joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b410
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1460
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x49b455
mov eax, dword [edi]
jmp 0x49b457
mov eax, edi
mov byte [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x49b481
push str.No_input_file_path_data
push 0
push 5
push str.AdobeGCVersionWrapper
push dword [0x64d01c]
call fcn.00555430
add esp, 0x14
jmp 0x49b5d2
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.0049bd40
mov esi, eax
add esp, 4
test esi, esi
mov ecx, 0x60a7b8
cmovne ecx, esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00467340
push esi
mov byte [ebp - 4], 1
call fcn.00593b50
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x49b4cb
push str.Error_converting_ascii_path_to_wide_path
push 0
push 5
jmp 0x49b5aa
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x49b5bd
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0057b68c
mov esi, eax
add esp, 4
test esi, esi
je 0x49b5a1
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
push esi
cmovae ecx, dword [ebp - 0x2c]
push ebx
push dword [ebp - 0x14]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x49b573
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0x60a774
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x49b596
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x49b596
movzx eax, word [ecx + 0xc]
mov dx, word [ecx + 8]
push edi
push eax
movzx eax, word [ecx + 0xe]
mov cx, word [ecx + 0xa]
push eax
call fcn.0049b610
add esp, 0xc
push esi
call fcn.0057b687
add esp, 4
jmp 0x49b5bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_retrieving_version_for_file_:__d
push 0
push 2
push str.AdobeGCVersionWrapper
push dword [0x64d01c]
call fcn.00555430
add esp, 0x18
push esi
call fcn.0057b687
add esp, 4
jmp 0x49b5bd
push str.Error_creating_memory_for_version
push 0
push 2
push str.AdobeGCVersionWrapper
push dword [0x64d01c]
call fcn.00555430
add esp, 0x14
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x49b5d2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004688c0
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x49b5e7
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00459720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
Function at 0x49b8a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x49b93d
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0049bda0
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49b8e3
sub ecx, edx
je 0x49b8f9
cmp byte [ecx + esi - 1], 0x5c
jne 0x49b8f9
mov byte [ecx + esi - 1], al
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x49b900
sub edx, ecx
or ecx, 0xffffffff
cmp edx, 0x104
cmovb ecx, edx
push ecx
push esi
push 0x104
push edi
call fcn.00595fdb
push esi
call fcn.00593b50
add esp, 0x14
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0057b676
mov esp, ebp
pop ebp
ret

Function at 0x49b990
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.0049bd40
mov edi, eax
add esp, 4
test edi, edi
je 0x49b9bd
push esi
push edi
call fcn.0059525b
push edi
mov esi, eax
call fcn.00593b50
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebp
ret
push 0x16
call fcn.00593fa9
add esp, 4
or eax, 0xffffffff
pop edi
pop ebp
ret

Function at 0x49ba80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
dec edx
push edi
mov edi, ecx
cmp edx, 0xfe
ja case.0x49baa7.2
movzx eax, byte [edx + 0x49bb94]
jmp dword [eax*4 + 0x49bb74]
mov esi, 0x2b
jmp 0x49badd
mov esi, 0x23
jmp 0x49badd
mov esi, 0x1a
jmp 0x49badd
mov esi, 0x1c
jmp 0x49badd
mov esi, 0x2a
jmp 0x49badd
mov esi, 0x26
jmp 0x49badd
mov esi, 0x2c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
mov eax, esi
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x49bb1b
cmp esi, 0x2c
jne 0x49bb60
lea edx, [esi - 0x2b]
mov ecx, edi
call fcn.0049ba80
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.0049bda0
mov esi, eax
add esp, 4
test esi, esi
je 0x49bb60
push 0xffffffffffffffff
push esi
push 0x104
push edi
call fcn.00595fdb
xor ecx, ecx
test eax, eax
push esi
cmovne edi, ecx
call fcn.00593b50
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0057b676
mov esp, ebp
pop ebp
ret
Function at 0x49c570
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1772
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x314], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x31c], esi
mov dword [esi + 0x10], 0
jb 0x49c5e1
mov eax, dword [esi]
jmp 0x49c5e3
mov eax, esi
xor ecx, ecx
mov byte [eax], 0
cmp byte [str.unknown], cl
mov eax, 7
cmove eax, ecx
mov ecx, esi
push eax
push str.unknown
call fcn.0045f8d0
push 0x200
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x318], 1
call fcn.00581fe0
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x49c6b8
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00581fe0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x110], 0
jne 0x49c697
xor ecx, ecx
jmp 0x49c6a9
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49c6a0
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.0045f8d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
Function at 0x49c6e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1772
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x314], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x31c], esi
mov dword [esi + 0x10], 0
jb 0x49c751
mov eax, dword [esi]
jmp 0x49c753
mov eax, esi
xor ecx, ecx
mov byte [eax], 0
cmp byte [str.unknown], cl
mov eax, 7
cmove eax, ecx
mov ecx, esi
push eax
push str.unknown
call fcn.0045f8d0
push 0x200
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x318], 1
call fcn.00581fe0
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x49c828
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00581fe0
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x110], 0
jne 0x49c807
xor ecx, ecx
jmp 0x49c819
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49c810
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.0045f8d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
Function at 0x49d0f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0xa30], edx
push ebx
xor ebx, ebx
mov dword [ebp - 0xa2c], eax
test eax, eax
je 0x49d27a
push 0x20a
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00581fe0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa28], ax
lea eax, [ebp - 0xa28]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x1fe
ja 0x49d27a
mov eax, dword [0x60f124]
push esi
mov dword [ebp - 0xc], eax
mov ax, word [0x60f128]
push edi
mov word [ebp - 8], ax
lea edi, [ebp - 0xa28]
mov ax, word [edi]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x49d260
lea esi, [ebp - 0x214]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49d1a0
sub esi, ecx
sar esi, 1
cmp esi, 0x104
jae 0x49d260
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0xa2c]
call fcn.00596f64
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0xa2c]
jne 0x49d1e9
cmp word [eax + esi*2], 0x5c
jne 0x49d1e9
mov ebx, 1
jmp 0x49d1eb
xor ebx, ebx
test ebx, ebx
je 0x49d260
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push str._s_s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.0049c110
lea ecx, [ebp - 0x41c]
add esp, 0x14
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49d220
sub ecx, edx
lea eax, [ebp - 0x41c]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x628]
push 0x105
push eax
call fcn.0059675f
mov ecx, dword [ebp - 0xa30]
lea eax, [ebp - 0x628]
add esp, 0x10
push eax
call fcn.004677c0
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x49d260
test ebx, ebx
jne 0x49d278
cmp word [edi], bx
jne 0x49d172
pop edi
pop esi
mov ecx, dword [ebp - 4]
test ebx, ebx
pop ebx
setne al
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
Function at 0x4acd80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4acdab
push 8
call fcn.0057b695
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, dword [edi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 4]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x4ace3c
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4ace3c
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x4ace3c
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.0057c8b0
mulsd xmm0, qword [0x614818]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.0057c8b0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x4ace3f
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.004a8a80
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ace70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4ace9b
push 8
call fcn.0057b695
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
cmp dword [ebp + 0x10], 0
mov ecx, dword [edi + 4]
push 0x7d
setne al
movzx eax, al
mov edx, dword [ecx]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx + 8]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x4acf33
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4acf33
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x4acf33
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.0057c8b0
mulsd xmm0, qword [0x614818]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.0057c8b0
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x4acf36
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.004a8a80
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b6550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7166
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x645624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0057b695
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0057d42a
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b77b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], esi
jb 0x4b77cb
mov eax, dword [edi]
jmp 0x4b77cd
mov eax, edi
mov ecx, dword [ebp + 8]
mov byte [eax], 0
test ecx, ecx
je 0x4b792a
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4b792a
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 4], al
inc ecx
mov ah, byte [ebp - 2]
inc esi
mov dl, byte [ebp - 3]
mov dh, byte [ebp - 4]
mov dword [ebp + 8], ecx
mov byte [ebp - 0xb], ah
mov byte [ebp - 9], dl
mov byte [ebp - 0xa], dh
cmp esi, 3
jne 0x4b7867
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 8], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 7], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
xor esi, esi
nop
movzx eax, byte [ebp + esi - 8]
mov ecx, edi
movzx eax, byte [eax + 0x608708]
push eax
push 1
call fcn.0045ff30
inc esi
cmp esi, 4
jl 0x4b7840
mov ecx, dword [ebp + 8]
xor esi, esi
mov dl, byte [ebp - 9]
mov dh, byte [ebp - 0xa]
test ebx, ebx
jne 0x4b77e6
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4b7920
mov eax, esi
cmp esi, 3
jge 0x4b78a0
cmp eax, 3
jae 0x4b7933
mov byte [ebp + eax - 4], 0
inc eax
cmp eax, 3
jl 0x4b7884
mov cl, byte [ebp - 2]
mov dl, byte [ebp - 3]
mov dh, byte [ebp - 4]
jmp 0x4b78a3
mov cl, byte [ebp - 0xb]
mov al, dh
xor ebx, ebx
shr al, 2
and dh, 3
mov byte [ebp - 8], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 7], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 5], cl
lea eax, [esi + 1]
mov byte [ebp - 6], dl
mov dword [ebp - 4], eax
test eax, eax
jle 0x4b78fe
mov esi, eax
nop
movzx eax, byte [ebp + ebx - 8]
mov ecx, edi
movzx eax, byte [eax + 0x608708]
push eax
push 1
call fcn.0045ff30
inc ebx
cmp ebx, esi
jl 0x4b78e0
mov esi, dword [ebp - 0x10]
cmp esi, 3
jge 0x4b7920
mov ebx, 3
sub ebx, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, edi
call fcn.0045ff30
sub ebx, 1
jne 0x4b7910
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0057bdbe
int3
Function at 0x4b86d0
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6140
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov edi, dword [0x65c000]
mov eax, 7
xor ecx, ecx
mov esi, dword [edi]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 1
cmp esi, edi
je 0x4b87d5
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
nop dword [eax]
cmp dword [esi + 0x24], 0x10
lea ecx, [esi + 0x10]
jb 0x4b874b
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.004b82a0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00467cf0
push 2
push 0x6119e8
lea ecx, [ebp - 0x28]
call fcn.00470df0
cmp dword [esi + 0x3c], 0x10
lea ecx, [esi + 0x28]
jb 0x4b877d
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.004b82a0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00470f20
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0xa0000000
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x48]
call ebx
lea ecx, [ebp - 0x44]
call fcn.00467650
mov esi, dword [ebp - 0x44]
cmp esi, edi
jne 0x4b8740
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4b87d2
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004688c0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
cmp eax, 8
jb 0x4b87fb
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004688c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret
Function at 0x4ba250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6450
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x645624]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x64], edi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.004be210
test al, al
je 0x4ba44e
xor ecx, ecx
mov dword [ebp - 0x48], 7
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x34]
mov word [ebp - 0x5c], cx
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
call fcn.00467cf0
push str..trace
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00467340
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.004be490
mov byte [ebp - 4], 1
mov bl, al
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x4ba308
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.004688c0
test bl, bl
je 0x4ba425
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
call fcn.004be2a0
test al, al
je 0x4ba425
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4ba346
mov dword [esi + 0x64], 0xa
jmp 0x4ba425
push str..debug
lea ecx, [ebp - 0x44]
call fcn.00467340
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004be490
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov bl, al
call fcn.00467300
test bl, bl
je 0x4ba384
lea ecx, [ebp - 0x2c]
call fcn.004be1f0
test al, al
jne 0x4ba419
lea ecx, [ebp - 0x2c]
call fcn.004be540
test al, al
je 0x4ba425
push str.asu.trace
lea ecx, [ebp - 0x44]
call fcn.00467340
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.004be2a0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov bl, al
call fcn.00467300
test bl, bl
je 0x4ba425
lea ecx, [ebp - 0x2c]
call fcn.004be1f0
test al, al
je 0x4ba3d7
mov dword [esi + 0x64], 0xa
jmp 0x4ba425
lea ecx, [ebp - 0x2c]
call fcn.004be540
test al, al
je 0x4ba425
push str.asu.debug
lea ecx, [ebp - 0x44]
call fcn.00467340
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.004be2a0
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.00467300
test bl, bl
je 0x4ba425
lea ecx, [ebp - 0x2c]
call fcn.004be1f0
test al, al
je 0x4ba425
cmp edi, 0x14
jle 0x4ba425
mov dword [esi + 0x64], 0x14
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x4ba43a
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.004688c0
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4ba463
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004688c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0057b676
mov esp, ebp
pop ebp
ret 4