joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494ca0
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f918
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x610684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.Storing_XML_Started
push 0
push 4
mov dword [ebp - 4], 0
push str.AdobeGCUpdaterXMLWrapper
push dword [0x618c28]
call fcn.004b11f0
add esp, 0x14
cmp dword [ebp + 0x18], 0
je 0x494eb5
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x494eae
push 0x104
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.005637ad
push SysReAllocString
push 0x5d8afc
call fcn.0055fbc3
push eax
push 0x5d8afc
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0055f72e
push 7
push 0x5dfc48
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0055f72e
lea edi, [ebp - 0x31c]
add esp, 0x34
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x494d80
mov eax, dword [0x5d896c]
lea ecx, [ebp - 0x31c]
mov dword [edi], eax
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x494da0
mov eax, dword [str.AdobeGC]
mov dword [ecx], eax
mov eax, dword [0x5dfd4c]
mov dword [ecx + 4], eax
mov eax, dword [0x5dfd50]
mov dword [ecx + 8], eax
mov eax, dword [0x5dfd54]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x114]
push eax
call fcn.004659c0
add esp, 4
test eax, eax
jne 0x494e10
lea eax, [ebp - 0x114]
push eax
call fcn.00465c30
add esp, 4
mov esi, eax
lea eax, [ebp - 0x31c]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x494e10
push str.Could_not_retreive_path_to_folder
push 0
push 5
jmp 0x494eda
push SysReAllocString
push 0x5d8afc
call fcn.0055fbc3
push eax
push 0x5d8afc
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0055f72e
push 0xe
push str.adobegc_XXXXXX
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.0055f72e
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], 0
push eax
lea ecx, [ebp - 0x114]
call fcn.00465a30
add esp, 0x2c
test eax, eax
je 0x494ed1
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [ebp - 0x320]
cmovae eax, dword [ebp + 8]
push eax
push 0x5d7be8
push esi
call fcn.004947e0
add esp, 0xc
test eax, eax
jle 0x494ea3
lea eax, [ebp - 0x114]
mov ecx, ebx
push eax
call fcn.0044f530
push esi
call fcn.00553320
add esp, 4
jmp 0x494ed1
push str.Could_not_retreive_path_to_directory
jmp 0x494eba
push str.No_data_to_write
push 0
push 5
push str.AdobeGCUpdaterXMLWrapper
push dword [0x618c28]
call fcn.004b11f0
add esp, 0x14
push str.Storing_XML_Ended
push 0
push 4
push str.AdobeGCUpdaterXMLWrapper
push dword [0x618c28]
call fcn.004b11f0
mov eax, dword [ebp + 0x1c]
add esp, 0x14
cmp eax, 0x10
jb 0x494f02
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0044c890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544516
mov esp, ebp
pop ebp
ret
Function at 0x495850
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x49586d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x49587e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.00496a30
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x495908
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x495908
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x495908
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x49590b
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.Get_AdobeGC_client_download_path_status_____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x495930
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x49594d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x49595e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.00497250
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x4959e8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4959e8
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x4959e8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x4959eb
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_client_download_status_____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495a10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x495a2d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x495a3e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.00497a30
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x495ac8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x495ac8
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x495ac8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x495acb
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_Fetching_rules_status_____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x495af0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x495b0d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x495b1e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.0049a6c0
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x495ba8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x495ba8
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x495ba8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x495bab
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_Posting_rules_data_status_____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495cb0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x495ccb
lea eax, [edi + 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x495cdb
mov eax, 3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0049c3a0
mov edi, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x495d62
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x495d62
mov esi, dword [esp + 0x20]
mov eax, esi
or eax, dword [esp + 0x24]
je 0x495d62
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov ecx, esi
mov edx, dword [esp + 0x24]
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x495d65
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push edi
push str.AdobeGC_sending_ETS_event___Hostfile_modified_____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x495d90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x495dab
lea eax, [edi + 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x495dbb
mov eax, 3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0049ccf0
mov edi, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x495e42
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x495e42
mov esi, dword [esp + 0x20]
mov eax, esi
or eax, dword [esp + 0x24]
je 0x495e42
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov ecx, esi
mov edx, dword [esp + 0x24]
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x495e45
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push edi
push str.AdobeGC_sending_in_app_event____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x495e70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x495e8d
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], edi
je 0x495e9e
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.0049d130
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x495f28
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x495f28
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x495f28
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x495f2b
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push str.AdobeGC_sending_machine_event____d__took_____.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0270
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4a029b
push 8
call fcn.00544535
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, dword [edi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 4]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x4a032c
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4a032c
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x4a032c
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x4a032f
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a0360
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4a038b
push 8
call fcn.00544535
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
cmp dword [ebp + 0x10], 0
mov ecx, dword [edi + 4]
push 0x7d
setne al
movzx eax, al
mov edx, dword [ecx]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx + 8]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x4a0423
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4a0423
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x4a0423
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00545440
mulsd xmm0, qword [0x5e3018]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00545440
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x4a0426
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.0049bca0
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a8220
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], esi
jb 0x4a823b
mov eax, dword [edi]
jmp 0x4a823d
mov eax, edi
mov ecx, dword [ebp + 8]
mov byte [eax], 0
test ecx, ecx
je 0x4a839a
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4a839a
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 4], al
inc ecx
mov ah, byte [ebp - 2]
inc esi
mov dl, byte [ebp - 3]
mov dh, byte [ebp - 4]
mov dword [ebp + 8], ecx
mov byte [ebp - 0xb], ah
mov byte [ebp - 9], dl
mov byte [ebp - 0xa], dh
cmp esi, 3
jne 0x4a82d7
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 8], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 7], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
xor esi, esi
nop
movzx eax, byte [ebp + esi - 8]
mov ecx, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.00453520
inc esi
cmp esi, 4
jl 0x4a82b0
mov ecx, dword [ebp + 8]
xor esi, esi
mov dl, byte [ebp - 9]
mov dh, byte [ebp - 0xa]
test ebx, ebx
jne 0x4a8256
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4a8390
mov eax, esi
cmp esi, 3
jge 0x4a8310
cmp eax, 3
jae 0x4a83a3
mov byte [ebp + eax - 4], 0
inc eax
cmp eax, 3
jl 0x4a82f4
mov cl, byte [ebp - 2]
mov dl, byte [ebp - 3]
mov dh, byte [ebp - 4]
jmp 0x4a8313
mov cl, byte [ebp - 0xb]
mov al, dh
xor ebx, ebx
shr al, 2
and dh, 3
mov byte [ebp - 8], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, cl
mov byte [ebp - 7], dh
shr al, 6
and cl, 0x3f
add dl, al
mov byte [ebp - 5], cl
lea eax, [esi + 1]
mov byte [ebp - 6], dl
mov dword [ebp - 4], eax
test eax, eax
jle 0x4a836e
mov esi, eax
nop
movzx eax, byte [ebp + ebx - 8]
mov ecx, edi
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
push 1
call fcn.00453520
inc ebx
cmp ebx, esi
jl 0x4a8350
mov esi, dword [ebp - 0x10]
cmp esi, 3
jge 0x4a8390
mov ebx, 3
sub ebx, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, edi
call fcn.00453520
sub ebx, 1
jne 0x4a8380
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00544a28
int3
Function at 0x4a9130
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3320
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x610684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov edi, dword [0x623060]
mov eax, 7
xor ecx, ecx
mov esi, dword [edi]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 1
cmp esi, edi
je 0x4a9235
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
nop dword [eax]
cmp dword [esi + 0x24], 0x10
lea ecx, [esi + 0x10]
jb 0x4a91ab
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.004a8d00
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044f880
push 2
push 0x5e20cc
lea ecx, [ebp - 0x28]
call fcn.00452ce0
cmp dword [esi + 0x3c], 0x10
lea ecx, [esi + 0x28]
jb 0x4a91dd
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.004a8d00
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004533a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0xa0000000
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x48]
call ebx
lea ecx, [ebp - 0x44]
call fcn.004535d0
mov esi, dword [ebp - 0x44]
cmp esi, edi
jne 0x4a91a0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a9232
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0044f7a0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
cmp eax, 8
jb 0x4a925b
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0044f7a0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544516
mov esp, ebp
pop ebp
ret

Function at 0x4ac8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 0xc
test edx, edx
je 0x4ac968
push ebx
push esi
mov ecx, 0x5d5053
mov byte [edx], 0xda
sub ecx, edx
mov dword [ebp - 4], 0x33
push edi
mov dword [ebp - 8], ecx
lea eax, [edx + 1]
mov esi, 0x5d5050
mov edi, 0x5d5051
mov ebx, 0x5d5052
mov ecx, 0x5d5054
sub esi, edx
sub edi, edx
sub ebx, edx
sub ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [esi + eax]
lea eax, [eax + 5]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [edi + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
sub dword [ebp - 4], 1
mov byte [eax - 1], cl
jne 0x4ac925
pop edi
pop esi
pop ebx
mov eax, 0x100
mov esp, ebp
pop ebp
ret