00463934
test eax, eax
jne 0x42d5d7
movzx eax, word [ebp - 0x42]
movzx eax, ax
and eax, 0xf000
cmp eax, 0x8000
jne 0x42d68e
mov eax, dword [0x6ea470]
mov dword [ebp - 0xc], eax
jmp 0x42d64c
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x65c11f
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_d
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0042b580
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x65c11f
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_d
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0042b580
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_rename
sub dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 1
jg 0x42d5e1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x65c11f
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_d
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0042b580
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_rename
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42df02
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42df44
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f838
xor eax, 1
test al, al
je 0x42df4b
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x42df4b
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2b
je 0x42df4b
mov eax, 0
jmp 0x42df93
add dword [ebp - 0xc], 1
jmp 0x42df55
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42df88
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f838
test al, al
jne 0x42df51
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x42df51
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2b
je 0x42df51
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3a
sete al
leave
ret

Function at 0x430e3d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.006225b0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00622a70
mov dword [esp + 4], eax
mov dword [esp + 8], edx
lea eax, [ebp - 0x21]
mov dword [esp], eax
call fcn.00434887
lea eax, [ebp - 0x21]
mov dword [esp + 4], eax
mov dword [esp], str.Content_Length
call fcn.00430db7
mov dword [esp], 0x65c7bb
call fcn.00430c1c
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.006225b0
test eax, eax
je 0x430ed4
mov byte [0x6e4e80], 0
jmp 0x430ef7
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x221]
mov dword [esp], eax
call fcn.00430ba4
cmp eax, dword [ebp - 0xc]
jae 0x430ef7
mov byte [0x6e4e80], 0
movzx eax, byte [0x6e4e80]
test al, al
je 0x430f30
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
lea eax, [ebp - 0x221]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x430ed6
movzx eax, byte [0x6e4e80]
leave
ret
Function at 0x433b74
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x433b8f
mov eax, 1
jmp 0x433c40
movzx eax, byte [0x6ea364]
xor eax, 1
test al, al
je 0x433bcd
jmp 0x433ba7
add dword [ebp + 8], 1
add dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x433c13
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x433c13
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp dl, al
je 0x433b9f
jmp 0x433c13
jmp 0x433bd7
add dword [ebp + 8], 1
add dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x433c13
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x433c13
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f9fa
mov ebx, eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f9fa
cmp ebx, eax
je 0x433bcf
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x433c38
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x433c31
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp al, 0x2f
jne 0x433c38
mov eax, 1
jmp 0x433c3d
mov eax, 0
and eax, 1
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x433fe4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x2d
jne 0x43401b
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
test al, al
jne 0x43401b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x11], 1
jmp 0x434031
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0044fb99
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x434041
mov eax, 0
jmp 0x4341b4
mov dword [esp], 0xc
call fcn.004484c4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
mov dword [ebp - 0x10], 0x200
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004484c4
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
cmp edx, eax
jle 0x4340a7
shl dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004484ee
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll__read
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
js 0x434106
cmp dword [ebp - 0x1c], 0
jg 0x4340ef
cmp dword [ebp - 0x20], 0
jbe 0x434106
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
jmp 0x434128
cmp dword [ebp - 0x1c], 0
jns 0x43411a
nop
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x434187
jmp 0x43417c
nop
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x434138
jmp 0x43412d
jmp 0x434073
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00448ef2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x10]
jge 0x43416d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
test eax, eax
je 0x43416d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004484ee
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x18]
jmp 0x4341b4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00448ef2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0062e160
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0062e160
mov dword [ebp - 0x18], 0
mov eax, 0
leave
ret
Function at 0x43afe4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x43b165
jmp 0x43b009
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp + 0xc]
jae 0x43b02e
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b005
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x43b074
jmp 0x43b051
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp + 0xc]
jae 0x43b06b
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
cmp al, 0x3b
jne 0x43b04d
add dword [ebp - 0x18], 1
jmp 0x43b165
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0xc], eax
jmp 0x43b085
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jae 0x43b0a2
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b081
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x43b0b4
mov eax, 0
jmp 0x43b187
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3d
je 0x43b0c7
add dword [ebp - 0x18], 1
jmp 0x43b165
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x43b0d6
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jae 0x43b0f3
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b0d2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x43b105
mov eax, 0
jmp 0x43b187
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x43b114
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x43b13e
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3b
je 0x43b13e
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
xor eax, 1
test al, al
jne 0x43b110
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub edx, eax
mov eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00448650
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, 1
jmp 0x43b187
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp + 0xc]
jb 0x43b003
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 0
leave
ret
Function at 0x43b28b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jmp 0x43b2ba
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3b
je 0x43b2ad
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2c
jne 0x43b2b6
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp + 8], eax
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x43b2cc
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3d
jne 0x43b299
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jb 0x43b2de
mov eax, 0
jmp 0x43b409
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x43b2ea
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0x43b307
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b2e6
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x43b316
sub dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x43b333
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b312
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x43b346
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jae 0x43b363
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b342
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x43b36f
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jae 0x43b3a3
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x3b
je 0x43b3a3
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x2c
je 0x43b3a3
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
xor eax, 1
test al, al
jne 0x43b36b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub edx, eax
mov eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00448650
mov edx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub edx, eax
mov eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00448650
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x43b3e9
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jae 0x43b406
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043f996
test al, al
jne 0x43b3e5
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x43c136
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6e5070]
mov dword [esp], eax
call fcn.0062e160
mov dword [0x6e5070], 0
mov eax, dword [0x6e5074]
mov dword [esp], eax
call fcn.0062e160
mov dword [0x6e5074], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 0x14
mov dword [esp], eax
call fcn.004484c4
mov dword [0x6e5070], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004485f9
mov dword [0x6e5074], eax
mov dword [0x6327c0], 0xffffffff
mov edx, dword [0x6e5074]
mov eax, dword [0x6e5070]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Wget__s
mov dword [esp], eax
call fcn.0043b9cc
mov eax, dword [0x6e5070]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call eax
sub esp, 4
leave
ret

Function at 0x43c1d2
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6e5070]
test eax, eax
je 0x43c1f6
mov eax, dword [0x6e5074]
test eax, eax
jne 0x43c1fb
jmp 0x43c2a6
fld qword [ebp - 0x20]
fnstcw word [ebp - 0x22]
movzx eax, word [ebp - 0x22]
mov ah, 0xc
mov word [ebp - 0x24], ax
fldcw word [ebp - 0x24]
fistp dword [ebp - 0xc]
fldcw word [ebp - 0x22]
cmp dword [ebp - 0xc], 0
jns 0x43c221
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0x64
jle 0x43c22e
mov dword [ebp - 0xc], 0x64
mov eax, dword [0x6327c0]
cmp dword [ebp - 0xc], eax
jne 0x43c23a
jmp 0x43c2a6
mov eax, dword [ebp - 0xc]
mov dword [0x6327c0], eax
mov edx, dword [0x6e5074]
mov eax, dword [0x6e5070]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Wget___d_____s
mov dword [esp], eax
call fcn.0043b9cc
mov eax, dword [0x6e5070]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call eax
sub esp, 4
fld qword [ebp - 0x20]
fld qword [0x65dbd8]
fmulp st(1)
fnstcw word [ebp - 0x22]
movzx eax, word [ebp - 0x22]
mov ah, 0xc
mov word [ebp - 0x24], ax
fldcw word [ebp - 0x24]
fistp dword [ebp - 0x28]
fldcw word [ebp - 0x22]
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00439a24
leave
ret
Function at 0x43c395
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov word [ebp - 0xa], 0x101
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43c3f6
mov eax, dword [0x6ea2c4]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Couldnt_find_usable_socket_driver._n
mov dword [esp], edx
call fcn.00463b20
mov dword [esp], 1
call sub.msvcrt.dll_exit
movzx eax, word [ebp - 0x1a0]
cmp ax, word [ebp - 0xa]
jae 0x43c438
mov eax, dword [0x6ea2c4]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Couldnt_find_usable_socket_driver._n
mov dword [esp], edx
call fcn.00463b20
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], 0x43bad9
call fcn.0061ff70
call fcn.0043c34f
mov dword [esp + 4], 1
mov dword [esp], 0x43c12a
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call eax
sub esp, 8
leave
ret