joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566c40
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x566c6e
call fcn.005629a0
push ebx
push str.File_does_not_exist_at__s
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 0xc
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x566c67
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call fcn.005629a0
mov esi, eax
mov edi, dword [esi]
call ebx
push eax
push dword [ebp + 8]
push str.Failed_to_delete_file_at_path:_ls_error:_d
push esi
call dword [edi + 4]
mov al, byte [ebp - 1]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x566cc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
jne 0x566d24
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push dword [ebp + 8]
push str.Failed_to_open_the_file_handle_at__s._Error___d_
push 0x5b4948
push edi
call dword [ebx + 0x24]
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005629a0
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push esi
mov ecx, dword [eax]
push edi
push str.file_size_to_which_we_have_to_extend_is__llu
push eax
call dword [ecx + 4]
add esp, 0x10
push 0
push 0
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x566d98
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x566d70
push ebx
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push str.Failed_to_set_the_end_of_the_file_to_size__llu._Error____d
jmp 0x566dbe
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push str.Failed_to_resize_the_file_to_size__ld._Error____d
push 0x5b4948
push edi
call dword [ebx + 0x24]
mov ebx, dword [ebp - 8]
add esp, 0x18
mov byte [ebp - 1], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5670a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x5670b7
xor al, al
pop esi
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5670f2
push edi
call fcn.005629a0
mov esi, eax
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str.Failed_to_get_the_directory_attributes_for____s._Error_is__d.
push 0x5b4948
push esi
call dword [edi + 0x24]
add esp, 0x14
xor al, al
pop edi
pop ebx
pop esi
pop ebp
ret
call fcn.005629a0
push ebx
push esi
push str.The_file_attributes_of_directory____s_is__d
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
add esp, 0x10
shr ebx, 4
and bl, 1
mov al, bl
pop ebx
pop esi
pop ebp
ret

Function at 0x567120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56714a
call fcn.005629a0
push dword [ebp + 8]
push str.File_does_not_exist_at__s
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
add esp, 0xc
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret

Function at 0x567180
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x5671df
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5671df
push ebx
push eax
call fcn.005293bd
add esp, 8
test eax, eax
je 0x5671da
push esi
push edi
call fcn.0052659e
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
call fcn.005629a0
mov esi, eax
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push dword [ebp + 0xc]
push str.Failed_to_rename_file_from__s_to__s._The_error_is_:_d
push 0x5b4948
push esi
call dword [edi + 0x24]
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
call fcn.005629a0
push 0x5aa8e4
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
xor al, al
pop ebx
pop ebp
ret

Function at 0x5673a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test edi, edi
jne 0x5673b9
xor al, al
pop edi
pop ebp
ret
lea eax, [edi*2 + 2]
push esi
push eax
call fcn.0052416a
mov esi, eax
add esp, 4
test esi, esi
je 0x5673e5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
test eax, eax
jne 0x5673eb
call fcn.00524165
add esp, 4
pop esi
xor al, al
pop edi
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.0044d3e0
push esi
call fcn.00524165
add esp, 4
mov al, 1
pop esi
pop edi
pop ebp
ret
Function at 0x569640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [edi], 0
jne 0x56966d
call fcn.005629a0
push str.file_handler_to_read_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebx + 8]
push esi
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00567410
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x5696ed
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 8]
push 0
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp + 8], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp + 0x18], eax
cmp dword [ebp + 8], esi
jb 0x5696b9
test eax, eax
jne 0x569720
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.failed_to_read_data._Error_code____d
push 0x5b4948
push edi
call dword [ebx + 0x24]
mov esi, dword [ebp + 0x18]
add esp, 0x10
jmp 0x569722
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.file_pointer_set_error____d
push 0x5b4948
push edi
call dword [ebx + 0x24]
add esp, 0x10
xor esi, esi
jmp 0x569722
mov esi, eax
mov ecx, dword [ebp - 4]
call fcn.00567430
xor eax, eax
cmp esi, 1
pop esi
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x569780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [edi], 0
jne 0x5697ad
call fcn.005629a0
push str.file_handler_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebx + 8]
push esi
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00567410
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x56981d
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 8]
push 0
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp + 8], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [ebp + 8], esi
jb 0x5697f8
test edi, edi
jne 0x56984e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.failed_to_write_data._Error_code____d
jmp 0x569840
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.005629a0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.file_pointer_set_error____d
push 0x5b4948
push edi
call dword [ebx + 0x24]
add esp, 0x10
xor edi, edi
mov ecx, dword [ebp - 4]
call fcn.00567430
xor eax, eax
cmp edi, 1
pop esi
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x56f4d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x579480
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5df3f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov dword [esi], vtable.WorkerThread.0
test eax, eax
je 0x56f544
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x56f534
call fcn.005629a0
push edi
push dword [esi + 0x38]
mov ecx, dword [eax]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push eax
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
lea ecx, [esi + 8]
call fcn.00567420
lea ecx, [esi + 8]
call fcn.0044d2f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x56f740
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
je 0x56f76a
call fcn.005629a0
push dword [esi + 0x38]
push str.thread___d__is_already_running._Closing_it_first
mov edx, dword [eax]
push eax
call dword [edx + 4]
add esp, 0xc
mov ecx, esi
call fcn.0056f990
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x56f570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x56f7a6
call fcn.005629a0
push str.failed_to_create_a_new_thread._Fatal_Error
push 0x5b4948
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x56f7e1
call fcn.005629a0
push str.thread_failed_to_resumed._fatal_error
push 0x5b4948
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [esi + 0x38], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56f990
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x56fa91
push edi
lea ecx, [esi + 8]
mov dword [esi + 0x34], 2
call fcn.00567410
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x56fa36
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [esi + 0x28]
xor edi, edi
cmp dword [eax + 8], 3
je 0x56fa36
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 5
je 0x56fa35
inc edi
cmp edi, 0x12c
jne 0x56fa05
call fcn.005629a0
mov ecx, dword [esi + 0x28]
mov edx, dword [eax]
push dword [ecx + 4]
push str.forcing_the_job___d__to_terminate.
push eax
call dword [edx + 0x14]
mov ecx, dword [esi + 0x28]
add esp, 0xc
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x56fa0d
cmp edi, 0x3e8
je 0x56fa1c
push 0xa
call ebx
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 3
jne 0x56f9d0
jmp 0x56fa35
call fcn.005629a0
mov edx, dword [esi + 0x28]
mov edi, dword [eax]
push dword [edx + 4]
push str.job___d__is_still_not_terminated._Closing_the_thread_handle_now
push eax
call dword [edi + 0x14]
add esp, 0xc
pop ebx
lea ecx, [esi + 8]
call fcn.00567430
mov eax, dword [esi + 0x24]
test eax, eax
je 0x56fa89
push 0x61a8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x56fa79
call fcn.005629a0
push edi
push dword [esi + 0x38]
mov ecx, dword [eax]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push eax
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
mov dword [esi + 0x34], 3
pop edi
mov al, 1
pop esi
ret
Function at 0x5720e0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
jne 0x572112
sub esp, 0x18
mov ecx, esp
push 0x5b4948
call fcn.0044d0f0
push 0
push 0x13
mov ecx, esi
call fcn.00573470
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x57212d
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esi + 0xb0], 0
mov eax, dword [esi + 0x24]
mov edi, 0x100
mov ecx, 0x800100
lea edx, [eax + 0x138]
cmp dword [eax + 0x154], 1
cmove edi, ecx
cmp dword [edx + 0x14], 8
jb 0x572152
mov edx, dword [edx]
cmp dword [esi + 0x90], 8
lea eax, [esi + 0x7c]
jb 0x572160
mov eax, dword [eax]
cmp dword [esi + 0xa8], 8
lea ecx, [esi + 0x94]
jb 0x572171
mov ecx, dword [ecx]
push edi
push 0
push edx
push 0
push eax
push ecx
push dword [esi + 0xac]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0xb0], eax
test eax, eax
jne 0x5721ba
call fcn.005629a0
push str.createRequest_:_failed_to_open_the_request_handle
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00572c30
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5721d0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
je 0x57232d
cmp byte [esi + 0x28], 0
je 0x57232d
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
mov dword [ebx], 0
push dword [esi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x572249
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
mov ecx, esi
call fcn.00572c30
call fcn.005629a0
mov esi, eax
mov edi, dword [esi]
call ebx
push eax
push str.Error__d_in_WinHttpQueryDataAvailable._n
push 0x5b4948
push esi
call dword [edi + 0x24]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x14]
cmova ecx, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x572266
lea eax, [ecx + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
je 0x5722c6
push 0x5af9a4
push ecx
call fcn.00576111
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x5722c3
call fcn.005629a0
push dword [ebp - 4]
push str.failed_to_allote_mmeory_of_size__d
mov ecx, dword [eax]
push 0x5b4948
push eax
call dword [ecx + 0x24]
sub esp, 8
mov ecx, esp
push 0x5b4948
call fcn.0044d0f0
push 0
push 0x14
mov ecx, esi
call fcn.00573470
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
push ecx
push 0
push dword [edi]
call fcn.00510680
add esp, 0xc
push ebx
push dword [ebp - 4]
push dword [edi]
push dword [esi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x57231a
call fcn.005629a0
push str.Error__u_in_WinHttpReadData._n
push 0x5b4948
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00572c30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.005629a0
push str.downloader_is_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x5b4948
mov word [ecx], ax
call fcn.0044d430
push 0
push 0x13
mov ecx, esi
call fcn.00573470
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x572790
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
push 0
push eax
push 0
mov edi, ecx
mov dword [ebp - 4], 0
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x24
jne 0x5727cc
cmp eax, 0x2f76
je 0x5727d9
cmp eax, 0x7a
je 0x5727e4
push eax
mov ecx, edi
call fcn.00572c30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
test eax, eax
jne 0x57280e
call fcn.005629a0
push str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
push 0x5b4948
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x5af9a4
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00576111
mov esi, eax
add esp, 8
test esi, esi
jne 0x57286d
call fcn.005629a0
push str.failed_to_allocate_memory
push 0x5b4948
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
sub esp, 0xc
mov ecx, esp
push str.Memory_Allocation_Failed
call fcn.0044d0f0
push esi
push 0x14
mov ecx, edi
call fcn.00573470
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 4]
push eax
push esi
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x5728a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.00572c30
push esi
call fcn.0050ad96
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0044d3e0
push esi
call fcn.0050ad96
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5729b0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0
push 0x16
push dword [edi]
mov dword [ebp - 4], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x572a38
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0050ad9b
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push 0
push 0x16
push dword [edi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x572a2a
call fcn.005629a0
push esi
push str.Header_contents:__n_s
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
add esp, 0xc
test esi, esi
je 0x572a37
push esi
call fcn.0050ad96
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
mov esi, 4
push str.SoftwareRealtekInitAP
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401fb9
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.InitChannel
push ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401fae
mov edx, dword [esp + 0x10]
push edx
push str.Current_preset_channel_is__d._n
call fcn.0040287b
mov eax, dword [esp + 0xc]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x402320
Capabilities:
Enumerate gui resources

Disassembly:
push 0
push 0x402340
call sub.DSOUND.dll_DirectSoundEnumerateA
jmp 0x402440
push ecx
push 0
push 0x4023c0
mov dword [0x40a66c], 0
mov dword [esp + 8], 0
call dword [sym.imp.USER32.dll_EnumWindows]
push str.FRONT_PANEL_MESSAGE
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [0x40a66c]
test ecx, ecx
je 0x4024b7
mov dl, byte [0x40a658]
cmp dl, 1
je 0x40249c
cmp dl, 4
je 0x40249c
cmp dl, 6
jne 0x402493
mov dx, word [0x409ecc]
jmp 0x4024a3
mov dx, word [0x409ec4]
jmp 0x4024a3
mov dx, word [0x409ec8]
mov word [esp], dx
mov edx, dword [esp]
push 2
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop ecx
ret
Function at 0x403e2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [eax*8 + 0x40a310]
je 0x403e46
inc eax
cmp eax, 0x13
jb 0x403e37
push esi
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40a310]
mov dword [ebp + 8], esi
jne 0x403f8c
mov eax, dword [0x40a6c8]
cmp eax, 1
push ebx
je 0x403f5c
test eax, eax
jne 0x403e7b
cmp dword [0x409f64], 1
je 0x403f5c
cmp ecx, 0xfc
je 0x403f8b
push edi
push 6
pop ecx
mov esi, str.Runtime_Error__n_nProgram:
mov edi, 0x40a6e0
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x40a6fa
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x40a7fe], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403ec9
push 5
pop ecx
mov esi, str._program_name_unknown_
mov edi, 0x40a6fa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403ece
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x403f01
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403ee2
sub eax, edx
push 3
lea eax, [eax + 0x40a6bf]
push 0x407b8c
push eax
call fcn.004052d0
add esp, 0xc
mov edx, 0x40a6e0
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403f09
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40a314]
mov esi, 0x407b88
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f24
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403f30
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.004051cd
add esp, 0xc
pop edi
jmp 0x403f8b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x403f8b
mov esi, dword [esi + 0x40a314]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x403f73
push 0
sub ecx, edx
lea edx, [ebp - 4]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret