joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42daaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42daec
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043ea20
xor eax, 1
test al, al
je 0x42daf3
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x42daf3
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2b
je 0x42daf3
mov eax, 0
jmp 0x42db3b
add dword [ebp - 0xc], 1
jmp 0x42dafd
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42db30
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043ea20
test al, al
jne 0x42daf9
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x42daf9
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2b
je 0x42daf9
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3a
sete al
leave
ret

Function at 0x4306d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00626920
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00626de0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
lea eax, [ebp - 0x21]
mov dword [esp], eax
call fcn.0043411f
lea eax, [ebp - 0x21]
mov dword [esp + 4], eax
mov dword [esp], str.Content_Length
call fcn.00430693
mov dword [esp], 0x6604fb
call fcn.004304f8
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00626920
test eax, eax
je 0x43076d
mov byte [0x6e9e40], 0
jmp 0x430790
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x221]
mov dword [esp], eax
call fcn.00430480
cmp eax, dword [ebp - 0xc]
jae 0x430790
mov byte [0x6e9e40], 0
movzx eax, byte [0x6e9e40]
test al, al
je 0x4307c9
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
lea eax, [ebp - 0x221]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43076f
movzx eax, byte [0x6e9e40]
leave
ret
Function at 0x43340c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x433427
mov eax, 1
jmp 0x4334d8
movzx eax, byte [0x6ef324]
xor eax, 1
test al, al
je 0x433465
jmp 0x43343f
add dword [ebp + 8], 1
add dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x4334ab
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x4334ab
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp dl, al
je 0x433437
jmp 0x4334ab
jmp 0x43346f
add dword [ebp + 8], 1
add dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x4334ab
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x4334ab
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043ebe2
mov ebx, eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043ebe2
cmp ebx, eax
je 0x433467
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x4334d0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x4334c9
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp al, 0x2f
jne 0x4334d0
mov eax, 1
jmp 0x4334d5
mov eax, 0
and eax, 1
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x43387c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x2d
jne 0x4338b3
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
test al, al
jne 0x4338b3
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x11], 1
jmp 0x4338c9
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0044e8c5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x4338d9
mov eax, 0
jmp 0x433a4c
mov dword [esp], 0xc
call fcn.004476ac
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
mov dword [ebp - 0x10], 0x200
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004476ac
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
cmp edx, eax
jle 0x43393f
shl dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004476d6
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll__read
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
js 0x43399e
cmp dword [ebp - 0x1c], 0
jg 0x433987
cmp dword [ebp - 0x20], 0
jbe 0x43399e
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x20]
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
jmp 0x4339c0
cmp dword [ebp - 0x1c], 0
jns 0x4339b2
nop
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x433a1f
jmp 0x433a14
nop
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x4339d0
jmp 0x4339c5
jmp 0x43390b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004480da
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x10]
jge 0x433a05
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
test eax, eax
je 0x433a05
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004476d6
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x18]
jmp 0x433a4c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004480da
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.006324d0
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.006324d0
mov dword [ebp - 0x18], 0
mov eax, 0
leave
ret
Function at 0x43a3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x43a541
jmp 0x43a3e5
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp + 0xc]
jae 0x43a40a
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a3e1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x43a450
jmp 0x43a42d
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp + 0xc]
jae 0x43a447
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
cmp al, 0x3b
jne 0x43a429
add dword [ebp - 0x18], 1
jmp 0x43a541
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0xc], eax
jmp 0x43a461
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jae 0x43a47e
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a45d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x43a490
mov eax, 0
jmp 0x43a563
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x3d
je 0x43a4a3
add dword [ebp - 0x18], 1
jmp 0x43a541
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x43a4b2
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jae 0x43a4cf
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a4ae
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x43a4e1
mov eax, 0
jmp 0x43a563
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x43a4f0
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x43a51a
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3b
je 0x43a51a
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
xor eax, 1
test al, al
jne 0x43a4ec
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub edx, eax
mov eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00447838
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, 1
jmp 0x43a563
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
add eax, edx
cmp eax, dword [ebp + 0xc]
jb 0x43a3df
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 0
leave
ret
Function at 0x43a667
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jmp 0x43a696
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3b
je 0x43a689
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x2c
jne 0x43a692
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp + 8], eax
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x43a6a8
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
cmp al, 0x3d
jne 0x43a675
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jb 0x43a6ba
mov eax, 0
jmp 0x43a7e5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x43a6c6
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0x43a6e3
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a6c2
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x43a6f2
sub dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x43a70f
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a6ee
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x43a722
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jae 0x43a73f
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a71e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x43a74b
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jae 0x43a77f
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x3b
je 0x43a77f
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x2c
je 0x43a77f
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
xor eax, 1
test al, al
jne 0x43a747
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub edx, eax
mov eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00447838
mov edx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub edx, eax
mov eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00447838
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x43a7c5
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jae 0x43a7e2
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0043eb7e
test al, al
jne 0x43a7c1
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x43b516
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6ea030]
mov dword [esp], eax
call fcn.006324d0
mov dword [0x6ea030], 0
mov eax, dword [0x6ea034]
mov dword [esp], eax
call fcn.006324d0
mov dword [0x6ea034], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 0x14
mov dword [esp], eax
call fcn.004476ac
mov dword [0x6ea030], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004477e1
mov dword [0x6ea034], eax
mov dword [0x636780], 0xffffffff
mov edx, dword [0x6ea034]
mov eax, dword [0x6ea030]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Wget__s
mov dword [esp], eax
call fcn.0043ada8
mov eax, dword [0x6ea030]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call eax
sub esp, 4
leave
ret

Function at 0x43b5b2
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6ea030]
test eax, eax
je 0x43b5d6
mov eax, dword [0x6ea034]
test eax, eax
jne 0x43b5db
jmp 0x43b686
fld qword [ebp - 0x20]
fnstcw word [ebp - 0x22]
movzx eax, word [ebp - 0x22]
mov ah, 0xc
mov word [ebp - 0x24], ax
fldcw word [ebp - 0x24]
fistp dword [ebp - 0xc]
fldcw word [ebp - 0x22]
cmp dword [ebp - 0xc], 0
jns 0x43b601
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0x64
jle 0x43b60e
mov dword [ebp - 0xc], 0x64
mov eax, dword [0x636780]
cmp dword [ebp - 0xc], eax
jne 0x43b61a
jmp 0x43b686
mov eax, dword [ebp - 0xc]
mov dword [0x636780], eax
mov edx, dword [0x6ea034]
mov eax, dword [0x6ea030]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Wget___d_____s
mov dword [esp], eax
call fcn.0043ada8
mov eax, dword [0x6ea030]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call eax
sub esp, 4
fld qword [ebp - 0x20]
fld qword [0x6618d8]
fmulp st(1)
fnstcw word [ebp - 0x22]
movzx eax, word [ebp - 0x22]
mov ah, 0xc
mov word [ebp - 0x24], ax
fldcw word [ebp - 0x24]
fistp dword [ebp - 0x28]
fldcw word [ebp - 0x22]
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00438e1c
leave
ret
Function at 0x43b775
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov word [ebp - 0xa], 0x101
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b7d6
mov eax, dword [0x6ef280]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Couldnt_find_usable_socket_driver._n
mov dword [esp], edx
call fcn.0046284c
mov dword [esp], 1
call sub.msvcrt.dll_exit
movzx eax, word [ebp - 0x1a0]
cmp ax, word [ebp - 0xa]
jae 0x43b818
mov eax, dword [0x6ef280]
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_Couldnt_find_usable_socket_driver._n
mov dword [esp], edx
call fcn.0046284c
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], 0x43aeb9
call fcn.006242e0
call fcn.0043b72f
mov dword [esp + 4], 1
mov dword [esp], 0x43b50a
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call eax
sub esp, 8
leave
ret
Function at 0x43b88b
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
movzx eax, byte [0x6ef42b]
movzx eax, al
test eax, eax
je 0x43b8be
fld qword [ebp - 0x30]
fstp qword [esp + 4]
mov dword [esp], str.seconds__.2f_
call fcn.004232e5
fld qword [ebp - 0x30]
fldz
fucompi st(1)
fstp st(0)
jp 0x43b8e9
fld qword [ebp - 0x30]
fldz
fucompi st(1)
fstp st(0)
jne 0x43b8e9
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
call eax
mov eax, 0
jmp 0x43ba1f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x43b844
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43b96e
movzx eax, byte [0x6ef42b]
movzx eax, al
test eax, eax
je 0x43b969
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.CreateThread___failed____lx__n
call fcn.004232e5
jmp 0x43b8d4
jmp 0x43b8d4
fld qword [ebp - 0x30]
fld qword [0x6618c8]
fmulp st(1)
fnstcw word [ebp - 0x32]
movzx eax, word [ebp - 0x32]
mov ah, 0xc
mov word [ebp - 0x34], ax
fldcw word [ebp - 0x34]
fistp qword [ebp - 0x40]
fldcw word [ebp - 0x32]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
test eax, eax
jne 0x43b9e8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSASetLastError]
call eax
sub esp, 4
movzx eax, byte [0x6ef42b]
movzx eax, al
test eax, eax
je 0x43b9e2
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Winsock_error:__d_n
call fcn.004232e5
mov byte [ebp - 9], 0
jmp 0x43ba04
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0x10], 0
movzx eax, byte [ebp - 9]
leave
ret

Function at 0x43f688
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
pop ebp
ret
Function at 0x4407ac
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
pop ebp
ret

Function at 0x440b14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov dword [esp], 0x8048
call fcn.0044d5b4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x440b3c
mov eax, 1
jmp 0x440c35
lea eax, [ebp - 0xb4]
mov dword [esp], eax
call fcn.004407ac
mov dword [ebp - 0xc], 0
mov eax, 0x8000
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
add ecx, edx
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ecx
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x8000
jne 0x440b90
jmp 0x440bcc
cmp dword [ebp - 0x14], 0
jne 0x440bb9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x440bb7
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.006324d0
mov eax, 1
jmp 0x440c35
jmp 0x440bee
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
je 0x440bca
jmp 0x440bee
jmp 0x440b51
lea eax, [ebp - 0xb4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8000
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00440e70
jmp 0x440b4a
cmp dword [ebp - 0xc], 0
je 0x440c10
lea eax, [ebp - 0xb4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00440c81
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0xb4]
mov dword [esp], eax
call fcn.00440981
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.006324d0
mov eax, 0
leave
ret

Function at 0x4423c4
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
pop ebp
ret
Function at 0x442438
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x367cd507
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3070dd17
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xf70e5939
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0xffc00b31
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x68581511
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x64f98fa7
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0xbefa4fa4
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
pop ebp
ret

Function at 0x4427af
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov dword [esp], 0x8048
call fcn.0044d5b4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4427d7
mov eax, 1
jmp 0x4428d0
lea eax, [ebp - 0xc0]
mov dword [esp], eax
call fcn.004423c4
mov dword [ebp - 0xc], 0
mov eax, 0x8000
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
add ecx, edx
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ecx
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x8000
jne 0x44282b
jmp 0x442867
cmp dword [ebp - 0x14], 0
jne 0x442854
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x442852
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.006324d0
mov eax, 1
jmp 0x4428d0
jmp 0x442889
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
je 0x442865
jmp 0x442889
jmp 0x4427ec
lea eax, [ebp - 0xc0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8000
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00442c78
jmp 0x4427e5
cmp dword [ebp - 0xc], 0
je 0x4428ab
lea eax, [ebp - 0xc0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00442a89
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc0]
mov dword [esp], eax
call fcn.00442765
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.006324d0
mov eax, 0
leave
ret