joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f222
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fb60
call fcn.1005e6e0
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002f2f6
mov dword [ebp - 0x20], 0x344d
cmp dword [ebp - 0x20], 0x374c
jle 0x1002f29c
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], 0x24bf
mov ebx, edi
mov dword [ebp - 0x14], 0x6ec9
xor esi, esi
mov eax, ebx
mov ecx, 0x1007ab78
xor eax, esi
cdq
push edx
push eax
call fcn.10001bfe
inc esi
cmp esi, 0x4b1b
jl 0x1002f266
inc ebx
dec dword [ebp - 0x14]
jne 0x1002f264
mov esi, dword [ebp - 0x1c]
add edi, esi
dec dword [ebp - 0x18]
jne 0x1002f25b
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x67b
jl 0x1002f252
cmp byte [ebp + 8], 0
je 0x1002f2ac
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x1002f2be
push 0xf8a
push 0xdcf
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x33d7
jge 0x1002f2da
mov edx, str.winzkbm_xvztqez_znwxl_bgorlam_rqmtru_msatz_xenkqxrl_bltub_tnlavbev_pjb_ahzwf_xfyq
mov ecx, 0x1007ab78
call fcn.100039fb
jmp 0x1002f30a
push 0
push edx
mov edx, 0x40e8
mov ecx, 0xf6a
call fcn.1002f1f7
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002f33b
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], ebx
push esi
push edi
cmp edx, 0xa9a07b
jae 0x1002f35f
sub dword [0x1007a5e8], 0x6c3fea45
mov dword [esp + 0x1c], 0x73be
cmp dword [esp + 0x1c], 0x7555
jle 0x1002f40b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor esi, esi
mov dword [esp + 0x18], esi
mov ebx, esi
mov dword [esp + 0x14], 0x6f5c
mov dword [esp + 0x10], ebx
xor edi, edi
mov ecx, edi
mov dword [esp + 0x20], ebx
xor esi, esi
sar ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002f3c1
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10002050
inc esi
cmp esi, 0x6492
jl 0x1002f3a5
mov ebx, dword [esp + 0x10]
inc edi
cmp edi, 0x308f
jl 0x1002f39b
dec ebx
dec dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jne 0x1002f399
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x3339
jl 0x1002f38b
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x1c], 0x70e6
jge 0x1002f420
push str.kgrczgc_wjialsa_zmfgnt_elklva_ero_pfrcrj_rnwgnjwy_kfm_nfbxh_gqlvoynb_vtsphvtln_nmdx
call fcn.10047d34
pop ecx
mov eax, dword [0x110936d0]
test al, 1
jne 0x1002f43d
or eax, 1
mov dword [0x110936d0], eax
call fcn.10044764
mov dword [0x1109372c], eax
jmp 0x1002f442
mov eax, dword [0x1109372c]
mov eax, dword fs:[eax]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fdc0
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005fb90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002ff3a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002fe38
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002fe33
push 0
push 0x83
push 0x289a
push 0x4354
call fcn.10030a0d
add esp, 0x10
jmp 0x1002ff38
mov dword [ebp - 0x24], 0x66e6
mov dword [ebp - 0x3c], str.agkvzcu_fcbqok_rbnwx_bfmiv_evv_uwkxvwvo_vdafbvmfy_ltpskia_wajji_gpdrpgy_nes
cmp dword [ebp - 0x24], 0x6993
jle 0x1002fed9
and dword [ebp - 0x18], 0
jmp 0x1002fe60
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x327a
jge 0x1002fed9
and dword [ebp - 0x1c], 0
jmp 0x1002fe76
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1387
jge 0x1002fed7
and dword [ebp - 0x20], 0
jmp 0x1002fe8c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x799f
jge 0x1002fed5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.10001bde
push eax
call fcn.10047d34
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.10001bd4
jmp 0x1002fe85
jmp 0x1002fe6f
jmp 0x1002fe59
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x64a9
jge 0x1002fef3
push dword [ebp - 0x3c]
call fcn.10047d34
pop ecx
jmp 0x1002ff0f
or dword [ebp - 4], 0xffffffff
jmp 0x1002ff19
lea eax, [ebp - 0x11]
push eax
push 1
push 1
push 0x2aaf
push 0x7217
push 0x2b49
call fcn.1002f4d4
add esp, 0x18
jmp 0x1002ff90
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1002ff70
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x1002ff6e
push 0xe8
push 0x884
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x1002ff90
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x1002ff90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402850
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x74
call dword [sym.imp.comctl32.dll_InitCommonControls]
mov eax, dword [ebp + 0xc]
mov dword [0x40305c], 0
mov dword [0x40306c], 1
mov dword [0x403078], 1
test eax, eax
je 0x402a30
lea eax, [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.user32.dll_RegisterClassW]
sub esp, 4
test ax, ax
jne 0x4028b0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], 0
mov dword [0x403084], 0xc8
mov dword [0x403080], 0xc8
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xc8
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], 0x404084
mov dword [esp + 4], 0x404074
mov dword [esp], 0
call dword [sym.imp.user32.dll_CreateWindowExW]
sub esp, 0x30
mov dword [0x403064], eax
call sym._CLOCK_ResetTimer
test eax, eax
je 0x40289c
mov dword [esp + 4], 0x100
lea ebx, [ebp - 0x50]
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadMenuW]
sub esp, 8
mov dword [0x403068], eax
mov dword [esp + 4], eax
mov eax, dword [0x403064]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetMenu]
sub esp, 8
call sym._CLOCK_UpdateMenuCheckmarks
call sym._CLOCK_UpdateWindowCaption
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [0x403064]
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x403064]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.user32.dll_UpdateWindow]
mov esi, dword [sym.imp.user32.dll_GetMessageW]
mov edi, dword [sym.imp.user32.dll_TranslateMessage]
sub esp, 4
jmp 0x4029cc
mov dword [esp], ebx
call edi
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.user32.dll_DispatchMessageW]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call esi
sub esp, 0x10
test eax, eax
jne 0x4029b8
mov eax, dword [0x403064]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.user32.dll_KillTimer]
mov eax, dword [0x40305c]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], 0xb
mov dword [ebp - 0x30], sym._CLOCK_WndProc_16
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadIconW]
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadCursorW]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], eax
sub esp, 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x404074
jmp 0x402888
Function at 0x402ac0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x402b30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x402bad
cmp al, 9
je 0x402ba0
cmp al, 0x20
je 0x402ba0
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp al, 0x5c
je 0x402c00
cmp al, 0x22
je 0x402c10
mov dword [ebp - 0x54], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x402bad
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x402b60
test edi, 1
jne 0x402b60
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x402ba0
cmp al, 0x20
je 0x402ba0
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x24], 1
jne 0x402bc8
mov word [ebp - 0x20], 1
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x402b77
and dword [ebp - 0x54], 1
jne 0x402b70
xor edi, 1
jmp 0x402b77
Function at 0x70cb6f31
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
lea eax, [eax - 0x76cd7325]
bswap eax
stc
xor ebx, eax
stc
test di, bx
add esi, eax
jmp 0x70b1e737
push esi
ret
ror edi, 0x19
sar al, cl
stc
cmp ebp, ebx
lea edi, [edi + ecx]
cwd
rcr si, 0x88
mov ebp, esp
lea esp, [esp - 0xc0]
xchg dh, al
add ax, 0x4c09
mov ebx, edi
bt si, ax
rol ax, 0x16
bsr esi, ecx
mov edx, 0x60940000
rcr si, 0x5f
dec al
cwde
sub ebx, edx
bts esi, esp
cmc
btc ax, 0x5e
lea esi, [0x70b976f0]
rcl al, 0xdc
mov eax, dword [edi]
add edi, 4
xor eax, ebx
cmp ax, cx
add eax, 0x655c3ca0
test eax, 0x6e5719c9
jmp 0x70a60651
push ebx
movzx ebx, cx
push edx
pushfd
mov ebx, 0x37363c2c
bswap bx
push eax
setne dl
inc ax
push esi
movzx edx, di
push ebp
push edi
rdtsc
cdq
push ecx
mov ecx, 0x60940000
cdq
mov esi, esp
rdtsc
push ecx
lahf
cdq
dec bp
mov edi, dword [esp + 0x28]
movsx ebx, bp
bswap eax
dec edi
bswap edx
rcl esi, 0x58
lahf
bswap edi
bt bx, 0xe9
rol edi, 0x10
movsx edx, di
dec edi
jmp 0x70b976ac
Function at 0x41a4590
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a4627
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a4640
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a462e
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b0884
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b08e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41b08ce
push 3
push 0x41b08f0
push 0x41b08f0
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41b08f4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b08eb
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x401058
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push ebx
push esi
push edi
push 4
push 0x3000
mov esi, 0x1e5d70
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
push eax
cmp eax, 0x11
je 0x401025
mov eax, eax
cld
test ecx, ecx
or eax, eax
clc
pop eax
test edi, edi
je 0x401054
nop
mov al, al
push 0xf1b30
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
mov cl, cl
mov cl, cl
cld
pop ebx
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
ret
push 0
push 0x40
push 0x3000
push 0x7d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
jne 0x401080
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp section..text

Function at 0x40117e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41cb47
call sub.msvcrt.dll__EH_prolog
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040e5af
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040e5af
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.0040e5af
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4020b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov ebx, 0x3e8
push ebx
lea eax, [ebp - 0x3f4]
push 0
push eax
mov dword [ebp - 8], edi
mov byte [edi + esi], 0
call sub.msvcrt.dll_memset
and dword [ebp - 4], 0
add esp, 0xc
test esi, esi
je 0x402161
mov eax, dword [ebp + 8]
sub eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0xc], eax
push str.Eric_Marienthal_was_born_on_December_19__1957
lea eax, [ebp - 0x3f4]
push eax
call edi
push str.He_initially_wanted_to_pick_up_the_trumpet_but_a_teacher
lea eax, [ebp - 0x3f4]
push eax
call edi
mov esi, dword [ebp - 4]
push dword [ebp + 0xc]
add esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
push ebx
push 0
mov al, byte [edx + eax]
xor al, byte [ecx + esi]
mov byte [esi], al
lea eax, [ebp - 0x3f4]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jb 0x402102
push ebx
lea eax, [ebp - 0x3f4]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4046a3
Capabilities:
Check http status code

Disassembly:
mov eax, 0x41cf63
call sub.msvcrt.dll__EH_prolog
sub esp, 0x598
push ebx
push esi
push edi
sub esp, 0xc
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 4], 1
call fcn.0040e5af
lea eax, [ebp - 0xa4]
push eax
call fcn.00403f45
add esp, 0x10
push 0xf
pop ecx
push 0x5f5e0ff
mov esi, eax
xor ebx, ebx
lea edi, [ebp - 0x68]
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [0x63d15c]
push eax
call dword [0x63d0f4]
push ebx
push ebx
xor edi, edi
push ebx
inc edi
push ebx
lea ecx, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
call fcn.0040e7af
push eax
call dword [0x63d058]
push dword [0x62c334]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x64]
xor esi, esi
call dword [0x63d134]
test eax, eax
jne 0x404735
mov esi, edi
cmp dword [ebp - 0x18], ebx
je 0x404869
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x58]
push dword [ebp - 0x18]
call dword [0x63d158]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x404860
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0x62c188]
push dword [ebp - 0x3c]
push 0x423558
push dword [ebp - 0x24]
call dword [0x63d18c]
mov edi, eax
cmp edi, ebx
je 0x404859
cmp esi, ebx
je 0x4047ad
or dword [ebp - 0x20], 0x10300
push 4
lea eax, [ebp - 0x20]
push eax
push 0x1f
push edi
call dword [0x63cf60]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x63d120]
push ebx
mov esi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x13
push edi
mov dword [ebp - 0x28], 0x100
call dword [0x63d1a4]
test eax, eax
jne 0x4047fd
lea ecx, [ebp + 8]
xor esi, esi
mov byte [ebp - 4], bl
call fcn.0040e5e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040e5e3
mov eax, dword [ebp - 0x2c]
mov edx, esi
jmp 0x40488f
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040f782
pop ecx
cmp eax, 0xc8
jne 0x4047da
cmp esi, ebx
je 0x404859
jmp 0x404854
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x5a4]
push eax
push edi
call dword [0x63d080]
xor esi, esi
cmp dword [ebp - 0x10], ebx
jbe 0x404859
push 1
lea eax, [ebp + esi - 0x5a4]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
push eax
call fcn.0040f7d3
inc dword [ebp - 0x14]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x404835
cmp dword [ebp - 0x10], ebx
ja 0x404817
push edi
call dword [0x63d054]
push dword [ebp - 0x24]
call dword [0x63d054]
push dword [ebp - 0x18]
call dword [0x63d054]
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040e5e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040e5e3
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4053f7
Capabilities:
Check http status code

Disassembly:
mov eax, 0x41d171
call sub.msvcrt.dll__EH_prolog
sub esp, 0x978
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
sub esp, 0xc
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 4], 2
call fcn.0040e5af
lea eax, [ebp - 0xb4]
push eax
call fcn.00403f45
add esp, 0x10
push 0xf
pop ecx
mov esi, eax
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
push 0x423532
lea ecx, [ebp - 0x30]
call fcn.0040e578
push ebx
push ebx
push ebx
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 3
call fcn.0040e7af
push eax
call dword [0x63d058]
push dword [0x62c334]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x74]
xor esi, esi
call dword [0x63d134]
test eax, eax
jne 0x40547e
inc esi
cmp dword [ebp - 0x10], ebx
je 0x4055c2
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [ebp - 0x10]
call dword [0x63d158]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x4055b9
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0x62c188]
push dword [ebp - 0x4c]
push 0x423660
push dword [ebp - 0x1c]
call dword [0x63d18c]
mov edi, eax
cmp edi, ebx
je 0x4055b0
cmp esi, ebx
je 0x4054f6
or dword [ebp - 0x20], 0x10300
push 4
lea eax, [ebp - 0x20]
push eax
push 0x1f
push edi
call dword [0x63cf60]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x63d120]
push ebx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x13
push edi
mov dword [ebp - 0x18], 0x100
call dword [0x63d1a4]
test eax, eax
jne 0x405535
mov ecx, dword [ebp + 8]
push 0x423664
call fcn.0040e578
jmp 0x4055ce
lea eax, [ebp - 0x1b4]
push eax
call fcn.0040f782
pop ecx
cmp eax, 0xc8
jne 0x40560a
cmp esi, ebx
je 0x4055a9
mov esi, 0x7cf
jmp 0x405592
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x4055a9
mov byte [ebp + eax - 0x984], bl
lea eax, [ebp - 0x984]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040e6f1
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0040e636
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0040e5e3
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x984]
push eax
push edi
call dword [0x63d080]
cmp eax, ebx
jne 0x405558
push edi
call dword [0x63d054]
push dword [ebp - 0x1c]
call dword [0x63d054]
push dword [ebp - 0x10]
call dword [0x63d054]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0040e5af
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 2
call fcn.0040e5e3
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040e5e3
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], bl
call fcn.0040e5e3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
push 0x42366c
call fcn.0040e578
jmp 0x4055ce
Function at 0x405e82
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
push 0x40
push 0
push esi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
jne 0x405ea0
xor eax, eax
inc eax
jmp 0x405f32
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x405f2f
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x405f2f
push dword [ebp + 0xc]
lea edi, [esi + 0x40]
push 0xf8
push eax
push edi
call dword [ebp + 8]
add esp, 0x10
test eax, eax
je 0x405e98
cmp dword [edi], 0x4550
jne 0x405f2f
mov eax, 0x10b
cmp word [esi + 0x58], ax
jne 0x405f2f
movzx eax, word [esi + 0x46]
test ax, ax
je 0x405f2f
imul eax, eax, 0x28
push eax
mov dword [esi + 0x140], eax
call fcn.0040f806
pop ecx
mov dword [esi + 0x138], eax
test eax, eax
jne 0x405f06
push 3
jmp 0x405f31
push dword [ebp + 0xc]
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push dword [esi + 0x140]
lea ecx, [ecx + edx + 0x18]
push ecx
push eax
mov dword [esi + 0x13c], ecx
call dword [ebp + 8]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x405f32
push 2
pop eax
pop edi
pop ebp
ret

Function at 0x406518
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x406552
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x406552
mov edx, 0x10b
cmp word [eax + ecx + 0x18], dx
jne 0x406552
push dword [ebp + 0xc]
push ecx
push dword [eax + ecx + 0x78]
call fcn.0040647c
add esp, 0xc
pop ebp
ret
xor eax, eax
pop ebp
ret