joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fbcc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004283f5
and dword [ebp - 0x14], 0
cmp dword [0x44aa18], 0
mov dword [ebp - 0x18], eax
jne 0x42fc7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42fd27
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x42fd27
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44aa18], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44aa1c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44aa20], eax
call edi
push eax
call esi
mov dword [0x44aa28], eax
test eax, eax
je 0x42fc7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44aa24], eax
mov eax, dword [0x44aa24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42fcd8
cmp dword [0x44aa28], ecx
je 0x42fcd8
push eax
call esi
push dword [0x44aa28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42fcd8
test ebx, ebx
je 0x42fcd8
call edi
test eax, eax
je 0x42fccf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42fccf
test byte [ebp - 8], 1
jne 0x42fcd8
or dword [ebp + 0x10], 0x200000
jmp 0x42fd0b
mov eax, dword [0x44aa1c]
cmp eax, dword [ebp - 0x18]
je 0x42fd0b
push eax
call esi
test eax, eax
je 0x42fd0b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42fd0b
mov eax, dword [0x44aa20]
cmp eax, dword [ebp - 0x18]
je 0x42fd0b
push eax
call esi
test eax, eax
je 0x42fd0b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44aa18]
call esi
test eax, eax
je 0x42fd27
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42fd29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420e82
leave
ret
Function at 0x403a22
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 2
jne 0x403a9e
mov eax, dword [ebp - 0x10]
add eax, 1
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00625290
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp - 0x10]
lea edx, [eax - 4]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [eax], 0x6769726f
mov byte [eax + 4], 0
jmp 0x403afd
mov eax, dword [ebp - 0x10]
add eax, 6
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00625290
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [eax], 0x69726f2e
mov word [eax + 4], 0x67
mov eax, dword [0x6e5060]
test eax, eax
jne 0x403b17
mov dword [esp], 0
call fcn.004122de
mov dword [0x6e5060], eax
mov eax, dword [0x6e5060]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00433c8d
test eax, eax
jne 0x403b90
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_rename
test eax, eax
je 0x403b7c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00462cf8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cannot_back_up__s_as__s:__s_n
mov dword [esp], 1
call fcn.004231f5
mov eax, dword [0x6e5060]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00433c4b
leave
ret
Function at 0x403d94
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1c], al
mov dword [esp + 4], 0x642412
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strpbrk
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403de2
cmp byte [ebp - 0x1c], 0
je 0x403dd2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
jmp 0x403f5c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00404629
jmp 0x403f5c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
add eax, 1
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00625290
sub esp, eax
lea eax, [esp + 8]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x403f29
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
cmp eax, 0x25
je 0x403e6e
cmp eax, 0x25
jg 0x403e5f
cmp eax, 0x23
je 0x403e97
jmp 0x403f14
cmp eax, 0x3b
je 0x403ebd
cmp eax, 0x3f
je 0x403ee3
jmp 0x403f14
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x32
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x35
jmp 0x403f25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x32
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
jmp 0x403f25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x42
jmp 0x403f25
movzx eax, byte [0x6ef459]
test al, al
je 0x403f14
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x46
jmp 0x403f25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx]
mov byte [eax], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x403e42
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
cmp byte [ebp - 0x1c], 0
je 0x403f50
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
jmp 0x403f5b
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00404629
nop
leave
ret
Function at 0x412a02
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jne 0x412a28
mov eax, 0
jmp 0x412bb1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x412a52
add dword [ebp + 8], 1
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x412a48
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x3a
je 0x412a52
mov eax, 0
jmp 0x412bb1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x1c], 0
jmp 0x412b62
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
movzx eax, byte [eax]
movsx eax, al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.0043ebbd
test al, al
je 0x412ac8
shl dword [ebp - 0x1c], 4
cmp dword [ebp - 0x20], 0x40
jg 0x412a9b
mov eax, dword [ebp - 0x20]
sub eax, 0x30
jmp 0x412aa9
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.0043ebfd
sub eax, 0x37
or dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffff
jbe 0x412abf
mov eax, 0
jmp 0x412bb1
mov byte [ebp - 0x15], 1
jmp 0x412b62
cmp dword [ebp - 0x20], 0x3a
jne 0x412b2f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 0x15]
xor eax, 1
test al, al
je 0x412afc
cmp dword [ebp - 0x14], 0
je 0x412aef
mov eax, 0
jmp 0x412bb1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x412b62
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jne 0x412b0e
mov eax, 0
jmp 0x412bb1
cmp dword [ebp - 0x10], 0xe
jle 0x412b1e
mov eax, 0
jmp 0x412bb1
add dword [ebp - 0x10], 2
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x1c], 0
jmp 0x412b62
cmp dword [ebp - 0x20], 0x2e
jne 0x412b5b
cmp dword [ebp - 0x10], 0xc
jg 0x412b5b
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0041292f
test al, al
je 0x412b5b
add dword [ebp - 0x10], 4
mov byte [ebp - 0x15], 0
jmp 0x412b6e
mov eax, 0
jmp 0x412bb1
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jb 0x412a68
cmp byte [ebp - 0x15], 0
je 0x412b85
cmp dword [ebp - 0x10], 0xe
jle 0x412b81
mov eax, 0
jmp 0x412bb1
add dword [ebp - 0x10], 2
cmp dword [ebp - 0x14], 0
je 0x412b9f
cmp dword [ebp - 0x10], 0x10
jne 0x412b98
mov eax, 0
jmp 0x412bb1
mov dword [ebp - 0x10], 0x10
cmp dword [ebp - 0x10], 0x10
je 0x412bac
mov eax, 0
jmp 0x412bb1
mov eax, 1
leave
ret
Function at 0x41765e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
movzx eax, byte [0x6ef42b]
movzx eax, al
test eax, eax
je 0x4176a0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str._writing_BODY_file__s_...
call fcn.004232e5
mov dword [esp + 4], 0x657f18
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4176c6
mov eax, 0xffffffff
jmp 0x417834
jmp 0x4177b5
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
mov dword [esp], 0x6e51c0
call sub.msvcrt.dll_fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4176fc
jmp 0x4177e1
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp - 0x18]
cdq
cmp ebx, edx
jl 0x417720
cmp ebx, edx
jg 0x41771c
cmp ecx, eax
jbe 0x417720
mov ecx, eax
mov ebx, edx
mov dword [ebp - 0x1c], ecx
fld1
fchs
fstp qword [esp + 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6e51c0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402aa2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jns 0x417763
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0xffffffff
jmp 0x417834
cmp dword [ebp + 0x18], 0
je 0x4177ab
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6e51c0
call fcn.00462be1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
je 0x4177ab
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffe
jmp 0x417834
mov eax, dword [ebp - 0x1c]
cdq
add dword [ebp - 0x10], eax
adc dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x4177e1
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x2c]
jl 0x4176cb
cmp edx, dword [ebp - 0x2c]
jg 0x4177e1
cmp eax, dword [ebp - 0x30]
jb 0x4176cb
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x2c]
jg 0x417815
cmp edx, dword [ebp - 0x2c]
jl 0x417801
cmp eax, dword [ebp - 0x30]
jae 0x417815
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x417834
movzx eax, byte [0x6ef42b]
movzx eax, al
test eax, eax
je 0x41782f
mov dword [esp], str.done__n
call fcn.004232e5
mov eax, 0
add esp, 0x54
pop ebx
pop ebp
ret
Function at 0x42052e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 0x228
mov dword [esp + 4], 0
mov dword [esp], 0x6ef2c0
call sub.msvcrt.dll_memset
mov byte [0x6ef491], 1
mov dword [0x6ef2c0], 0xffffffff
mov dword [0x6ef2c8], 0x14
mov dword [0x6ef2dc], 5
mov byte [0x6ef2e8], 1
mov byte [0x6ef3a0], 1
mov byte [0x6ef3a1], 1
mov byte [0x6ef43f], 1
mov byte [0x6ef3b0], 1
mov byte [0x6ef3b1], 1
mov byte [0x6ef43d], 0
mov dword [esp], str.no_proxy
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4205cb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004329dc
mov dword [0x6ef3c0], eax
mov dword [0x6ef4c4], 2
mov byte [0x6ef3b2], 1
mov byte [0x6ef42d], 1
fld qword [0x65a8f8]
fstp qword [0x6ef3e0]
mov byte [0x6ef410], 1
mov byte [0x6ef43e], 1
mov dword [0x6ef448], 0x400
mov dword [0x6ef44c], 0
mov dword [0x6ef454], 0xa
mov dword [0x6ef450], 0x32
mov byte [0x6ef34c], 1
mov byte [0x6ef3a2], 1
mov byte [0x6ef359], 1
mov dword [0x6ef464], 1
mov byte [0x6ef48d], 1
mov byte [0x6ef48e], 0
mov byte [0x6ef48f], 0
mov byte [0x6ef490], 0
mov dword [0x6ef4b4], 2
mov byte [0x6ef4b8], 1
mov byte [0x6ef4b9], 0
mov dword [0x6ef4bc], 0
mov dword [0x6ef338], 0
mov dword [0x6ef2d4], 0x14
fld qword [0x65a900]
fstp qword [0x6ef408]
mov byte [0x6ef4ca], 1
mov dword [0x6ef4d0], 0
mov dword [0x6ef4cc], 0
mov byte [0x6ef4d5], 1
mov byte [0x6ef4d6], 0
mov dword [0x6ef370], 0
mov dword [0x6ef374], 0
mov byte [0x6ef378], 1
mov byte [0x6ef379], 1
mov byte [0x6ef37a], 0
mov dword [0x6ef368], 0
mov dword [0x6ef364], 0
mov byte [0x6ef37b], 1
mov dword [0x6ef390], 0xffffffff
mov dword [0x6ef394], 0xffffffff
mov dword [0x6ef3cc], 0xffffffff
mov byte [0x6ef3d0], 0
mov byte [0x6ef4dc], 1
leave
ret

Function at 0x4207b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.WGETRC
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x420829
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x420829
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00432da6
xor eax, 1
test al, al
je 0x42081c
mov eax, dword [0x6ef280]
mov edx, dword [sym.imp.msvcrt.dll__iob]
lea ecx, [edx + 0x40]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_WGETRC_points_to__s__which_doesnt_exist._n
mov dword [esp], ecx
call fcn.0046284c
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004477e1
jmp 0x42082e
mov eax, 0
leave
ret
Function at 0x420b71
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 9], 1
mov dword [esp], str.SYSTEM_WGETRC
call sub.msvcrt.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x420bf3
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00432da6
test al, al
je 0x420bf3
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00420940
movzx edx, byte [ebp - 9]
movzx eax, al
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x420bf1
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edx, [eax + 0x40]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Parsing_system_wgetrc_file__env_SYSTEM_WGETRC__failed.__Please_check_n_s__nor_specify_a_different_file_using___config._n
mov dword [esp], edx
call fcn.0046284c
mov dword [esp], 2
call sub.msvcrt.dll_exit
jmp 0x420c20
mov dword [esp], 0x65a4d0
call fcn.00432da6
test al, al
je 0x420c20
mov dword [esp], 0x65a4d0
call fcn.00420940
movzx edx, byte [ebp - 9]
movzx eax, al
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x420c57
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 8], 0x65a4d0
mov dword [esp + 4], str.Parsing_system_wgetrc_file_failed.__Please_check_n_s__nor_specify_a_different_file_using___config._n
mov dword [esp], eax
call fcn.0046284c
mov dword [esp], 2
call sub.msvcrt.dll_exit
call fcn.004208b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x420c6a
jmp 0x420cfc
mov dword [esp + 4], 0x65a4d0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x420cb6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00447320
mov ecx, eax
mov eax, dword [0x6ef280]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Warning:_Both_system_and_user_wgetrc_point_to__s._n
mov dword [esp], edx
call fcn.0046284c
jmp 0x420cd2
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00420940
movzx edx, byte [ebp - 9]
movzx eax, al
and eax, edx
test eax, eax
setne al
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x420ce9
mov dword [esp], 2
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.006324d0
mov dword [ebp - 0x14], 0
nop
leave
ret
Function at 0x42272b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jmp 0x422748
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422765
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x422744
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422793
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x422781
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2b
jne 0x422793
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2d
sete al
mov byte [ebp - 0xd], al
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x4227a5
mov eax, 0
jmp 0x422885
movzx eax, byte [ebp - 0xd]
xor eax, 1
test al, al
je 0x42280c
jmp 0x4227ed
mov edx, dword [ebp - 0xc]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jge 0x4227e3
mov eax, 0
jmp 0x422885
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422869
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043ead4
test al, al
jne 0x4227b2
jmp 0x422869
jmp 0x42284c
mov edx, dword [ebp - 0xc]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov ecx, 0x30
sub ecx, eax
mov eax, ecx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jle 0x422842
mov eax, 0
jmp 0x422885
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x422869
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043ead4
test al, al
jne 0x42280e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
je 0x422878
mov eax, 0
jmp 0x422885
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 1
leave
ret

Function at 0x4229d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x4229e4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x422a10
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3a
je 0x422a10
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
xor eax, 1
test al, al
jne 0x4229e0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x422a22
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x422a29
mov eax, 0
jmp 0x422a4c
mov dword [esp + 4], 0xa
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x422a47
mov eax, 0
jmp 0x422a4c
mov eax, 1
leave
ret
Function at 0x4232e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [0x6ef42b]
test al, al
je 0x42334e
call fcn.004239e7
movzx eax, byte [0x6e7248]
test al, al
jne 0x42334e
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00422fc1
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
jne 0x423321
leave
ret

Function at 0x42d0b8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ebx, eax
mov eax, dword [0x6ef430]
cdq
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004340bf
add eax, ebx
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00625290
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0xf]
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.00625290
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00462660
test eax, eax
jne 0x42d17f
movzx eax, word [ebp - 0x42]
movzx eax, ax
and eax, 0xf000
cmp eax, 0x8000
jne 0x42d236
mov eax, dword [0x6ef430]
mov dword [ebp - 0xc], eax
jmp 0x42d1f4
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x65ff47
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_d
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0042b154
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x65ff47
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_d
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0042b154
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_rename
sub dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 1
jg 0x42d189
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x65ff47
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_d
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0042b154
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_rename
mov ebx, dword [ebp - 4]
leave
ret